Abstract:

The proliferation of Internet of Things (IoT) devices has led to increasingly severe security challenges posed by embedded firmware vulnerabilities. Current mainstream taint analysis schemes are plagued by significant limitations, including path explosion and high false positive rates. To overcome the limitations of existing solutions, this paper proposed Laptaint, a high-accuracy firmware vulnerability detection scheme based on taint analysis. First, for keyword matching, Laptaint integrated lightweight model and fuzzy matching to enhance keyword identification. This approach precisely recognized input sources, thereby reducing false negatives caused by missing source points. Second, in terms of data flow analysis, a fine-grained taint semantics model was constructed. This model utilized definitional reachability analysis to iteratively trace backward from hazardous function call sites, reaching the taint sources. Finally, for function sanitization, an integrated sanitization verification module validated tainted inputs through four distinct checking logics. Experiments conduct on 30 real-world device firmwares demonstrat Laptaint’s ability to identify vulnerabilities with an 82.02% accuracy rate, outperforming comparable schemes.

Key words: firmware security, vulnerability detection, taint analysis, sanitization validation