Methodology for Vulnerabilities Detection in IoT Gateways Source Code

The growth of IoT has driven advancements but also raised security concerns, particularly for IoT gateways. Vulnerabilities can stem from firmware, source code, and software flaws, often due to insecure coding practices. Detection methods include static code analysis and hybrid approaches combining static and dynamic analysis, machine learning, and natural language processing. However, static application security testing tools generate high false positives and have limitations in identifying OWASP IoT Top 10 vulnerabilities. This proposal aims to develop a static analysis-based solution to enhance vulnerability detection, including a taxonomy, a benchmark for tool evaluation, and an automated solution integrating hybrid techniques. In addition, a methodology will be proposed to identify insecure coding practices in compliance with the OWASP guidelines.