Third-party library (TPL) reuse may introduce vulnerable or malicious code and expose the software, which exposes them to potential risks. Thus, it is essential to identify third-party dependencies and take immediate corrective action to fix critical vulnerabilities when a damaged reusable component is found or reported. However, most of the existing methods only rely on syntactic features, which results in low recognition accuracy and significantly discounts the detection performance by obfuscation techniques. In addition, a few semantic-based approaches face the efficiency problem. To resolve these problems, we propose and implement a more precise and scalable TPL detection method BBDetector. In addition to syntactic features, we consider the rich function-level semantic features and form a feature vector for each function. Moreover, we design a scalable function vector similarity search method to identify anchor functions and the candidate libraries, based upon which we carry out TPL detection. The experiment results demonstrate that BBDetector outperforms B2SFinder and ModX in terms of effectiveness, efficiency, and obfuscation-resilient capability. For the nix binaries, the F1-score of BBDetector is 1.11% and 11.21% higher than that of ModX and B2SFinder, respectively. Moreover, for the Ubuntu binaries, the F1-score of BBDetector is 1.32% and 14.93% is higher than that of ModX and B2SFinder, respectively. And in terms of efficiency, the detection time of BBDetector is only 30.02% of ModX. Besides, for the obfuscation-resilient capability, BBDetector is much stronger than B2SFinder. BBDetector achieves a F1-score of 71%, slightly lower than the F1-score of 77% achieved with the non-obfuscated binary programs. However, B2SFinder only achieves an F1-score of 28%, much lower than that of 67% achieved with the non-obfuscated binary programs.

Function recognition is the preliminary step of the reverse analysis. It is the premise of binary reuse, generating control flow graphs and performing semantic analysis. There are still many shortcomings in the application of current function identification tools, including cross-platform support, efficiency, and resource usage. To improve the accuracy and efficiency of function recognition in embedded system firmware, this paper proposes a new function recognition algorithm FRwithMBA based on structure information. With the help of function call resolve (FCR), FRwithMBA identifies functions by determining the termination position of the function based on branches instruction and termination signatures of the function. In the experiment, we evaluated FRwithMBA against IDA Pro, radare2, and angr with the router binary Cisco IOS and found that FRwithMBA is more effective in identifying functions in the stripped binary under PPC and MIPS than the other tools. In terms of recognition effectiveness, FRwithMBA performs a little better than IDA Pro, but the results of radare2 and angr are poor. For a 14 MB binary, the parsing time of IDA Pro is 178 s, radare2 uses 376 s, angr uses 1896 s and FRwithMBA uses 25 s. When processing 220 MB Executable and Linkable Format (ELF) files, FRwithMBA can identify nearly 420,000 functions in about 240 s, IDA takes 2754 s, and both radare2 and angr get a fault. In the experiment, the recall of FRwithMBA reached 99.99% and the precision reached 99.7%. It is better than the other tools. In other words, FRwithMBA has more speed, higher accuracy, and less resource occupation.

The proliferation of taint-style vulnerabilities in embedded devices poses a significant threat to cybersecurity. However, discovering these vulnerabilities is challenging due to their vast number and variety. While current solutions for discovering vulnerabilities in embedded firmware have achieved some success, they suffer from imprecision, are time-consuming, and fail to consider sensitive sinks and constraints. To address these challenges, we propose a novel taint-style vulnerability discovery method called SinkTaint. SinkTaint incorporates backtracking and constraint analysis to achieve high precision and employs a global taint keyword identification strategy to identify implicit taint keywords. It identifies additional sinks using static analysis and performs backtracking analysis to eliminate sanitized sinks, while retrieving the parameter's length for risky sinks. Furthermore, SinkTaint employs dual-label labeling strategies for taint keywords and data, propagating taint labels based on function return values. Finally, SinkTaint employs symbolic execution-based taint analysis to discover taint-style vulnerabilities. We evaluate SinkTaint on datasets released by SaTC and 10 known overflow vulnerabilities. Compared to state-of-the-art methods, including Karonte, SaTC, and EmTaint, SinkTaint demonstrated superior performance, discovering more vulnerabilities with an increase in vulnerability discovery effectiveness by 472%. To date, SinkTaint has identified 21 high-risk taint-style vulnerabilities that were previously undisclosed.

Command injection vulnerability is a severe threat to the embedded device. Most methods detect command injection vulnerability with taint analysis and symbolic execution and achieve promising results. However, they waste too much time analyzing secure sink call-sites, resulting in less efficient vulnerability detection. To tackle the above problem, we propose a novel sink call-site classification method named CINDY to accelerate the command injection vulnerability discovery in embedded firmware with static backtracking analysis. CINDY first performs sink call-sites detection in the binary executables and constructs the data flow for function call parameters. Then, CINDY analyzes whether the parameters passed to sink functions are derived from constant string or not and labels them “secure" or “risky". According to the labels, CINDY classifies the sink call-sites into risky and secure sink call-sites. Finally, CINDY performs taint analysis with symbolic execution to check whether a risky sink call-site is vulnerable. To demonstrate the efficacy of CINDY, we compare CINDY with the state-of-the-art method SaTC, using the dataset published by SaTC. Compared with SaTC, CINDY can filter out more of the secure sink call-sites, with a 35% decrease, and the efficiency is improved by 17% than SaTC.

As the most crucial link in the network kill chain, exploiting a vulnerability is viewed as one of the most popular attack vectors to get the control authority of the system, which is dangerous for legal users. Therefore, an effective exploit traffic detection method is urgent. However, current methods are almost based on pattern matching, invalid for encrypted traffic. To address this problem, we propose a reverse shell-based exploit traffic detection method, ETDetector. Our key insight is that the reverse shell attack often coexists with vulnerability exploitation as one of the most popular exploit behaviors. So, we first extract the fusion information feature from original features, such as the packet delay sequence, as input of a decision tree model to identify reverse shell traffic in the shellcode execution stage. Then, we trace suspicious traffic in the shellcode delivery stage by reconstructing the session relationship of the two stages above. Compared with Blatta, using a cyclic neural network to detect early exploit traffic, the detection rate of ETDetector is increased by 50% and valid for encrypted exploit traffic. In addition, we propose a traffic stratification method based on a bisecting K-means algorithm, which can intuitively show the traffic communication behavior and improve the interpretability of ETDetector.

Vulnerable open-source component reuse can lead to security problems. At present, open-source component detection for binary programs can only reveal whether open-source components with vulnerabilities are reused, which cannot determine the specific location of vulnerabilities. To address this problem, we propose BMVul, an open-source vulnerability function detection based on the software modularization method, which is oriented to binary programs. BMVul performs binary modularization by the overlapping clustering method DBM based on directed graph, then uses feature comparison technology to carry out modular software component analysis. After creating open-source component vulnerability function set through function signature, BMVul detects vulnerability function in the binary modules reusing open-source components. The experimental results show that compared with the component detection based on Louvain modularization and B2SFinder, BMVul improves the precision by 3.16% and 59.57%, respectively. Moreover, the precision of unique binary module matching is improved by 39.43% compared with the Louvain method. The F1 score is improved by 8.45% compared to B2SFinder. Module-level detection narrows the search space of vulnerability functions, thereby reducing the workload of open-source vulnerability detection, which is of great significance for software security analysis.