CVSSA: Cross-Architecture Vulnerability Search in Firmware Based on Support Vector Machine and Attributed Control Flow Graph

Lin, Hong; Zhao, Dongdong; Ran, Linjun; Han, Mushuai; Tian, Jing; Xiang, Jianwen; Ma, Xian; Zhong, Yingshou

doi:10.1109/dsa.2017.15

Cited by 13 publications

(9 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The idea is to use kNN for fast screening out of obvious non-candidates, and then, SVM is only applied to a small number of highly suspected functions. The kNN-SVM-based method can reduce the query time to a few times lower than that of our previous work only applying SVM (Lin et al 2017), e.g., from 0.18 s to 0.032 s in the condition "ARM to MIPS", at the expense of slightly lower correctness, e.g., from 99.7 to 99.6%. The kNN-SVM-based method also outperforms other state-of-the-art approaches, i.e., Multi−MH (Pewny et al 2015), Multi−k−MH (Pewny et al 2015), and discovRE (Eschweiler et al 2016), in terms of overall performance.…”

Section: Introductionmentioning

confidence: 68%

See 1 more Smart Citation

CVSkSA: cross-architecture vulnerability search in firmware based on kNN-SVM and attributed control flow graph

et al. 2019

Self Cite

View full text Add to dashboard Cite

To prevent the same known vulnerabilities from affecting different firmware, searching known vulnerabilities in binary firmware across different architectures is crucial. Because the accuracy of existing cross-architecture vulnerability search methods is not high, we propose a staged approach based on support vector machine (SVM) and attributed control flow graph (ACFG) at the function level to improve the accuracy using prior knowledge. Furthermore, for efficiency, we utilize the k-nearest neighbor (kNN) algorithm to prune and SVM to refine in the function prefilter stage. Although the accuracy of the proposed method using kNN-SVM approach is slightly lower than the accuracy of the method using only SVM, its efficiency is significantly enhanced. We have implemented our approach CVSkSA to search several vulnerabilities in real-world firmware images. The experimental results show that the accuracy of the proposed method using kNN-SVM approach is close to the accuracy of the method using only SVM in most cases, while the former is approximately four times faster than the latter.

show abstract

Section: Introductionmentioning

confidence: 68%

“…This paper is a significant extension of the conference paper published at DSA 2017 (Lin et al 2017). On the basis of the original paper, we further propose a hybrid method using a kNN-SVM approach to improve the efficiency considerably at an acceptable or negligible cost of accuracy.…”

Section: Introductionmentioning

confidence: 88%

CVSkSA: cross-architecture vulnerability search in firmware based on kNN-SVM and attributed control flow graph

et al. 2019

Self Cite

View full text Add to dashboard Cite

show abstract

“…There is a wide range of operating systems used in embedded devices, ranging from more complex ones like Linux to less complex ones like eCos. The most common operating systems used by IoT devices are Linux 20 , VxWorks 21 , eCos 22 , OpenWRT 23 , Junos OS 24 and uCOS 25 . Like the bootloader, the operating system might also contain security holes, but finding these are not trivial either.…”

Section: Firmware Extractionmentioning

confidence: 99%

“…In order to perform efficient searches, similarity metrics and bug patterns are required. Similarity metrics often include structural features [20], [21], [22], [23] such as the number of instructions, string and numeric constants or the structure of the control flow graph (CFG). However, such metrics face challenges when vulnerable components must be matched in a cross-platform manner.…”

Section: Finding Potentially Vulnerable Componentsmentioning

confidence: 99%

“…https://www.denx.de/wiki/U-Boot14 https://github.com/runtimeco/mcuboot 15 https://sourceware.org/redboot/16 https://www.theiphonewiki.com/wiki/IBoot_(Bootloader)17 https://www.barebox.org/18 https://en.wikipedia.org/wiki/Common_Firmware_Environment 19 https://github.com/ucsb-seclab/BootStomp 20 https://www.elinux.org/Main_Page 21 https://www.windriver.com/products/vxworks/22 https://www.ecoscentric.com/ecos/index.shtml23 https://openwrt.org/24 https://www.juniper.net/us/en/products-services/nos/junos/25 https://www.micrium.com/rtos/…”

mentioning

confidence: 99%

See 1 more Smart Citation

IoT Hacking – A Primer

Papp¹,

Tamás²,

Buttyán³

2019

Infocommunications journal

View full text Add to dashboard Cite

The Internet of Things (IoT) enables many new and exciting applications, but it also creates a number of new risks related to information security. Several recent attacks on IoT devices and systems illustrate that they are notoriously insecure. It has also been shown that a major part of the attacks resulted in full adversarial control over IoT devices, and the reason for this is that IoT devices themselves are weakly protected and they often cannot resist even the most basic attacks. Penetration testing or ethical hacking of IoT devices can help discovering and fixing their vulnerabilities that, if exploited, can result in highly undesirable conditions, including damage of expensive physical equipment or even loss of human life. In this paper, we give a basic introduction into hacking IoT devices. We give an overview on the methods and tools for hardware hacking, firmware extraction and unpacking, and performing basic firmware analysis. We also provide a survey on recent research on more advanced firmware analysis methods, including static and dynamic analysis of binaries, taint analysis, fuzzing, and symbolic execution techniques. By giving an overview on both practical methods and readily available tools as well as current scientific research efforts, our work can be useful for both practitioners and academic researchers.

show abstract

DVul-WLG: Graph Embedding Network Based on Code Similarity for Cross-Architecture Firmware Vulnerability Detection

Sun¹,

Tong²,

Zhao³

et al. 2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

CVSSA: Cross-Architecture Vulnerability Search in Firmware Based on Support Vector Machine and Attributed Control Flow Graph

Cited by 13 publications

References 17 publications

CVSkSA: cross-architecture vulnerability search in firmware based on kNN-SVM and attributed control flow graph

CVSkSA: cross-architecture vulnerability search in firmware based on kNN-SVM and attributed control flow graph

IoT Hacking – A Primer

DVul-WLG: Graph Embedding Network Based on Code Similarity for Cross-Architecture Firmware Vulnerability Detection

Contact Info

Product

Resources

About