Automated Vulnerability Discovery and Exploitation in the Internet of Things

Area of Science:

• Computer Science
• Cybersecurity
• Software Engineering

Background:

• Internet of Things (IoT) adoption is rapidly increasing, leading to significant social impact.
• Existing automated vulnerability detection methods for IoT systems are often ineffective at discovering critical vulnerabilities.
• The complexity of IoT systems presents challenges for vulnerability discovery and exploitation.

Purpose of the Study:

• To propose an Automated Vulnerability Discovery and Exploitation framework (AutoDES) to enhance efficiency and effectiveness.
• To address the limitations of current methods in discovering exploitable IoT vulnerabilities.
• To improve the process of both finding and exploiting software vulnerabilities in IoT devices.

Main Methods:

• Developed the Anti-Driller technique to mitigate the path explosion problem in symbolic execution using Control Flow Graphs (CFGs).
• Employed a mutation-based fuzzer for vulnerability discovery, ensuring valid mutations.
• Proposed exploit generation techniques based on vulnerability characteristics to create shells.
• Implemented a genetic algorithm (GA)-based scheduling strategy (AutoS) for dynamic resource allocation.

Main Results:

• The AutoDES framework demonstrated significant improvements in the efficiency and effectiveness of vulnerability discovery and exploitation.
• Experimental results on RHG 2018 and BCTF-RHG 2019 datasets validated the proposed approach.
• The Anti-Driller technique successfully addressed the path explosion issue.

Conclusions:

• AutoDES provides an effective and efficient solution for automated vulnerability discovery and exploitation in IoT systems.
• The proposed techniques, including Anti-Driller and AutoS, contribute to advancing IoT security.
• The framework shows strong performance on benchmark datasets, indicating its practical applicability.