# A Vulnerability Scanning Method for Web Services in Embedded Firmware
## 2 Related Work
### Static Analysis-Based Approaches  
Current efforts addressing taint-style vulnerabilities in firmware primarily focus on taint analyses. [PERSON] et al. [9] developed a taint analysis tool, Dtaint, built on angr [24], which employs static taint analysis for vulnerability mining. Dtaint conducts data flow analysis based on a control flow graph, forms a data flow graph, and performs a backward depth-first search to identify execution paths from source to sink points. It then evaluates path constraints to detect potential taint-style vulnerabilities. However, it adheres to the traditional static analysis rules of personal computer programs for identifying source and sink points, leading to a higher rate of false positives in firmware vulnerability mining. FloT [10], developed based on angr [24], facilitates the detection of memory corruption vulnerabilities using fuzzy testing methods. It employs backward code-slicing techniques to traverse a binary program's control flow graph (CFG) within firmware. This process constructs hazardous code segments extending from input sources to calls of sensitive functions. Subsequently, it analyzes these segments through symbolic execution and dynamic fuzz testing. Nonetheless, FloT's localization of source points remains dependent on user-defined criteria. Inaccurate judgments of dangerous code segments could lead to false positives and false negatives in subsequent analyses. [PERSON] et al. [11] have addressed vulnerabilities in Web services of Internet of Things (IoT) devices by introducing the concept of \"boundary binary programs\". They designed a method, KARONTE, to identify boundary binary programs. KARONTE analyzes numerous indicators, such as the count of basic blocks, the number of branches, and the quantity of network feature strings within a program. It then employs the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) clustering algorithm to selectively identify binary programs within firmware that process web input data, which are subsequently designated as targets for taint analysis. However, their method does not consider the impact of web front-end factors, resulting in reduced identification accuracy. Based on KARONTE, [PERSON] et al. [12] factored in front-end considerations and developed a vulnerability mining approach centered on keywords shared between the front end and back end. This method identifies binary programs with the highest numbers of matching strings between the front end and back end, designating these as boundary binary programs. It uses the occurrence points of these key terms within the program as origin points for a taint analysis. By examining the function call graph, the method pinpoints potential vulnerability trigger paths and conducts a data flow analysis on these paths. Nevertheless, this approach overlooks the fact that user input data are ingested via data import functions, leading to a substantial number of false positives in the analysis. [PERSON] et al. [13] and [PERSON] et al. [14] have researched the identification of these external data import functions and have proposed relevant identification techniques.  
In summary, current static analysis methods for firmware vulnerabilities primarily rely on manually defined criteria to locate the origin points of vulnerabilities, including boundary binary programs and data import functions. Moreover, most studies arbitrarily designate the call locations of hazardous functions as sink points, lacking specificity. Such imprecise identifications of origin and termination points frequently lead to false positives and false negatives.