# Optimizing IoT Web Fuzzing by Firmware Infomation Mining
## 5 Related Work
### Dynamic Analysis  
Dynamic analysis (e.g., fuzz) has attracted much attention from researchers in the past few years, and related systems have been deployed and used on a large scale in theindustry. However, the special characteristics of IoT devices, such as limited hardware resources and complex system architecture, make traditional fuzz not directly applicable to vulnerability discovery in IoT devices.  
Recent dynamic analyses for IoT devices can be classified according to the interfaces tested. Previously we described the prevalence of the web interface and the advantages of using it for fuzz. More and more state-of-the-art is choosing this interface for vulnerability detection. Firmadyne [20] accesses web pages, collects SNMP information, and uses existing attack scripts to test the emulated firmware. FirmAE [8] is based on Firmadyne, which mainly solves the problem of the low success rate of emulation. They proposed an arbitration mechanism, which increases the simulation success rate from about 20% to about 80%. FirmFuzz [5] generates test cases through the web crawler and then mutates them for testing. As a result, it achieves better vulnerability detection results than previous dynamic analysis research. Building on FirmFuzz, FirmHunter proposes a stateful queue method and a two-level scheduling mechanism to discover vulnerabilities with stateful dependencies and speed up vulnerability discovery. WMIFuzzer [24] adopts mandatory interface automation technology and performs input and click operations on all elements to increase coverage as much as possible. It aims to extend the coverage of the crawler to enhance vulnerability discovery, and experiments show that WMIFuzzer can find more vulnerabilities than mainstream fuzz tools. IoTScope [13] constructs probing requests through static analysis to test physical devices, and narrows down the scope of identification by filtering out irrelevant requests and interfaces through differential analysis. It pinpoints hidden interfaces by attaching various device-setting parameters in the probing requests and matching keywords of sensitive information.  
From the initial simple analysis of web pages to the continuous optimization of crawlers for more function entries, dynamic analysis has been confined to the limited resources of web entry. None of these studies could discover hidden interfaces that are not displayed on the web entry or some function pages that are dynamically generated by js scripts, etc. IoTScope can obtain more function entries through static analysis of the firmware, but instead of using fuzz techniques to find vulnerabilities, they only looked at the issue of permissions for the interface by constructing requests. Our work extracts interfaces, page paths, and shared keywords from firmware to aid fuzz. Compared to existing work, we have enhanced the capability and speed of vulnerability discovery. Furthermore, because the firmware is only statically extracted once before fuzz testing, it is faster and has less overhead.  
In addition to the web interface, some research is based on other interfaces. To reduce the difficulty and effort of reversing executable files when analyzing vulnerabilities, [PERSON] [27] et al. designed IoTFuzzer to detect memory vulnerabilities in IoT devices by analyzing the device's Android APP. It can mutate the source data that constitutes the message and trigger memory vulnerabilities by mutating the length and type of the data. [PERSON] [28] et al. proposed a new type of vulnerability, SweynTooth, which affects devices running the low-energy Bluetooth protocol. Their experiments found that more than 480 devices were using the vulnerable SDK. Research on these interfaces is not suitable for large-scale vulnerability discovery due to limited interface resources or the small number of devices that contain this interface.