Fuzzing system, fuzzing method, and recording medium for detecting vulnerabilities in IoT devices

Abstract

The present invention relates to a fuzzing system for detecting vulnerabilities in an IoT device, comprising: a user terminal that generates user actions through a GUI (Graphical User Interface) to run a companion application for controlling an IoT device; and a fuzzing device that collects network packets transmitted and received according to the user actions, identifies a target activity which is a user action that generates network packets, identifies a target send message corresponding to the target activity, and performs black box fuzzing that acts as a fuzzing trigger to detect vulnerabilities in the IoT device when the target send message is identified. By doing so, vulnerabilities in the IoT device can be detected based on a black box, regardless of whether the application for controlling the IoT device is obfuscated.

Description

Technology Field

[0001] The present invention relates to a fuzzing system for detecting vulnerabilities in IoT devices using a GUI regardless of whether the application is obfuscated, a fuzzing method, and a recording medium for performing the same. Background Technology

[0002] Internet of Things (IoT) devices (hereinafter referred to as IoT devices) have the advantage of enhancing the user experience of the IoT environment by collecting and processing data through sensors and communication; as a result, the use of IoT devices has increased exponentially in recent years, leading to the provision of various services.

[0003] Due to the growth of the IoT device market, IoT devices offering various services and functions are continuously being released; however, because IoT devices not properly managed by manufacturers may use open-source versions with vulnerabilities or lack basic security mechanisms, such devices with vulnerabilities can lead to incidents such as personal information leaks.

[0004] For example, IoT devices such as Wi-Fi cameras, smart panels, and AI speakers use custom firmware from each manufacturer, and the lack of system and communication standards makes it difficult to research universal security solutions.

[0005] Furthermore, there is a problem in that obtaining firmware running on IoT devices is complex, and unpacking and analyzing actual firmware samples is very difficult.

[0006] In particular, to use a black-box-based approach for firmware analysis, knowledge of which data formats are allowed on the IoT device being analyzed is required.

[0007] However, consistent application of a black-box-based approach is difficult due to a lack of technical documentation or the protocols used by various types of IoT devices.

[0008] DIANE is a tool that identifies optimal functions within companion applications of IoT devices. When DIANE is invoked, it has the advantage of generating well-structured inputs with few restrictions on the analyzed IoT devices, allowing for efficient fuzzing of IoT devices while simultaneously monitoring for anomalies.

[0009] And in the case of DIANE, it filters the source code of all APKs by network package name, identifies send message candidates, and proceeds with fuzzing.

[0010] However, DIANE has limitations in detecting all vulnerabilities because obfuscated applications are filtered out.

[0011] In particular, as the level and method of obfuscation vary from application to application, there is a growing need for black-box-based fuzzing techniques targeting obfuscated applications. Prior art literature

[0012] Korean Patent Publication No. 10-1859988 The problem to be solved

[0013] The present invention has been devised to solve the above-mentioned problems, and the objective of the present invention is to provide a fuzzing system for detecting vulnerabilities in an IoT device, a fuzzing method, and a recording medium for performing the same, which can detect vulnerabilities in an IoT device based on a black box regardless of whether the application for controlling the IoT device is obfuscated. means of solving the problem

[0014] A fuzzing system for detecting vulnerabilities in an IoT device according to an embodiment of the present invention for achieving the above objective comprises: a user terminal that generates user actions through a GUI (Graphical User Interface) to run a companion application for controlling the IoT device; and a fuzzing device that collects network packets transmitted and received according to the user actions, identifies a target activity which is a user action that generates the network packets, identifies a target send message corresponding to the target activity, and performs black box fuzzing that acts as a fuzzing trigger to detect vulnerabilities in the IoT device when the target send message is identified.

[0015] And identifying the target activity may involve performing static analysis on the companion application to extract an activity list, and extracting a method for the target activity from the activity list based on the collected network packets.

[0016] Additionally, identifying the target send message may include performing dynamic analysis to generate a call graph by hooking the extracted method and logging the operation of the hooked method, and designating the leaf node located at the bottom of the generated call graph as a candidate send message.

[0017] And identifying the target send message may further include dynamically connecting all functions corresponding to the specified candidate send message to execute the companion application, and, as a result of executing the companion application, storing the function that generates the network packet as a function of the candidate send message to perform filtering on the candidate send message.

[0018] In addition, storing as a function of the above candidate send message may involve collecting the execution time and the elapsed time of network activity whenever the function of the above candidate send message is executed, and storing them together with the function of the above candidate send message.

[0019] And identifying the target send message may further include clustering the candidate send messages based on the elapsed time to generate a plurality of clusters, and selecting the cluster with the smallest average elapsed time among the plurality of clusters.

[0020] Additionally, identifying the target send message may involve performing static analysis on the function of the candidate send message corresponding to the selected cluster to identify the data transforming function and generate a transformation data chain, and identifying the lowest function in the transformation data chain as the target send message.

[0021] And performing the black box fuzzing above may involve considering the top-level function in the transformation data chain as the fuzzing trigger, adjusting the parameters of the fuzzing trigger according to a preset fuzzing rule to generate a mutation, and performing fuzzing.

[0022] Meanwhile, a fuzzing method according to an embodiment of the present invention for achieving the above objective relates to a fuzzing method in a fuzzing device linked with a user terminal that generates user actions through a GUI (Graphical User Interface) to run a companion application for controlling an IoT device, and comprises the steps of: collecting network packets transmitted and received according to the user actions; identifying a target activity which is a user action that generates the network packets; identifying a target send message corresponding to the target activity; and, when the target send message is identified, performing black box fuzzing that acts as a fuzzing trigger to detect vulnerabilities of the IoT device.

[0023] And in the step of identifying the target activity, a static analysis is performed on the companion application to extract an activity list, and a method for the target activity within the activity list can be extracted based on the collected network packets.

[0024] Additionally, the step of identifying the target send message may include performing dynamic analysis to generate a call graph by hooking the extracted method and logging the operation of the hooked method, and designating a leaf node located at the bottom of the generated call graph as a candidate send message.

[0025] And the step of identifying the target send message may further include the step of dynamically connecting all functions corresponding to the designated candidate send message to execute the companion application, and, as a result of executing the companion application, storing the function that generates the network packet as a function of the candidate send message to perform filtering on the candidate send message.

[0026] In addition, storing as a function of the above candidate send message may involve collecting the execution time and the elapsed time of network activity whenever the function of the above candidate send message is executed, and storing them together with the function of the above candidate send message.

[0027] And in paragraph 13, the step of identifying the target send message may further include the step of clustering the candidate send messages based on the elapsed time to generate a plurality of clusters, and selecting the cluster with the smallest average elapsed time among the plurality of clusters.

[0028] In addition, in the step of identifying the target send message, static analysis is performed on the function of the candidate send message corresponding to the selected cluster to identify the data transforming function and generate a transformation data chain, and the lowest function in the transformation data chain can be identified as the target send message.

[0029] And in the step of performing the black box fuzzing, the top-most function in the transformation data chain is considered as the fuzzing trigger, and the parameters of the fuzzing trigger are adjusted according to a preset fuzzing rule to generate a mutation and perform fuzzing.

[0030] Meanwhile, a recording medium according to one embodiment of the present invention for achieving the above objective may be a recording medium having a computer-readable computer program recorded thereon for performing the fuzzing method. Effects of the invention

[0031] According to one aspect of the present invention described above, by providing a fuzzing system for detecting vulnerabilities of an IoT device, a fuzzing method, and a recording medium for performing the same, vulnerabilities of an IoT device can be detected based on a black box regardless of whether an application for controlling the IoT device is obfuscated. Brief explanation of the drawing

[0032] FIG. 1 is a drawing for explaining the configuration of a purging system according to an embodiment of the present invention, FIG. 2 is a diagram illustrating the overall process of detecting vulnerabilities in an IoT device in a fuzzing system according to an embodiment of the present invention. FIG. 3 is a diagram illustrating a target activity identified by a fuzzing device according to an embodiment of the present invention. FIG. 4 is a diagram illustrating an activity list extracted from an application of an IoT device by a fuzzing device according to an embodiment of the present invention. FIG. 5 is a diagram illustrating the result of a fuzzing device extracting a method for a target activity according to an embodiment of the present invention, and, FIG. 6 is a flowchart illustrating a purging method according to one embodiment of the present invention. Specific details for implementing the invention

[0033] The following detailed description of the invention refers to the accompanying drawings, which illustrate specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that various embodiments of the invention are different but need not be mutually exclusive. For example, specific shapes, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in relation to one embodiment. It should also be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the invention. Accordingly, the following detailed description is not intended to be limiting, and the scope of the invention is limited only by the appended claims, including all equivalents to those claimed therein, provided appropriately described. Similar reference numerals in the drawings refer to the same or similar functions across various aspects.

[0034] The components according to the present invention are defined by functional distinction rather than physical distinction, and can be defined by the functions each performs. Each component may be implemented as hardware or as program code and processing units that perform each function, and the functions of two or more components may be included and implemented in a single component. Therefore, it should be noted that the names assigned to the components in the following embodiments are not intended to physically distinguish each component but are assigned to imply the representative function performed by each component, and that the technical concept of the present invention is not limited by the names of the components.

[0035] Preferred embodiments of the present invention will be described in more detail below with reference to the drawings.

[0036] FIG. 1 is a diagram illustrating the configuration of a fuzzing system (10) according to one embodiment of the present invention, and FIG. 2 is a diagram illustrating the overall process of detecting vulnerabilities of an IoT device (1) in a fuzzing system (10) according to one embodiment of the present invention.

[0037] The system (10) according to the present embodiment includes an IoT device (1), a user terminal (3), and a fuzzing device (100).

[0038] The IoT device (1), user terminal (3), and fuzzing device (100) constituting the system (10) may be able to communicate with each other through a network, and software (application) for performing a fuzzing method may be installed and executed. In addition, the IoT device (1), user terminal (3), and fuzzing device (100) may be controlled by software (application) for performing an IoT packet automatic generation method.

[0039] An IoT device (1) may refer to a device that uses technology to collect, exchange, analyze, and interact with various devices connected to each other via the internet.

[0040] These IoT devices (1) may include various devices such as sensors, cameras, home appliances, vehicles, factory production facilities, and building systems, as well as general computer devices such as traditional computers and smartphones.

[0041] And the IoT device (1) can be controlled and operated through a mobile companion application distributed by each manufacturer.

[0042] A user terminal (3) can be provided to control and operate the IoT device (1) using a terminal carried by the user.

[0043] To this end, a mobile companion application can be installed and run on the user terminal (3).

[0044] The user terminal (3) and the IoT device (1) may communicate directly (Direct Connection) via Wi-Fi, etc., or indirectly (Cloud-based Connection) based on a separate cloud.

[0045] And the user terminal (3) can communicate with the fuzzing device (100) and receive commands from the fuzzing device (100).

[0046] Accordingly, the user terminal (3) can control the companion application based on the command received from the fuzzing device (100).

[0047] Additionally, the user terminal (3) can generate user actions through the GUI (Graphical User Interface) by means of commands received from the fuzzing device (100) or user operations to execute the companion application.

[0048] Meanwhile, the fuzzing device (100) according to the present embodiment is provided to detect vulnerabilities of the IoT device (1) regardless of whether the application for controlling the IoT device (1) is obfuscated.

[0049] To this end, the fuzzing device (100) can communicate with the IoT device (1) and the user terminal (3).

[0050] At this time, the fuzzing device (100) may be a separate terminal or a part module of a terminal, and the fuzzing device (100) may be in the form of a server or an engine, and may be referred to by other terms such as device, apparatus, terminal, UE (user equipment), MS (mobile station), wireless device, handheld device, etc.

[0051] And the fuzzing device (100) can execute or create various software based on an operating system (OS), that is, a system. Here, the operating system is a system program that enables software to use the hardware of the device, and can include all mobile computer operating systems such as Android OS, iOS, Windows Mobile OS, Bada OS, Symbian OS, BlackBerry OS, etc., as well as computer operating systems such as Windows family, Linux family, Unix family, MAC, AIX, HP-UX, etc.

[0052] The fuzzing device (100) can collect network packets transmitted and received according to user actions at the user terminal (3).

[0053] Specifically, the fuzzing device (100) can detect user actions through the GUI of the user terminal (3).

[0054] For example, if the user terminal (3) is a terminal based on the Android operating system, various user actions will continuously occur in the GUI based on the Android operating system. That is, in the user terminal (3), action events such as touch, swipe, long-touch, click, double-click, etc. can occur in response to event triggers of the GUI, such as toggles and buttons.

[0055] Accordingly, the fuzzing device (100) according to the present embodiment detects action events based on a GUI operating on such a user terminal (3) and can check whether network packets are generated according to the action events through packet sniffing.

[0056] And the fuzzing device (100) can identify a target activity, which is a user action that generates a network packet.

[0057] Here, an activity may refer to the most basic element for configuring the UI displayed on the screen of the user terminal (3).

[0058] FIG. 3 is a diagram illustrating an exemplary target activity identified by a fuzzing device (100) according to an embodiment of the present invention, and is a diagram illustrating an exemplary target activity in which a network packet is generated through a user action in an application for controlling a Wi-Fi camera IC see product, which is an IoT device (1).

[0059] And the fuzzing device (100) identifying the target activity may be extracting a method (M) for the target activity.

[0060] Specifically, the fuzzing device (100) can extract an activity list by performing static analysis on a companion application provided for controlling an IoT device (1).

[0061] FIG. 4 is a diagram illustrating a list of activities extracted by a fuzzing device (100) from an application of an IoT device (1). Specifically, FIG. 4 is a diagram illustrating activities and methods (M) extracted from a companion application of a Wi-Fi camera IC see product, which is an IoT device (1).

[0062] The fuzzing device (100) can extract all activities of the obfuscated APK through the open-source Androguard Tool to extract an activity list.

[0063] And the fuzzing device (100) can extract a method (M) for a target activity identified within an activity list based on the collected network packets.

[0064] As a result of the fuzzing device (100) performing static analysis on the companion application of the IoT device (1), a Wi-Fi camera IC see product, the activity list was extracted by extracting all 207 activities from the IC see application as shown in FIG. 4.

[0065] Meanwhile, FIG. 5 is a diagram illustrating, exemplarily, the result of the fuzzing device (100) extracting a method (M) for a target activity.

[0066] After extracting the activity list, the fuzzing device (100) can perform the process of analyzing the internal data of the collected network packet to identify which activity the network packet originated from.

[0067] Through this, the fuzzing device (100) extracted 168 methods (M) of target activities in which network packets occur in the IC see application, as shown in FIG. 5.

[0068] The process of the fuzzing device (100) performing static analysis to extract an activity list of the IoT device (1) is illustrated in FIG. 2 as being after network packets have been collected, but this is merely an exemplary case for convenience of explanation and may be performed before network packets have been collected.

[0069] And the fuzzing device (100) can identify a target send message (SM) corresponding to a target activity.

[0070] The fuzzing device (100) according to the present embodiment can perform dynamic analysis to identify a target send message (SM) by hooking a method (M) of a target activity and logging the operation of the hooked method (M) to generate a call graph.

[0071] And the fuzzing device (100) can designate a leaf node located at the bottom of the call graph generated to identify the target send message as a candidate send message (CSM).

[0072] Here, hooking can mean intercepting or altering the call of a function or method (M) to modify the original behavior or add new behavior.

[0073] Accordingly, the fuzzing device (100) performs hooking on the method (M) of the extracted target activity. For example, the fuzzing device (100) can perform the hooking process through the pysoot tool.

[0074] Generally, logic to be executed when the function of method (M) is called is added, and this logic can record the call information of method (M), passed arguments, return value, etc.

[0075] The fuzzing device (100) according to the present embodiment can analyze information such as the operation pattern, return value, and call time of each hooked method (M) in detail based on the log recorded while logging the operation of each hooked method (M).

[0076] Through this, the fuzzing device (100) can generate a call graph representing the order and relationship of function calls based on the collected data, and from this, designate leaf nodes as candidate send messages (CSM).

[0077] And the fuzzing device (100) can execute a companion application by dynamically linking all functions corresponding to a specified candidate send message (CSM).

[0078] At this time, the fuzzing device (100) can analyze the operation pattern of the function corresponding to the candidate send message (CSM), the associated API call, etc. together.

[0079] Accordingly, the fuzzing device (100) can check whether a network packet actually occurs as a result of running the companion application and store the function that generates the network packet as a function of the candidate send message (CSM).

[0080] And the fuzzing device (100) can perform filtering on stored candidate send messages (CSM) to identify the target send message (SM).

[0081] The fuzzing device (100) according to the present embodiment can store the time of execution and the elapsed time of network activity whenever the function of the candidate send message (CSM) is executed when storing the function of the candidate send message (CSM), and store them together with the function of the candidate send message (CSM).

[0082] And the fuzzing device (100) can cluster candidate send messages (CSM) to identify a target send message (SM).

[0083] Specifically, the fuzzing device (100) can generate multiple clusters by clustering candidate send messages (CSMs) based on the elapsed time stored along with the function of the candidate send messages (CSMs). Then, the fuzzing device (100) can select the cluster with the smallest average elapsed time among the generated multiple clusters.

[0084] To this end, the fuzzing device (100) can use a k-means algorithm to cluster candidate send messages (CSM) into k (k=2) clusters.

[0085] Since the function that causes network activity is less affected by noise, the mean and standard deviation become small. Therefore, the fuzzing device (100) according to the present embodiment selects the cluster with the smallest average of the elapsed time among the two clusters.

[0086] In addition, the fuzzing device (100) according to the present embodiment can identify a data-transforming function (DTF) by performing static analysis on the function of a candidate send message (CSM) corresponding to a selected cluster to identify a target send message (SM), and can generate a transformation data chain.

[0087] The reason the fuzzing device (100) according to the present embodiment identifies the data transforming function (DTF) is that the optimal fuzzing trigger is located between the input validation function and the data transforming function (DTF).

[0088] Accordingly, the fuzzing device (100) can identify the data transforming function (DTF) by statically identifying the variables holding data transmitted by the function of the candidate send message (CSM) and the code locations of the said variables.

[0089] Therefore, the fuzzing device (100) can generate a transformation data chain including an identified data transforming function (DTF) as illustrated in FIG. 2.

[0090] And the fuzzing device (100) identifies the lowest function in the transformation data chain as the target send message (SM).

[0091] When a target send message (SM) is identified, the fuzzing device (100) can perform black box fuzzing to detect vulnerabilities in the IoT device (1) by using the top-level function of the target send message (SM) as a fuzzing trigger.

[0092] Specifically, the fuzzing device (100) can consider the top-level function (TCN) in the transformation data chain as a fuzzing trigger.

[0093] And the fuzzing device (100) can generate a mutation and perform fuzzing by adjusting the parameters of the fuzzing trigger according to a preset fuzzing rule.

[0094] In addition, the fuzzing device (100) can prepare collision conditions in advance and classify whether there are collisions by monitoring response messages from the IoT device (1) through the prepared collision conditions.

[0095] Accordingly, the fuzzing device (100) according to the present embodiment can perform black box fuzzing to detect vulnerabilities of the IoT device (1).

[0096] The conventional DIANE methodology dynamically analyzes the APK source code to extract all classes and performs filtering by specific class names. Then, DIANE hooks only network-related packages and identifies candidate Send Messages (CSMs).

[0097] However, conventional DIANE methodologies perform filtering based on specific class names, which inevitably leads to the filtering of obfuscated applications. Consequently, the DIANE methodology has a clear limitation in that it cannot detect all vulnerabilities, as it identifies candidate send messages (CSMs) with the corresponding class excluded during the filtering process if the packet is obfuscated and originates from the network.

[0098] On the other hand, the fuzzing device (100) according to the present embodiment detects user actions occurring based on a GUI, extracts all methods (M) of activities in which network packets occur among user actions, and can identify candidate send messages (CSM) by hooking the extracted methods (M).

[0099] Therefore, the fuzzing device (100) according to the present embodiment can solve the problem of candidate send messages (CSM) being excluded due to obfuscation of source code and packets, regardless of whether the application is obfuscated or not, even without knowing the internal structure or code of the application.

[0101] Meanwhile, FIG. 6 is a flowchart for explaining a purging method according to an embodiment of the present invention. Since the purging method according to an embodiment of the present invention is carried out on a configuration substantially identical to that of the purging system (10) shown in FIG. 1, the same reference numerals are assigned to the same components as those of the purging system (10) in FIG. 1, and repetitive descriptions are omitted.

[0102] The fuzzing method according to the present embodiment can be performed in a fuzzing device (100) linked with a user terminal (3) that generates user actions through a GUI (Graphical User Interface) to run a companion application for controlling an IoT device (1).

[0103] The fuzzing method according to the present embodiment may include the step of collecting network packets (S110), the step of identifying a target activity (S130), the step of identifying a target send message (S150), and the step of performing black box fuzzing (S170).

[0104] First, in the step of collecting network packets (S110), the fuzzing device (100) can collect network packets transmitted and received according to user actions occurring on the user terminal (3).

[0105] In the step of identifying a target activity (S130), the fuzzing device (100) can identify a target activity that is a user action generating a network packet.

[0106] In the step of identifying such target activities (S130), the fuzzing device (100) can perform static analysis on the companion application to extract an activity list.

[0107] And in the step of identifying the target activity (S130), the fuzzing device (100) can extract a method (M) for the target activity from the activity list based on the collected network packets.

[0108] Meanwhile, in the step of identifying the target send message (S150), the fuzzing device (100) hooks the extracted method (M), performs dynamic analysis to generate a call graph by logging the operation of the hooked method (M), and can designate the leaf node located at the bottom of the generated call graph as a candidate send message (CSM).

[0109] And in the step of identifying the target send message (S150), the fuzzing device (100) dynamically links all functions corresponding to the specified candidate send message (CSM) to execute a companion application, and as a result of executing the companion application, the function that generates the network packet is stored as a function of the candidate send message (CSM) to perform filtering on the candidate send message (CSM).

[0110] In the step (S150) of identifying such target send messages, storing them as a function of candidate send messages (CSM) may involve the fuzzing device (100) collecting the time of execution and the elapsed time of network activity whenever the function of candidate send messages (CSM) is executed, and storing them together with the function of candidate send messages (CSM).

[0111] And in the step of identifying target send messages (S150), the fuzzing device (100) clusters candidate send messages (CSM) based on elapsed time to generate multiple clusters, and can select the cluster with the smallest average elapsed time among the clusters.

[0112] In addition, in the step of identifying the target send message (S150), the fuzzing device (100) performs static analysis on the function of the candidate send message (CSM) corresponding to the selected cluster to identify the data transforming function (DTF) to generate the transformation data chain, and can identify the lowest function in the transformation data chain as the target send message (SM).

[0113] Meanwhile, in the step (S170) of performing black box fuzzing, when the target send message (SM) is identified, the fuzzing device (100) can perform black box fuzzing to detect vulnerabilities in the IoT device (1) by using a function located at the top of the target send message (SM) as a fuzzing trigger.

[0114] In the step (S170) of performing such black box fuzzing, the fuzzing device (100) may consider the top-level function (TCN) in the transformation data chain as a fuzzing trigger, adjust the parameters of the fuzzing trigger according to a preset fuzzing rule to generate a mutation, and perform fuzzing.

[0115] The fuzzing method of the present invention as described above can be implemented in the form of program instructions that can be executed through various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc., either individually or in combination.

[0116] The program instructions recorded on the above-mentioned computer-readable recording medium may be those specifically designed and configured for the present invention, or they may be those known and available to those skilled in the art of computer software.

[0117] Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes; optical recording media such as CD-ROMs and DVDs; magneto-optical media such as floptical disks; and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, and flash memory.

[0118] Examples of program instructions include machine code, such as that generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

[0119] Although various embodiments of the present invention have been illustrated and described above, the present invention is not limited to the specific embodiments described above. It is understood that various modifications can be made by those skilled in the art without departing from the essence of the invention as claimed in the claims, and such modifications should not be understood individually from the technical spirit or perspective of the present invention. Explanation of the symbols

[0120] 10 : Fuzzing System 1 : IoT Device 3 : User terminal 100 : Fuzzing device

Claims

Claim 1 A fuzzing system for detecting vulnerabilities in an IoT device regardless of whether the application for controlling the IoT device is obfuscated, comprising: a user terminal that generates a user action through a GUI (Graphical User Interface) to run a companion application for controlling the IoT device; and a fuzzing device that collects network packets transmitted and received according to the user action, identifies a target activity which is the user action that generates the network packet, identifies a target send message corresponding to the target activity, and performs black box fuzzing that acts as a fuzzing trigger to detect vulnerabilities in the IoT device when the target send message is identified, wherein identifying the target activity involves performing static analysis on the companion application to extract an activity list and extracting a method for the target activity within the activity list based on the collected network packets. Claim 2 delete Claim 3 A fuzzing system according to claim 1, wherein identifying the target send message comprises performing dynamic analysis to generate a call graph by hooking the extracted method and logging the operation of the hooked method, and designating a leaf node located at the bottom of the generated call graph as a candidate send message. Claim 4 A fuzzing system according to paragraph 3, wherein identifying the target send message further comprises dynamically connecting all functions corresponding to the designated candidate send message to execute the companion application, and, as a result of executing the companion application, storing the function that generates the network packet as a function of the candidate send message to perform filtering on the candidate send message. Claim 5 A fuzzing system according to claim 4, wherein storing as a function of the candidate send message involves collecting the time of execution and the elapsed time of network activity whenever the function of the candidate send message is executed, and storing them together with the function of the candidate send message. Claim 6 A fuzzing system according to claim 5, wherein identifying the target send message further comprises clustering the candidate send messages based on the elapsed time to generate a plurality of clusters, and selecting the cluster with the smallest average elapsed time among the plurality of clusters. Claim 7 A fuzzing system according to claim 6, wherein identifying the target send message involves performing static analysis on the function of the candidate send message corresponding to the selected cluster to identify the data transforming function to generate a transformation data chain, and identifying the lowest function in the transformation data chain as the target send message. Claim 8 A fuzzing system according to claim 7, wherein performing the black box fuzzing involves considering the top-most function in the transformation data chain as the fuzzing trigger, adjusting the parameters of the fuzzing trigger according to a preset fuzzing rule to generate a mutation, and performing fuzzing. Claim 9 A fuzzing method in a fuzzing device that detects vulnerabilities of an IoT regardless of whether the application is obfuscated, in conjunction with a user terminal that generates user actions through a GUI (Graphical User Interface) to run a companion application for controlling an IoT device, comprising: a step of collecting network packets transmitted and received according to the user action; a step of identifying a target activity, which is a user action that generates the network packets; a step of identifying a target send message corresponding to the target activity; and a step of performing black box fuzzing to detect vulnerabilities of the IoT device by acting as a fuzzing trigger when the target send message is identified, wherein in the step of identifying the target activity, static analysis is performed on the companion application to extract an activity list, and a method for the target activity is extracted from the activity list based on the collected network packets. Claim 10 delete Claim 11 A fuzzing method according to claim 9, wherein the step of identifying the target send message comprises the step of hooking the extracted method, performing dynamic analysis to generate a call graph by logging the operation of the hooked method, and designating a leaf node located at the bottom of the generated call graph as a candidate send message. Claim 12 A fuzzing method according to claim 11, wherein the step of identifying the target send message further comprises the step of dynamically connecting all functions corresponding to the designated candidate send message to execute the companion application, and, as a result of executing the companion application, storing the function that generates the network packet as a function of the candidate send message to perform filtering on the candidate send message. Claim 13 A fuzzing method according to claim 12, wherein storing as a function of the above candidate send message involves collecting the time of execution and the elapsed time of network activity whenever the function of the above candidate send message is executed, and storing them together with the function of the above candidate send message. Claim 14 A fuzzing method according to claim 13, wherein the step of identifying the target send message further comprises the step of clustering the candidate send messages based on the elapsed time to generate a plurality of clusters, and selecting the cluster with the smallest average elapsed time among the plurality of clusters. Claim 15 A fuzzing method according to claim 14, wherein in the step of identifying the target send message, static analysis is performed on the function of the candidate send message corresponding to the selected cluster to identify the data transforming function and generate a transformation data chain, and the lowest function in the transformation data chain is identified as the target send message. Claim 16 A fuzzing method according to claim 15, wherein in the step of performing the black box fuzzing, the top-most function in the transformation data chain is considered as the fuzzing trigger, and the parameters of the fuzzing trigger are adjusted according to a preset fuzzing rule to generate a mutation and perform fuzzing. Claim 17 A recording medium having a computer-readable computer program for performing the above-mentioned fuzzing method according to paragraph 9.

Images