With the rapid development of information technology, the widespread use of IoT devices has increasingly highlighted security issues. Existing vulnerability discovery techniques often focus on optimizing single processes, lacking systematic organization and application of discovery experiences. Therefore, this paper proposes a learnable vulnerability discovery framework inspired by genetic principles in biology. It encodes key feature data from HTTP interactions into DNA and builds a knowledge tree model with the discovery experiences, integrating multiple discovery experiences to form a knowledge forest. By calculating the similarity between the target and the DNA chains in the knowledge forest, the framework guides the vulnerability discovery process, enabling effective inheritance and utilization of experiences, thus endowing the process with memory and experience transfer capabilities. The DNAFuzzer model is used to validate this approach. Results show that when discovering vulnerabilities in different device models with code reuse, DNAFuzzer can precisely locate and trigger vulnerabilities within one minute based on past discovery experiences. Its average discovery efficiency improves by 83.79% compared to boofuzz, 92.65% compared to sulley, and 94.43% compared to peach.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

A Learnable Vulnerability Mining Model for Internet of Things

  • Pengbin Hu,
  • Lingling Tan,
  • Zhen Zhang

摘要

With the rapid development of information technology, the widespread use of IoT devices has increasingly highlighted security issues. Existing vulnerability discovery techniques often focus on optimizing single processes, lacking systematic organization and application of discovery experiences. Therefore, this paper proposes a learnable vulnerability discovery framework inspired by genetic principles in biology. It encodes key feature data from HTTP interactions into DNA and builds a knowledge tree model with the discovery experiences, integrating multiple discovery experiences to form a knowledge forest. By calculating the similarity between the target and the DNA chains in the knowledge forest, the framework guides the vulnerability discovery process, enabling effective inheritance and utilization of experiences, thus endowing the process with memory and experience transfer capabilities. The DNAFuzzer model is used to validate this approach. Results show that when discovering vulnerabilities in different device models with code reuse, DNAFuzzer can precisely locate and trigger vulnerabilities within one minute based on past discovery experiences. Its average discovery efficiency improves by 83.79% compared to boofuzz, 92.65% compared to sulley, and 94.43% compared to peach.