# A Survey of Security Vulnerability Analysis, Discovery, Detection, and Mitigation on IoT Devices
## 1 Introduction  
Internet of Things (IoT) is becoming the most popular and practical online platform. It connects various sensors and controllers to the Internet and helps to achieve seamless communication between people and things. It tends to be the crucial future of the Internet. Especially in recent years, with the prosperity of the IoT industry, the variety and quantity of devices have grown rapidly. Globally, the total number of current active IoT devices has reached 7 billion [1]. They have been widely used in smart homes, smart wear, smart manufacturing, smart car, smart medical care, and many other life-related fields. We believe that it will greatly improve the quality of our lives. At the same time, security vulnerabilities of IoT devices often occur, and they are very difficult to be eliminated. HP's report showed that 70% of IoT products contain security vulnerabilities, and, on average, there are 25 vulnerabilities per device [2]. The attacker engaged in various illegal activities by maliciously exploiting vulnerabilities and controlling devices. The most well-known case is in 2016; the Mirai virus controlled hundreds of thousands of IoT devices and built botnets by manipulating the controlled devices. It launched Tbps-level denial-of-service (DoS) attacks on targets, including the DNS service provider Dyn causing severe problems such as partial Internet paralysis in the United States [3]. In conclusion, with the universal usage of IoT devices, the proliferation of security vulnerabilities will bring severe risks to the security and privacy of the users and even the safety of human lives and property. Facing frequent attacking risks, IoT security research has become increasingly popular. After the concept of \"Internet of Things\" was first proposed by American Auto-ID in 1999 [4], the securityresearchers have also contributed to IoT by working on standards of security architecture and communications [5; 6]. Subsequently, there was a lot of discussion about IoT security issues [7; 8; 9; 10; 11; 12]. [PERSON] et al. [13] and [PERSON] et al. [14] pointed out the challenges and research directions. Therefore, researchers began to use traditional security research methods in the field of IoT Security [15]. With the development of artificial intelligence (AI), the survey of the machine and deep learning methods for IoT security has also emerged [16]. [PERSON] et al. [17] systematically summarized the IoT vulnerabilities from device, mobile application, cloud endpoint, and communication in smart homes. For the summary of vulnerability analysis, [PERSON] et al. [18] summed up techniques of detecting IoT vulnerability. Recently [PERSON] et al. [19] published a survey of IoT vulnerability discovery techniques. In the two papers above, the boundaries between vulnerability discovery and vulnerability detection technologies are blurred. In this paper, the technology of vulnerability discovery is to mine unknown vulnerabilities, and the technology of vulnerability detection is to detect the existence of known vulnerabilities. Through the above investigations, we find that the current study focuses on IoT security issues and lack analysis techniques. Secondly, in this kind of vulnerability analysis, they mainly focus on vulnerability discovery and detection and lack attention to the techniques of vulnerability mitigation. There is a problem that the technical summary of IoT security is not comprehensive enough. In order to overcome the above problem, we want to make some contributions in three aspects:  
* First, we shift our focus from IoT architecture to IoT devices. Second, the classification of IoT device security technologies has been refined. In addition, we summarize the current research, which is considered from the basic framework of vulnerability analysis, discovering the unknown vulnerability, detecting known vulnerability, and mitigating vulnerability. * We evaluate the current research of vulnerability analysis on IoT devices.