Network protocol software is usually characterized by complicated functions and a vast state space. In this type of program, a massive number of stateful variables that are used to represent the evolution of the states and store some information about the sessions are prone to potential flaws caused by violations of protocol specification requirements and program logic. Discovering such variables is significant in discovering and exploiting vulnerabilities in protocol software, and still needs massive manual verifications. In this paper, we propose a novel method that could automatically discover the use of stateful variables in network protocol software. The core idea is that a stateful variable features information of the communication entities and the software states, so it will exist in the form of a global or static variable during program execution. Based on recording and replaying a protocol program’s execution, varieties of variables in the life cycle can be tracked with the technique of dynamic instrument. We draw up some rules from multiple dimensions by taking full advantage of the existing vulnerability knowledge to determine whether the data stored in critical memory areas have stateful characteristics. We also implement a prototype system that can discover stateful variables automatically and then perform it on nine programs in ProFuzzBench and two complex real-world software programs. With the help of available open-source code, the evaluation results show that the average true positive rate (TPR) can reach 82% and the average precision can be approximately up to 96%.

Component vulnerability matching offers an approach for discovering vulnerabilities existing in IoT firmware. In this work, A component composition analysis and reliability assessment (C2ARA) is developed to improve the component vulnerability matching. The C2ARA method employs a knowledge graph for discovering the components and their relationships from the extracted file system of the firmware. The key to the proposed method is to discover vulnerabilities from the component composition extracted from IoT firmware file systems, rather than only the information provided by CVE databases and firmware vendor. The results of the experiment with a large-scale dataset demonstrate the effectiveness of the C2ARA method.

Various types of network protocol software vulnerabilities often result in considerable damage. However, existing root cause analysis methods, which rely on symbolic path tracing and the hardware processor tracing (PT) function, cannot be applied in protocol software. They are also limited by the restricted resources of embedded platforms and symbolic execution ability. Additionally, manually analysing vulnerabilities is typically labour intensive. To solve this problem, we propose SEEKER, the first root cause analysis method based on deterministic replay for multi-type network protocol vulnerabilities to automatically generate vulnerability analysis reports. By proposing a multilayer semantic model, SEEKER extracts fine-grained semantics, compares the extracted semantics with predefined vulnerability rules and finally generates an analysis report.We implemented and evaluated SEEKER against 7 vulnerability types, across 4 real-world software programs, covering 2 different platforms. The experimental results show that SEEKER can identify the root causes of multi-type vulnerabilities and even find 3 new 0-day vulnerabilities. Meanwhile, SEEKER demonstrates impressive adaptability and scalability. It can analyse one execution path that involves up to 135,437,793 instructions and upwards of 15,893,356 memory access requests.