Research on Intelligent Firmware Vulnerability Detection and Priority Assessment Method Based on Hybrid Analysis
Main Article Content
Abstract
Binary firmware underpins critical infrastructure but often contains vulnerabilities that conventional detection mechanisms fail to identify. In this work, we develop a hybrid analytical framework that integrates static pattern extraction with runtime behavioral monitoring, achieving detection rates of 93.7% across a corpus of 40 million procedures collected from production firmware. Static pattern recognition leverages control flow graph embeddings, while probabilistic scoring quantifies contextual risk. Cross-architecture evaluation across ARM, MIPS, x86, and PowerPC demonstrates robustness against variations in compilation. Our methodology also uncovers zero-day vulnerabilities, and the computational overhead remains manageable for deployment on resource-constrained platforms, reducing false positive rates by 56.7% compared to existing approaches.
Article Details
Section
How to Cite
References
1. P. Sun, L. Garcia, G. Salles-Loustau, and S. Zonouz, "Hybrid firmware analysis for known mobile and IoT security vulnerabilities," In 2020 50th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), June, 2020, pp. 373-384. doi: 10.1109/dsn48063.2020.00053
2. X. Feng, X. Zhu, Q. L. Han, W. Zhou, S. Wen, and Y. Xiang, "Detecting vulnerability on IoT device firmware: A survey," IEEE/CAA Journal of Automatica Sinica, vol. 10, no. 1, pp. 25-41, 2022.
3. M. Liu, Y. Zhang, J. Li, J. Shu, and D. Gu, "Security analysis of vendor customized code in firmware of embedded device," In International Conference on Security and Privacy in Communication Systems, October, 2016, pp. 722-739. doi: 10.1007/978-3-319-59608-2_40
4. Y. David, N. Partush, and E. Yahav, "Firmup: Precise static detection of common vulnerabilities in firmware," ACM SIGPLAN Notices, vol. 53, no. 2, pp. 392-404, 2018.
5. A. Qasem, P. Shirani, M. Debbabi, L. Wang, B. Lebel, and B. L. Agba, "Automatic vulnerability detection in embedded devices and firmware: Survey and layered taxonomies," ACM Computing Surveys (CSUR), vol. 54, no. 2, pp. 1-42, 2021.
6. J. B. Hou, T. Li, and C. Chang, "Research for vulnerability detection of embedded system firmware," Procedia Computer Science, vol. 107, pp. 814-818, 2017.
7. Y. Wang, J. Shen, J. Lin, and R. Lou, "Staged method of code similarity analysis for firmware vulnerability detection," IEEE Access, vol. 7, pp. 14171-14185, 2019. doi: 10.1109/access.2019.2893733
8. W. Xie, Y. Jiang, Y. Tang, N. Ding, and Y. Gao, "Vulnerability detection in IoT firmware: A survey," In 2017 IEEE 23rd International Conference on Parallel and Distributed Systems (ICPADS), December, 2017, pp. 769-772. doi: 10.1109/icpads.2017.00104
9. Y. G. Hassan, A. Collins, G. O. Babatunde, A. A. Alabi, and S. D. Mustapha, "Automated vulnerability detection and firmware hardening for industrial IoT devices," International Journal of Multidisciplinary Research and Growth Evaluation, vol. 4, no. 1, pp. 697-703, 2023. doi: 10.54660/.ijmrge.2023.4.1.697-703
10. S. Ul Haq, Y. Singh, A. Sharma, R. Gupta, and D. Gupta, "A survey on IoT & embedded device firmware security: Architecture, extraction techniques, and vulnerability analysis frameworks," Discover Internet of Things, vol. 3, no. 1, p. 17, 2023.
11. J. Zaddach, L. Bruno, A. Francillon, and D. Balzarotti, "AVATAR: A framework to support dynamic security analysis of embedded systems' firmwares," In NDSS, February, 2014, pp. 1-16. doi: 10.14722/ndss.2014.23229
12. T. Bakhshi, B. Ghita, and I. Kuzminykh, "A review of IoT firmware vulnerabilities and auditing techniques," Sensors, vol. 24, no. 2, p. 708, 2024. doi: 10.3390/s24020708
13. O. Sallenave, and R. Ducournau, "Lightweight generics in embedded systems through static analysis," ACM SIGPLAN Notices, vol. 47, no. 5, pp. 11-20, 2012. doi: 10.1145/2248418.2248421
14. H. Wang, Z. Ding, and Y. Zhong, "Static analysis test platform construction for embedded systems," In 2008 International Conference on Audio, Language and Image Processing, July, 2008, pp. 808-812.
15. H. M. Kienle, J. Kraft, and T. Nolte, "System-specific static code analyses: A case study in the complex embedded systems domain," Software Quality Journal, vol. 20, no. 2, pp. 337-367, 2012. doi: 10.1007/s11219-011-9138-7