关键词: 嵌入式设备, 网络安全, 漏洞检测, 污点分析, 无害处理识别

Abstract: The security issues of embedded devices are increasingly prominent, stemming from the negligence of device manufacturers towards security. To effectively identify vulnerabilities in embedded devices, taint analysis is a commonly used and effective technique. Taint sanitizer plays a crucial role in taint analysis by eliminating the security risks associated with tainted data. The accuracy of sanitizer identification directly determines the effectiveness of vulnerability detection. In the context of detecting vulnerabilities in embedded firmware, existing approaches reliant on simplistic pattern matching have led to the issue of false negatives in identifying taint sanitizer. To address this issue, this paper proposed a vulnerability detection method for embedded devices based on sanitizer identification, ASI, which improved the accuracy of sanitizer identification while ensuring lightweight and reducing the false positive rate of vulnerability detection results. The method established the “contentlength” association relationship between variables, finding potential variables that represent content length, thereby identifying sanitizers based on tainted length variables for path condition constraints. Additionally, it identified sanitizer functions that performed special character filtering based on heuristic methods. Experimental results on 10 device firmwares from 5 popular vendors showed that compared to existing ITS techniques, the false positive rate of ASI has been reduced by 9.58%, while the detection time cost has only increased by 7.43%.

Key words: embedded device, network security, vulnerability detection, taint analysis, Taint Sanitizer Detection