# A Survey of Security Vulnerability Analysis, Discovery, Detection, and Mitigation on IoT Devices
## 3 Vulnerability Analysis, Discovery, Detection, and Mitigation
### Research on Vulnerability Detection
#### 3.3.2 Similarity Detection Method  
Security researchers have introduced software code similarity detection methods to detect known vulnerabilities due to a large number of unpatched known vulnerabilities in IoT devices. At this stage, the research on similar detection is mainly aimed at the traditional software security field and gradually supports IoT devices by across-architectures. There is no research paper specifically for IoT firmware similarity detection. In Figure 4, the basic idea of similarity detection method is to extract the original features from the code such as strings, an instruction sequence, basic block, syntax tree, function call graph, and so on. Then, these features are measured similarly by the algorithm. Finally, it is determined whether there is a vulnerability in the corresponding code fragment. This section is mainly divided into the following two points: similarity detection on source code and similarity detection on binary code. **Technical requirements:** The ability to fetch firmware of IoT devices. (1) Similarity Detection on Source Code  
In terms of detecting known vulnerabilities based on source code, _CP-Miner_[74] adopts a token-based method that uses a lexer to generate a token sequence and search for repeated token sequences to measure similarity. _ReDeBug_[75] proposed a scalable method that can combine patch code to determine features of the vulnerability code before repaired, and it provides detecting the unpatched code clones. However, the above code-based approach does not apply to IoT. In most cases, security researchers can not obtain the source code of firmware. Figure 4: Similarity detection architecture. (2) Similarity Detection on Binary Code  
In terms of detecting known vulnerabilities based on binary code, researchers mainly faced the problem that it is difficult to detect code similarity due to different compiler code generation algorithms, different compiler optimization options, and different instruction sets. _N-Grams_[76] and _N-Perms_[77] are early means for vulnerability search [78]. [PERSON] et al. [79] use binary sequences or code in memory to match algorithms without any understanding of code semantics. Thus, these kinds of methods are difficult to deal with the opcode reordering problem caused by different compilation options. To improve the matching accuracy, the _Tracelet-based_[80] approach reconstructs the code into an execution sequence and uses a solver to handle its constraints and data constraints. Thus, it solves the problem of operation code disorder. Furthermore, _TEDEM_[81] adopts symbols to simplify binary programs and judge the similarity of code by tree editing distance as the basic blocks. It can even find vulnerabilities on different operating systems. Due to some common syntactic features, features of the basic block are difficult to express similarities between binary files. Researchers began to consider adopting the program of Control Flow Graph (CFG) [82] to describe the behavior of the program. Therefore, the similarity comparison can be performed by the graph. _BinDiff_[83] and _Binslayer_[84] check the similarity between the two binaries based on the similarity measure of CFG isomorphism, but not specifically designed for vulnerability detection. It is difficult to find cross-platform vulnerability code fragments by comparing two completely different binaries of CFG. [PERSON] et al. [85] proposed _Blanket Execution_ and point out that the research on establishing semantic similarity of binaries based on static analysis is easily affected by compilation chain and compilation optimization level. Therefore, they suggested extracting the dynamic run-time features of the program to counter the changes of CFG caused by the above reasons. _BinHunt_[86] and _iBinHunt_[87] use symbolic execution and theorem proving techniques to examine the semantic equivalence between basic blocks and find out which semantics are different.