Detecting Vulnerability on IoT Device Firmware: A Survey

doi:10.1109/JAS.2022.105860

CORC > 自动化研究所 > 中国科学院自动化研究所 > 学术期刊 > IEEE/CAA Journal of Automatica Sinica

	Detecting Vulnerability on IoT Device Firmware: A Survey
	Xiaotao Feng; Xiaogang Zhu; Qing-Long Han; Wei Zhou; Sheng Wen; Yang Xiang
刊名	IEEE/CAA Journal of Automatica Sinica
	2023
卷号	10 期号:1 页码:25-41
关键词	Firmware emulation internet of things (IoT) firmware network fuzzing security static analysis
ISSN号	2329-9266
DOI	10.1109/JAS.2022.105860
英文摘要	Internet of things (IoT) devices make up 30% of all network-connected endpoints, introducing vulnerabilities and novel attacks that make many companies as primary targets for cybercriminals. To address this increasing threat surface, every organization deploying IoT devices needs to consider security risks to ensure those devices are secure and trusted. Among all the solutions for security risks, firmware security analysis is essential to fix software bugs, patch vulnerabilities, or add new security features to protect users of those vulnerable devices. However, firmware security analysis has never been an easy job due to the diversity of the execution environment and the close source of firmware. These two distinct features complicate the operations to unpack firmware samples for detailed analysis. They also make it difficult to create visual environments to emulate the running of device firmware. Although researchers have developed many novel methods to overcome various challenges in the past decade, critical barriers impede firmware security analysis in practice. Therefore, this survey is motivated to systematically review and analyze the research challenges and their solutions, considering both breadth and depth. Specifically, based on the analysis perspectives, various methods that perform security analysis on IoT devices are introduced and classified into four categories. The challenges in each category are discussed in detail, and potential solutions are proposed subsequently. We then discuss the flaws of these solutions and provide future directions for this research field. This survey can be utilized by a broad range of readers, including software developers, cyber security researchers, and software security engineers, to better understand firmware security analysis.
内容类型	期刊论文
源URL	[http://ir.ia.ac.cn/handle/173211/50725]
专题	自动化研究所_学术期刊_IEEE/CAA Journal of Automatica Sinica
推荐引用方式 GB/T 7714	Xiaotao Feng,Xiaogang Zhu,Qing-Long Han,et al. Detecting Vulnerability on IoT Device Firmware: A Survey[J]. IEEE/CAA Journal of Automatica Sinica,2023,10(1):25-41.
APA	Xiaotao Feng,Xiaogang Zhu,Qing-Long Han,Wei Zhou,Sheng Wen,&Yang Xiang.(2023).Detecting Vulnerability on IoT Device Firmware: A Survey.IEEE/CAA Journal of Automatica Sinica,10(1),25-41.
MLA	Xiaotao Feng,et al."Detecting Vulnerability on IoT Device Firmware: A Survey".IEEE/CAA Journal of Automatica Sinica 10.1(2023):25-41.