The Vulnerabilities Detection System Based On Copied Codes Recognition Of IoT Firmware Source Codes

In recent years,with the rapid development of the Internet of things,the number of connected node devices in the Internet of things also shows an exponential growth trend.At the same time,the security problem of device firmware vulnerability also shows an increasing trend year by year.In the process of firmware source code development,in order to speed up the development efficiency,developers would introduce some code clones of the third-party open source code in accident.These inadvertent code clones may introduce security vulnerabilities into the firmware source codes.In this paper,the source code similarity detection is introduced into the firmware source codes vulnerabilities detection,finding the vulnerabilities introduced into the firmware source codes due to code cloning.The firmware source code vulnerability detection system designed and implemented in this paper will help IOT device manufacturers to eliminate the potential security vulnerabilities in the firmware source codes as far as possible before the firmware source codes are transformed.In this paper,the common code clone detection methods are studied.By comparing different code clone detection methods,the mixed code clone detection method based on abstract syntax tree extraction function + text + measure is selected.Through downloading and collecting the common third-party open source code libraries which are relied on the development of firmware source codes,and extracting all CVE vulnerability functions in the code libraries to build vulnerability function data set.The function prototype,features and repair attributes of the collected code vulnerability functions are extracted.For the firmware source code to be detected,the function prototypes of all functions are extracted,and the local sensitive hash(LSH)algorithm is used to select the candidate vulnerability functions.For the firmware source code function that may have vulnerabilities after initial selection,its function features are extracted and the feature similarity between it and its candidate vulnerability function is calculated.Finally,in order to further eliminate the false positives,the detection effect is further improved by screening whether the function to be detected carries the repair attributes of candidate vulnerability functions.In terms of interactivity,a command line tool for firmware source codes vulnerabilities detection based on C-S architecture is built.For the firmware to be tested without source code,reversing the firmware through using Binwalk and IDA Pro tools to get its reversed source code,and then transferring the firmware source code directory or a single source code file from the command line client to query the result of vulnerabilities asynchronously.Through testing the proposed firmware source codes vulnerabilities detection system,for a given test data set,the identification accuracy of firmware source codes vulnerabilities reaches 95%,which is expected.