IoT Application-Layer Protocol Vulnerability Detection using Reverse Engineering

Abstract

Fuzzing is regarded as the most promising method for protocol vulnerabilities discovering in network security of Internet of Things (IoT). However, one fatal drawback of existing fuzzing methods is that a huge number of test files are required to maintain a high test coverage. In this paper, a novel method based on protocol reverse engineering is proposed to reduce the amount of test files for fuzzing. The proposed method uses techniques in the field of protocol reverse engineering to identify message formats of IoT application-layer protocol and create test files by generating messages with error fields according to message formats. The protocol message treated as a sequence of bytes is assumed to obey a statistic process with change-points indicating the boundaries of message fields. Then, a multi-change-point detection procedure is introduced to identify change-points of byte sequences according to their statistic properties and divide them into segments according to their change-points. The message segments are further processed via a position-based occurrence probability test analysis to identify keyword fields, data fields and uncertain fields. Finally, a message generation procedure with mutation operation on message fields is applied to construct test files for fuzzing test. The results show that the proposed method can effectively find out the message fields and significantly reduce the amount of test files for fuzzing test.

SIEM-based detection and mitigation of IoT-botnet DDoS attacks

“…Therefore, consuming considerable amount of time. Luo et al [17], proposed a technique that performs reverse engineering of IoT protocols, to identify the message format of [18] verified the effectiveness graph-based analysis on a smart home system prototype. The prototype consisted of a smartphone controlling a smart light pulp and a Google home speaker.…”

A Type-Aware Approach to Message Clustering for Protocol Reverse Engineering

“…Numerous attempts have been made to reverse the formats of messages sent by a network application, which is crucial for information security of IoT [8,9]. Studies undertaken for this purpose focus on (1) approaches based on network traces [10] and (2) approaches based on execution traces [11].…”

Mechanisms to improve fuzz testing for message brokers

“…All of the aforementioned issues can be mitigated or avoided altogether with effective testing mechanisms for pub/sub brokers. In that regard, one of the most ideal and necessary testing techniques for pub/sub protocols is fuzzing (Luo et al, 2018;Praveen et al, 2023), which consists in generating and sending random inputs to a message broker. The output of the broker is then analyzed for potential weaknesses.…”

“…Third, it can mitigate implementation issues and zero-day attacks. These benefits are reasons why fuzz testing is considered the primary bug-finding technique for most software applications (Munea, Lim, et al, 2016;Munea, Luk Kim, et al, 2017;Luo et al, 2018;Boehme et al, 2021;Vinzenz and Oka, 2021).…”