Abstract
Third-party libraries are widely used in IoT firmware, and different versions of libraries have different vulnerabilities. Therefore, extracting versions of third-party libraries is of great significance for discovering known vulnerabilities of IoT devices. However, identifying the version of third-party library in IoT firmware is very challenging due to cross-architecture, cross-compiler, and cross-optimization options issues. To address this challenge, we present FirmAd, a GNN-based system that accurately detects third-party libraries’ versions in IoT firmware. The system leverages a two-stage approach that calculates the similarity of different granularity features to obtain the final TPL version. We evaluate FirmAd on a large-scale dataset comprising 10,699 TPLs and achieve a version information identification accuracy of 92.68%, which is 8% higher than existing methods.
Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
