Abstract Fuzzing, especially coverage-guided greybox (CG) fuzzing, has been demonstrated to be effective in discovering software security vulnerabilities. Code coverage achieved through instrumentation plays a vital role in this. However, closed-source software within IoT devices cannot easily perform binary instrumentation to trace coverage like traditional computers efficiently. To address this problem, we propose IoTtracer, an IoT CG fuzzing framework using low-cost coverage tracing. Unlike the state-of-the-art IoT CG fuzzers (e.g. AFLIoT and GDBFuzz), IoTtracer does not rely on complex binary-level rewrite or limited hardware breakpoints for instrumentation, but directly instruments the binary in a Linux-based IoT device through the software interrupts. To avoid frequently trapping into interrupts during fuzzing and reduce the overhead of collecting coverage, we also design a discrete instrumentation strategy and distributed adaptive coverage tracing for IoTtracer. We evaluated IoTtracer on multiple benchmarks containing real-world IoT devices. IoTtracer enables efficient and accurate tracing of full coverage in IoT devices by inserting probes into only an average of 37.8% of the binary’s basic blocks. In addition, IoTtracer’s throughput is 1.28–2.77× higher than AFLIoT. These results show that IoTtracer can more efficiently obtain the target’s coverage in IoT devices and effectively guide fuzzing to detect their potential vulnerabilities.

Abstract As the number of Internet of Thing (IoT) devices increases, attacks against their vulnerabilities have become a serious threat. The web servers (WSs) in IoT devices provide management services for end-users, which are currently the major attack surface. Several fuzzing solutions for identifying vulnerabilities in IoT devices have been proposed, but there is currently no grey-box fuzzer specifically designed for the unique features of WSs in IoT to effectively detect memory corruption vulnerabilities. We design and implement KVFL, an efficient grey-box fuzzer, to address the issues of low throughput and slow exploration of deep code when fuzzing for IoT WSs. Firstly, KVFL employs a delicate hooking technology that heuristically hijacks and emulates hardware-dependent functions, ensuring WSs can be accurately and efficiently emulated in user-mode. On this basis, KVFL fully utilizes the loop parsing HTTP requests feature of WSs through a redesigned fork-server, to minimize nonessential rebooting losses of the target, thereby significantly improving fuzzing throughput. Secondly, KVFL leverages code coverage feedback to automatically infer a set of valid Keys and derive a Key-Value mutation. This enables the generation of high-quality test cases that can facilitate deeper code exploration of WSs. The evaluation results show that compared to the state-of-the-art IoT grey-box fuzzer FIRM-AFL, KVFL improves the throughput by over 2× and explores 4.5× more edges. Additionally, it identifies all 1-day vulnerabilities with over 7× faster speed than the baseline and detects three previously unknown 0-day vulnerabilities. These all indicate that KVFL is effective and efficient at fuzzing IoT WSs.

Autonomous Systems (ASes) communicate via the Border Gateway Protocol (BGP), forming the Inter-domain routing network, the Internet’s critical infrastructure. Large-scale BGP anomalies over the years have caused serious damage to the global Internet. Effective BGP anomaly detection helps early mitigation of BGP anomalies. Methods based on machine learning, especially graph learning, have achieved remarkable results. However, existing methods based on graph learning have two limitations. One is to use AS communication graphs as the input to the graph neural network model, ignoring the interactions between AS nodes that are physically topologically connected and weakening the perception of anomalous neighbouring nodes; and the other is to use the average features of all nodes as the features of the whole network, smoothing the differences of different nodes, reducing the detection performance while failing to support anomaly tracing. We propose a BGP anomaly detection method based on the spatio-temporal feature representation model for AS (ASSTFR). The ASSTFR model is based on the Graph Attention Network (GAT) and Gated Recurrent Unit (GRU), which automatically extracts spatio-temporal features of AS nodes, rather than the whole network. We use ASSTFR to predict AS features by combining the actual topological connection of AS nodes and the historical information of AS communication features. Thus, the anomaly score of each AS can be generated based on the prediction and observation of AS features. We aggregate AS node anomaly scores based on node importance to detect BGP anomalies, which can distinguish the different contributions of different nodes to the network. The experimental results show that our method outperforms the existing methods in all metrics. Compared with the best-performing existing method, the accuracy, precision, recall, and F1-score of our method are improved by 2.7%, 3.0%, 2.3%, and 2.7% respectively. What’s more, ranking anomaly scores of AS nodes can narrow down the scope of investigation for abnormal origin AS, which helps to locate the root cause of BGP anomalies.

Existing correlation processing strategies make up for the defect that most evaluation algorithms do not consider the independence between indicators. However, these solutions may change the indicator system’s internal connection, affecting the final evaluation result’s interpretability and accuracy. Besides, traditional independent analysis methods cannot accurately describe the complex multivariate correlation based on the linear relationship. Aimed at these problems, we propose an indicators correlation elimination algorithm based on the feedforward neural network and Taylor expansion (NNTE). Firstly, we propose a generalized n-power correlation and a feedforward neural network to express the relationship between indicators quantitatively. Secondly, the low-order Taylor expression expanded at every sample is pointed to eliminate nonlinear relationships. Finally, to control the expansions’ accuracy, the layer-by-layer stripping method is presented to reduce the dimensionality of the correlations among multiple indicators gradually. This procedure continues to iterate until there are all simple two-dimensional correlations, eliminating multiple variables’ correlations. To compare the elimination efficiency, the ranking accuracy is proposed to measure the distance of the resulting sequence to the benchmark sequence. Under Cleveland and KDD99 two datasets, the ranking accuracy of the NNTE method is 71.64% and 96.41%, respectively. Compared with other seven common elimination methods, our proposed method’s average increase is 13.67% and 25.13%, respectively.

Coverage‐based greybox fuzzing has strong capabilities in discovering virtualization software vulnerabilities. Efficiency is one of the most important indicators while evaluating greybox fuzzing. However, the interference of virtual hardware state conditions on testcase evaluation severely impairs the efficiency of greybox fuzzing. In order to reduce the interference of virtual hardware state conditions and increase the efficiency of fuzzing, we propose a state‐based virtual hardware fuzzing framework, named SAVHF (State‐Aware Virtual Hardware Fuzzing). In this framework, a source‐to‐source instrumentation method based on the abstract syntax tree is proposed to detect the state condition of virtual hardware. Based on the source‐to‐source instrumentation, we afterwards propose a state‐based fuzzing strategy to adapt to the state conditions of virtual hardware. We realize the prototype system of SAVHF and use it to evaluate 17 popular virtual hardware of Qemu and find 16 bugs with 1 CVE (Common Vulnerabilities and Exposures) number assigned. Evaluation results demonstrate that the proposed SAVHF framework covers an average of more than 61% of virtual hardware code branches in the 18 hours testing and can improve the average code coverage by 11.04% compared with the path‐based fuzzing strategy.

Security incidents such as natural disasters and power outages can cause inter‐domain routing system regional failures, significantly impact the Internet’s safety. Reducing the impact of security incidents is essential for maintaining the stability of the Internet. One of the major impacts of security incidents is that many UPDATE messages will generate, which may easily cause network oscillations. This paper presents the UPDATE messages analysis during the six security incidents and finds that many duplicates and invalid messages are the leading cause of network instability. To effectively process these UPDATE messages, this paper proposes an UPDATE message preprocessing algorithm by analyzing the UPDATE operating mechanism to remove duplicate and invalid messages. Aiming at the problem of slow route search in existing route update methods using software‐defined networking (SDN), this paper designs a RIB hierarchical structure for multi‐level retrieval and proposes SMSEI‐SDN combination with current route update strategies. Experimental results show that when a security incident occurs, by removing duplicate and invalid messages, SMSEI‐SDN can reduce the total number of messages by an average of 19% and a maximum of 34.9% within the 60 s of caching time. Besides, SMSEI‐SDN can reduce the routing update time by more than 99.98% compared to existing methods. This work provides insights for network operators and researchers interested in security incident impact suppression in the inter‐domain routing system.

Penetration testing offers strong advantages in the discovery of hidden vulnerabilities in a network and assessing network security. However, it can be carried out by only security analysts, which costs considerable time and money. The natural way to deal with the above problem is automated penetration testing, the essential part of which is automated attack planning. Although previous studies have explored various ways to discover attack paths, all of them require perfect network information beforehand, which is contradictory to realistic penetration testing scenarios. To vividly mimic intruders to find all possible attack paths hidden in a network from the perspective of hackers, we propose a network information gain based automated attack planning (NIG-AP) algorithm to achieve autonomous attack path discovery. The algorithm formalizes penetration testing as a Markov decision process and uses network information to obtain the reward, which guides an agent to choose the best response actions to discover hidden attack paths from the intruder’s perspective. Experimental results reveal that the proposed algorithm demonstrates substantial improvement in training time and effectiveness when mining attack paths.