Scholarlink

<p>Power IoT devices, as critical components in industrial control systems, often operate in heterogeneous environments and support multiple communication protocols such as Modbus TCP, EtherNet/IP, and Siemens S7. Unlike general embedded systems, these devices have strict real-time constraints, safety-critical characteristics, and a large protocol surface exposed to external networks, making them vulnerable to protocol-level attacks. However, most existing fuzzing tools only test individual protocols independently, making it difficult to detect protocol-stack-level or multi-interface vulnerabilities. To address this, we propose OmniFuzz, a protocol-aware fuzzing framework based on multi-agent reinforcement learning, specifically designed for power IoT devices. For the multi-protocol scenarios supported by the devices, the framework constructs a dedicated agent array for each protocol. Each agent mutates specific protocol fields through an independently learned policy network and collaborates via a shared value network, forming a directed multi-protocol concurrent testing mechanism. The framework incorporates a domain-specific reward function cluster (covering vulnerability severity, code path depth, and input diversity), which effectively improves testing efficiency and code coverage. OmniFuzz supports concurrent multi-protocol fuzzing during runtime, enabling comprehensive vulnerability discovery across concurrent heterogeneous protocol interfaces. Although the current implementation does not explicitly model inter-protocol behavior sequences, it lays the foundation for future exploration of cross-protocol attack paths. Experiments on real-world PLC devices from multiple vendors show that OmniFuzz outperforms baseline fuzzers by approximately 10% in terms of time to first vulnerability, exception triggering rate, and effective recognition rate. Through this framework, we discovered 5 high-risk buffer overflow vulnerabilities in the State Grid’s Smart-distribution-transformer-combine-terminal-unit, with relevant demonstration videos published on GitHub. Detailed descriptions of this will be provided in the discussion section.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

OmniFuzz: A Multi-agent Reinforcement Learning Framework for Protocol-Aware Fuzzing in Power IoT Devices

  • 期刊论文

  • 发表日期：

    2025年10月27日

查看全文
  • Yubo Song,
  • Weiwei Chen,
  • Xin Sun,
  • Zhongyuan Qin,
  • Hua Dai,
  • Kanghui Wang,
  • Bang Lv,
  • Jiaqi Chen

摘要

Power IoT devices, as critical components in industrial control systems, often operate in heterogeneous environments and support multiple communication protocols such as Modbus TCP, EtherNet/IP, and Siemens S7. Unlike general embedded systems, these devices have strict real-time constraints, safety-critical characteristics, and a large protocol surface exposed to external networks, making them vulnerable to protocol-level attacks. However, most existing fuzzing tools only test individual protocols independently, making it difficult to detect protocol-stack-level or multi-interface vulnerabilities. To address this, we propose OmniFuzz, a protocol-aware fuzzing framework based on multi-agent reinforcement learning, specifically designed for power IoT devices. For the multi-protocol scenarios supported by the devices, the framework constructs a dedicated agent array for each protocol. Each agent mutates specific protocol fields through an independently learned policy network and collaborates via a shared value network, forming a directed multi-protocol concurrent testing mechanism. The framework incorporates a domain-specific reward function cluster (covering vulnerability severity, code path depth, and input diversity), which effectively improves testing efficiency and code coverage. OmniFuzz supports concurrent multi-protocol fuzzing during runtime, enabling comprehensive vulnerability discovery across concurrent heterogeneous protocol interfaces. Although the current implementation does not explicitly model inter-protocol behavior sequences, it lays the foundation for future exploration of cross-protocol attack paths. Experiments on real-world PLC devices from multiple vendors show that OmniFuzz outperforms baseline fuzzers by approximately 10% in terms of time to first vulnerability, exception triggering rate, and effective recognition rate. Through this framework, we discovered 5 high-risk buffer overflow vulnerabilities in the State Grid’s Smart-distribution-transformer-combine-terminal-unit, with relevant demonstration videos published on GitHub. Detailed descriptions of this will be provided in the discussion section.