IoTInfer: Automated Blackbox Fuzz Testing of IoT Network Protocols Guided by Finite State Machine Inference
IoTInfer: Automated Blackbox Fuzz Testing of IoT Network Protocols Guided by Finite State Machine Inference
复制标题
DOI：
10.1109/jiot.2022.3182589
复制
发表时间：
2022-11
影响因子：
10.6
通讯作者：
Zhan Shu;Guanhua Yan
中科院分区：
文献类型：
--
作者：
Zhan Shu;Guanhua Yan
物联网（IoT）设备的普及要求有效但有效的方法来评估物联网设备的安全性和弹性。在这项工作中，我们探讨了一种基于有限状态机（FSM）推断的新启发式算法，以指导生成物联网网络协议实现的黑盒模糊测试的测试用例。我们的方法（称为Iotinfer）通过不断监视输入消息突变的可能性导致反例与当前FSM的预测相冲突，从而平衡了探索和剥削。 Iotinfer还采用聚类技术来使FSM降低FSM，当时有限的计算资源用于模糊测试。我们为蓝牙和telnet协议实现Iotinfer，这些协议已被现有的IoT设备广泛使用。我们使用各种IoT设备的实验结果表明，物联网在生成有意义的测试用例方面有效，其中一些可以暴露以前未知的漏洞或与协议规格的实施偏差。我们还将Iotinfer与其他两个最先进的BlackBox IoT设备模糊工具进行了比较，并发现Iotinfer更好地从模糊目标引起了不同类型的响应。
The popularity of Internet of Things (IoT) devices calls for effective yet efficient methods to assess the security and resilience of IoT devices. In this work, we explore a new heuristic based on finite state machine (FSM) inference to guide generation of test cases for blackbox fuzzing tests of IoT network protocol implementations. Our method, which is called IoTInfer, balances exploration and exploitation by continuously monitoring how likely mutation of an input message leads to counterexamples conflicting with the prediction by the current FSM. IoTInfer also applies clustering techniques to coarsen the FSM inferred when there are limited computational resources provisioned for fuzzing tests. We implement IoTInfer for both Bluetooth and Telnet protocols, which are widely used by existing IoT devices. Our experimental results with a variety of IoT devices reveal that IoTInfer is efficient at generating meaningful test cases, some of which can expose previously unknown vulnerabilities or implementation deviations from protocol specifications. We also compare IoTInfer with two other state-of-the-art blackbox IoT device fuzzing tools and find that IoTInfer is better at eliciting different types of responses from the fuzzing targets.