Westworld: Fuzzing-Assisted Remote Dynamic Symbolic Execution of Smart Apps on IoT Cloud Platforms
Westworld: Fuzzing-Assisted Remote Dynamic Symbolic Execution of Smart Apps on IoT Cloud Platforms
复制标题
DOI：
10.1145/3485832.3488022
复制
发表时间：
2021-12
期刊：
影响因子：
--
通讯作者：
Lannan Luo;Qiang Zeng;Bokai Yang;Fei Zuo;Junzhe Wang
中科院分区：
文献类型：
--
作者：
Lannan Luo;Qiang Zeng;Bokai Yang;Fei Zuo;Junzhe Wang
现有的符号执行通常假设分析器可以控制I/O环境和/或访问库代码，然而，当程序在由另一方管理的远程专有执行环境上运行时，情况并非如此。例如，最流行的物联网平台之一SmartThings就是这样一个基于云的执行环境。对于编写要部署在物联网云平台上的自动化应用程序的程序员来说，当他们想要系统地测试代码并发现错误时，这会带来重大挑战。我们提出了模糊辅助远程动态符号执行，它使用动态符号执行为骨干，并利用模糊在必要时自动测试程序运行在远程专有执行环境中的分析仪几乎没有控制。作为案例研究，我们启用它来分析SmartThings上运行的智能应用程序。我们已经开发了一个原型，评估表明它在测试智能应用程序和发现bug方面是有效的。
Existing symbolic execution typically assumes the analyzer can control the I/O environment and/or access the library code, which, however, is not the case when programs run on a remote proprietary execution environment managed by another party. For example, SmartThings, one of the most popular IoT platforms, is such a cloud-based execution environment. For programmers who write automation applications to be deployed on IoT cloud platforms, it raises significant challenges when they want to systematically test their code and find bugs. We propose fuzzing-assisted remote dynamic symbolic execution, which uses dynamic symbolic execution as backbone and utilizes fuzzing when necessary to automatically test programs running in a remote proprietary execution environment over which the analyzer has little control. As a case study, we enable it for analyzing smart apps running on SmartThings. We have developed a prototype and the evaluation shows that it is effective in testing smart apps and finding bugs.