Skip to main content

2023 | OriginalPaper | Buchkapitel

Research on Firmware Vulnerability Mining Model of Power Internet of Things

verfasst von : Chao Zhou, Ziying Wang, Jing Guo, Yajuan Guo, Haitao Jiang, Zhimin Gu, Wei Huang

Erschienen in: Big Data and Security

Verlag: Springer Nature Singapore

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

Power IoT (Internet of Things) has been developing for a few years where various types of terminals are deployed. Since the power IoT devices need to be connected to the public network, the security situation is more severe, and it is imperative to develop an efficient and reliable vulnerability mining model for the device firmware in the power IoT field. Based on this, this paper analyzes the common mining means of power IoT device firmware vulnerabilities including static and dynamic analysis methods. By comparing the characteristics of different mining techniques and their applicability, an IoT device firmware vulnerability mining model applicable to the power system environment is proposed and its process and associated methods are designed. Finally, a test system is established to verify the effectiveness of the proposed model compared to the common static and dynamic analysis tools. The test results show that the proposed model demonstrates better performance in terms of execution time and code coverage efficiency.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Literatur
1.
Zurück zum Zitat Ren, Y., Zhang, Y., Ai, C.: Survey on taint analysis technology. Comput. Appl. 39(8), 2302–2309 (2019) Ren, Y., Zhang, Y., Ai, C.: Survey on taint analysis technology. Comput. Appl. 39(8), 2302–2309 (2019)
2.
Zurück zum Zitat Wang, L., Li, F., Li, L., Feng, X.: Principle and practice of taint analysis. J. Softw. 28(04), 860–882 (2017) Wang, L., Li, F., Li, L., Feng, X.: Principle and practice of taint analysis. J. Softw. 28(04), 860–882 (2017)
3.
Zurück zum Zitat Wu, Z., Chen, X., Yang, Z., Du, X.: Survey on information flow control. J. Softw. 28(1), 135–159 (2017)MathSciNet Wu, Z., Chen, X., Yang, Z., Du, X.: Survey on information flow control. J. Softw. 28(1), 135–159 (2017)MathSciNet
4.
Zurück zum Zitat Zhang, X., Zhang, K., Sang, H., Zhang, H., Wei, P., Zhou, H.: IoT security annual report. Inf. Secur. Commun. Priv. 2020(01), 45–62 (2019) Zhang, X., Zhang, K., Sang, H., Zhang, H., Wei, P., Zhou, H.: IoT security annual report. Inf. Secur. Commun. Priv. 2020(01), 45–62 (2019)
5.
Zurück zum Zitat Zheng, Y., Davanian, A., Yin, H.: FIRM-AFL: high-throughput grey box fuzzing of IoT firmware via augmented process emulation. In: Proceedings of the 28th USENIX Conference on Security Symposium (SEC 2019), pp. 1099–1114 (2019) Zheng, Y., Davanian, A., Yin, H.: FIRM-AFL: high-throughput grey box fuzzing of IoT firmware via augmented process emulation. In: Proceedings of the 28th USENIX Conference on Security Symposium (SEC 2019), pp. 1099–1114 (2019)
6.
Zurück zum Zitat Pereira, J.D.: Techniques and tools for advanced software vulnerability detection. In: 2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW), pp. 123–126 (2020) Pereira, J.D.: Techniques and tools for advanced software vulnerability detection. In: 2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW), pp. 123–126 (2020)
7.
Zurück zum Zitat Mera, A., Feng, B., Lu, L., Kirda, E. DICE: automatic emulation of DMA input channels for dynamic firmware analysis. In: 2021 IEEE Symposium on Security and Privacy (SP), pp. 1938–1954 (2021) Mera, A., Feng, B., Lu, L., Kirda, E. DICE: automatic emulation of DMA input channels for dynamic firmware analysis. In: 2021 IEEE Symposium on Security and Privacy (SP), pp. 1938–1954 (2021)
8.
Zurück zum Zitat Wang, Y., Shen, J., Lin, J., Lou, R.: Staged method of code similarity analysis for firmware vulnerability detection. IEEE Access 7, 14171–14185 (2019)CrossRef Wang, Y., Shen, J., Lin, J., Lou, R.: Staged method of code similarity analysis for firmware vulnerability detection. IEEE Access 7, 14171–14185 (2019)CrossRef
9.
Zurück zum Zitat Sun, Y., Sun, L., Shi, Z., Yu, W., Ying, H.: Vulnerability finding and firmware association in power grid. In: 2019 Fifth Conference on Mobile and Secure Services (MobiSecServ), pp. 1–5 (2019) Sun, Y., Sun, L., Shi, Z., Yu, W., Ying, H.: Vulnerability finding and firmware association in power grid. In: 2019 Fifth Conference on Mobile and Secure Services (MobiSecServ), pp. 1–5 (2019)
10.
Zurück zum Zitat Zhang, B., Xi, Z., Gao, K.: Fuzzy test guidance technology for power internet of things firmware vulnerability detection. In: 2021 IEEE International Conference on Energy Internet (ICEI), pp. 157–163 (2021) Zhang, B., Xi, Z., Gao, K.: Fuzzy test guidance technology for power internet of things firmware vulnerability detection. In: 2021 IEEE International Conference on Energy Internet (ICEI), pp. 157–163 (2021)
11.
Zurück zum Zitat Zhang, H., Zhou, A., Jia, P., Liu, L., Ma, J., Liu, L.: InsFuzz: fuzzing binaries with location sensitivity. IEEE Access 7, 22434–22444 (2019)CrossRef Zhang, H., Zhou, A., Jia, P., Liu, L., Ma, J., Liu, L.: InsFuzz: fuzzing binaries with location sensitivity. IEEE Access 7, 22434–22444 (2019)CrossRef
12.
Zurück zum Zitat Böhme, M., Pham, V., Roychoudhury, A.: Coverage-based greybox fuzzing as Markov chain. IEEE Trans. Softw. Eng. 45(5), 489–506 (2019)CrossRef Böhme, M., Pham, V., Roychoudhury, A.: Coverage-based greybox fuzzing as Markov chain. IEEE Trans. Softw. Eng. 45(5), 489–506 (2019)CrossRef
13.
Zurück zum Zitat Cheng, K., et al.: DTaint: detecting the taint-style vulnerability in embedded device firmware. In: 2018 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pp. 430–441 (2018) Cheng, K., et al.: DTaint: detecting the taint-style vulnerability in embedded device firmware. In: 2018 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pp. 430–441 (2018)
14.
Zurück zum Zitat Nicho, M., Girija, S.: IoTVT model: a model mapping IoT sensors to IoT vulnerabilities and threats. In: 2021 20th International Conference on Ubiquitous Computing and Communications (IUCC/CIT/DSCI/SmartCNS), pp. 123–129 (2021) Nicho, M., Girija, S.: IoTVT model: a model mapping IoT sensors to IoT vulnerabilities and threats. In: 2021 20th International Conference on Ubiquitous Computing and Communications (IUCC/CIT/DSCI/SmartCNS), pp. 123–129 (2021)
15.
Zurück zum Zitat Chen, Y., Tao, Y., Zhai, S., Sui, S.: Design and implementation of a universal offline reading system for embedded device firmware. In: 2022 7th International Conference on Intelligent Computing and Signal Processing (ICSP), pp. 1307–1310 (2022) Chen, Y., Tao, Y., Zhai, S., Sui, S.: Design and implementation of a universal offline reading system for embedded device firmware. In: 2022 7th International Conference on Intelligent Computing and Signal Processing (ICSP), pp. 1307–1310 (2022)
Metadaten
Titel
Research on Firmware Vulnerability Mining Model of Power Internet of Things
verfasst von
Chao Zhou
Ziying Wang
Jing Guo
Yajuan Guo
Haitao Jiang
Zhimin Gu
Wei Huang
Copyright-Jahr
2023
Verlag
Springer Nature Singapore
DOI
https://doi.org/10.1007/978-981-99-3300-6_52

Premium Partner