信息网络安全

信息网络安全 ›› 2026, Vol. 26 ›› Issue (2): 325-337.doi: 10.3969/j.issn.1671-1122.2026.02.012

• 技术研究 • 上一篇    下一篇

基于污点流分析的物联网固件高可信度漏洞检测

张光华1, 李国瑜1, 王鹤2, 李珩3, 武少广1()   

  1. 1.河北科技大学信息科学与工程学院， 石家庄 050018
    2.西安电子科技大学网络与信息安全学院， 西安 710071
    3.河北省网络安全感知与防御技术创新中心， 石家庄 052161
  • 收稿日期:2025-06-20 出版日期:2026-02-10 发布日期:2026-02-23
  • 通讯作者: 武少广 wushaoguang@hebust.edu.cn
  • 作者简介:张光华（1979—），男，河北，教授，博士，CCF高级会员，主要研究方向为网络与信息安全|李国瑜（2002—），男，山东，硕士研究生，主要研究方向为固件安全|王鹤（1987—），女，河南，讲师，博士，主要研究方向为应用密码和量子密码协议|李珩（1978—），男，河北，副教授，硕士，主要研究方向为软件工程|武少广（1987—），男，河北，讲师，硕士，CCF会员，主要研究方向为人工智能安全
  • 基金资助:
    国家自然科学基金(62072239);国家自然科学基金(62372236);河北省硕士在读研究生创新能力培养资助项目(CXZZSS2025076)

High-Confidence Vulnerability Detection in IoT Firmware Based on Taint Flow Analysis

ZHANG Guanghua1, LI Guoyu1, WANG He2, LI Heng3, WU Shaoguang1()   

  1. 1. School of Information Science and Engineering, Hebei University of Science and Technology, Shijiazhuang 050018, China
    2. School of Cyber Engineering, Xidian University, Xi’an 710071, China
    3. Hebei Cybersecurity Perception and Defense Technology Innovation Center, Shijiazhuang 052161, China
  • Received:2025-06-20 Online:2026-02-10 Published:2026-02-23

RichHTML

5

PDF (PC)

11

摘要：

随着物联网设备的普及，其内嵌固件的安全漏洞面临的挑战日益严峻。当前，主流的污点分析方案存在路径爆炸和误报率高的问题。为了克服现有方案的不足，文章提出基于污点流分析的物联网固件高可信度漏洞检测方案Laptaint。首先，融合了轻量化模型和模糊匹配进行相应的关键字匹配，通过精确识别输入源来减少因源点丢失而造成的假阴性问题；然后，构建了细粒度污点语义模型，利用定义可达性分析从危险函数调用点开始，迭代地向后追踪，到达污点源；最后，集成的消毒验证模块通过4种检查逻辑，对污点输入进行有效性验证。对30个真实设备固件进行测试，实验结果表明，Laptaint方案以82.02%的准确率来挖掘漏洞，性能优于同类方案。

关键词: 固件安全, 漏洞检测, 污点分析, 消毒验证

Abstract:

The proliferation of Internet of Things (IoT) devices has led to increasingly severe security challenges posed by embedded firmware vulnerabilities. Current mainstream taint analysis schemes are plagued by significant limitations, including path explosion and high false positive rates. To overcome the limitations of existing solutions, this paper proposed Laptaint, a high-accuracy firmware vulnerability detection scheme based on taint analysis. First, for keyword matching, Laptaint integrated lightweight model and fuzzy matching to enhance keyword identification. This approach precisely recognized input sources, thereby reducing false negatives caused by missing source points. Second, in terms of data flow analysis, a fine-grained taint semantics model was constructed. This model utilized definitional reachability analysis to iteratively trace backward from hazardous function call sites, reaching the taint sources. Finally, for function sanitization, an integrated sanitization verification module validated tainted inputs through four distinct checking logics. Experiments conduct on 30 real-world device firmwares demonstrat Laptaint’s ability to identify vulnerabilities with an 82.02% accuracy rate, outperforming comparable schemes.

Key words: firmware security, vulnerability detection, taint analysis, sanitization validation

中图分类号: