# A Survey on Recent Advanced Research of CPS Security
## 3 Reviews
### Fuzzing  
Fuzzing can be used to discover potential vulnerabilities by sending random input to applications and observing their behavior. It can trigger unexpected vulnerabilities that are difficult to find with conventional analysis. Researchers have applied fuzz technology to firmware, mobile apps, protocols, and other fields. Furthermore, they have improved the versatility and efficiency of the technology.  
FirmFuzz [137] is an open-source framework that automatically emulates and dynamically analyzes Linux-based firmware images. It employs a greybox-based generational fuzzing approach coupled with static analysis and system introspection to help fuzz the emulated firmware images while monitoring the firmware's running status. With the help of host emulation, the authors emulated and dynamically analyzed 32 images scraped from 27 unique vendor websites. They discovered seven previously undisclosed vulnerabilities spanning six different devices: two IP cameras and four routers and reported four new CVEs.  
FIRM-AFL [138] is the first high-throughput greybox fuzzer for IoT firmware. It supports three CPU architectures, mipsel, mipseb, and armed, so most firmware images can be emulated in a system emulator. With augmented process emulation, the performance bottleneck caused by system-mode emulation is solved by switching between user-mode and full-system emulation. After testing on 288 images, the evaluation results show that the throughput of FIRM-AFL can find 1-day or 0-day vulnerabilities 8.2 times higher than system-mode emulation-based fuzzing on average.  
Traditional testing techniques rely on observable crashes of a program, but memory corruption is often less visible on embedded devices due to their unique architecture. [PERSON] et al. [139] analyzed those differences on several categories of embedded devices and showed the difficulty of detecting memory corruptions. The authors further described and evaluated six heuristics that can be applied during the analysis of an embedded device to detect previously undetected memory corruptions. Based on Avatar and PANDA, they conducted numerous experiments to prove that live analysis can improve the fuzzing process of embedded systems.  
IoTFuzzer [50] was the first firmware-free fuzzing framework, as many devices' firmware is not easily extracted or decoded. This fuzzing framework communicates with a device through their official mobile apps to reuse program-specific logic and to mutate the test case without relying on any knowledge about its protocol specifications. With a lightweight monitor that gathered the target IoT device's status, the authors evaluated 17 real-world IoT devices running on different protocols and successfully identified 15 memory corruption vulnerabilities, including eight new vulnerabilities.  
IoTHunter [79] is the first gray-box fuzzer for fuzzing stateful protocols in IoT firmware. With a multistage message generation technique, IoTHunter can fuzz several stateful protocols (e.g., snmp, ftp, ssl, bgp, and smb) and has a high test case validation rate. The authors evaluated IoTHunter with a set of real-world programs, and the results proved that compared with black-box fuzzer-boduzz, the performance has 2.2\(\times\), 2.0\(\times\), and 2.5\(\times\) increases, respectively, in function coverage, block coverage, and edge coverage. They found five unknown vulnerabilities in the firmware of home router Mikrotik, which have been reported to the vendor.