SFO-CID: Structural Feature Optimization Based Command Injection Vulnerability Discovery for Internet of Things

The rapid development of Industrial Internet of Things (IIoT) has raised wider concerns for security of IoT devices. Command injection (CI) vulnerabilities, prevalent in IoT devices, pose a severe risk for remote code execution. Traditional static detection methods suffer from high overhead and imprecision due to symbolic execution. Popular binary code similarity detection (BCSD) methods rely on Control Flow Graphs (CFGs) with redundant structures, resulting in low efficiency and accuracy. In addition, they struggle with cross-function issues. In this paper, we propose <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SFO-CID</i>, a novel structural feature optimization based command injection vulnerability discovery model for IoT devices. Through backward taint analysis, all CFGs of suspicious CI vulnerabilities within the target binary file are precisely obtained. A large amount of code unrelated to vulnerabilities is removed, and cross-function issues are covered, significantly optimizing the structural features of original CFGs. Neural networks generate embedding vectors for optimized CFGs, transforming CI vulnerability detection into a vector similarity comparison. A wealth of semantic information within the code context is automatically and efficiently captured, improving the accuracy of vulnerability detection. We collect real-world cross-platform IoT firmware as data sources for tests. Experiments show that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SFO-CID</i> outperforms popular BCSD methods, such as <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Gemini</i>, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">IoTSeeker</i>, and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">FIT</i>, achieving the highest accuracy of 88.67<inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\%$</tex-math></inline-formula> in vulnerability detection. Compared to existing state-of-the-art static analysis methods, like <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">KARONTE</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SaTC</i>, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SFO-CID</i> attains the highest precision at 88.43<inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\%$</tex-math></inline-formula> and F1-score at 86.29<inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\%$</tex-math></inline-formula>, and is less time-consuming. Until now, 8 high-risk unknown vulnerabilities have been discovered, including 5 cross-function cases, and corresponding CVE IDs were assigned.