Automated Vulnerability Discovery and Exploitation in the Internet of Things
| Autor: | Qiang Ruan, Zhihong Tian, Wei Shi, Haichen Wang, Zhang Yuntao, Tong Liu, Zhongru Wang, Jiayi Lin, Zhehui Liu, Binxing Fang |
|---|---|
| Jazyk: | angličtina |
| Rok vydání: | 2019 |
| Předmět: |
vulnerability exploitation
Exploit Computer science Distributed computing 0211 other engineering and technologies Vulnerability 02 engineering and technology security lcsh:Chemical technology Symbolic execution Biochemistry vulnerability discovery Article Analytical Chemistry 020204 information systems 0202 electrical engineering electronic engineering information engineering lcsh:TP1-1185 Electrical and Electronic Engineering Instrumentation Vulnerability (computing) 021110 strategic defence & security studies business.industry Fuzz testing Atomic and Molecular Physics and Optics Internet of Things business Vulnerability discovery |
| Zdroj: | Sensors Volume 19 Issue 15 Sensors, Vol 19, Iss 15, p 3362 (2019) Sensors (Basel, Switzerland) |
| ISSN: | 1424-8220 |
| DOI: | 10.3390/s19153362 |
| Popis: | Recently, automated software vulnerability detection and exploitation in Internet of Things (IoT) has attracted more and more attention, due to IoT’s fast adoption and high social impact. However, the task is challenging and the solutions are non-trivial: the existing methods have limited effectiveness at discovering vulnerabilities capable of compromising IoT systems. To address this, we propose an Automated Vulnerability Discovery and Exploitation framework with a Scheduling strategy, AutoDES that aims to improve the efficiency and effectiveness of vulnerability discovery and exploitation. In the vulnerability discovery stage, we use our Anti-Driller technique to mitigate the “path explosion” problem. This approach first generates a specific input proceeding from symbolic execution based on a Control Flow Graph (CFG). It then leverages a mutation-based fuzzer to find vulnerabilities while avoiding invalid mutations. In the vulnerability exploitation stage, we analyze the characteristics of vulnerabilities and then propose to generate exploits, via the use of several proposed attack techniques that can produce a shell based on the detected vulnerabilities. We also propose a genetic algorithm (GA)-based scheduling strategy (AutoS) that helps with assigning the computing resources dynamically and efficiently. The extensive experimental results on the RHG 2018 challenge dataset and the BCTF-RHG 2019 challenge dataset clearly demonstrate the effectiveness and efficiency of the proposed framework. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
| Nepřihlášeným uživatelům se plný text nezobrazuje | K zobrazení výsledku je třeba se přihlásit. |