# A Survey on Recent Advanced Research of CPS Security
## 3 Reviews
### Firmware Analysis  
Firmware analysis is mainly divided into two categories: static and dynamic analysis. In static analysis, symbolic execution and flow analysis are optimized to address firmware characteristics. In dynamic analysis, the research focus is to simulate firmware operations in a more general way. FIRMADYNE [140] is an open-source automated dynamic analysis framework for identifying vulnerabilities in Linux-based embedded firmware. First, FIRMADYNE crawled from various vendor websites to download firmware images and gathered 23,035 firmware images spanning 42 vendors. Second, it used a binwalk API to extract the kernel and root filesystem to identify the hardware architecture. Next, it leveraged the corresponding QEMU full system emulator to launch the service. With 60 known exploits and 14 unknown vulnerabilities that were discovered by the framework, it evaluated 9486 firmware images successfully, and 887 firmware images were vulnerable to one or more exploits. Genius [141] is a numeric-feature-based search scheme that improves the effectiveness of cross-platform bug searches. It learns higher-level numeric features from representative control flow graphs (CFGs) and then searches for bugs based on the learned higher-level features. To speed up the process, it converts the CFGs into high-level numeric feature vectors, which can be indexed by locality sensitive hashing [159]. After evaluating 8126 devices with 420,558,702 functions across three architectures and 26 vendors, the results showed that Genius can execute a query in 1 s on average. Practically, Genius searched 154 vulnerabilities in the two latest firmware images from D-LINK and found 103 potential vulnerabilities, 16 of which have been confirmed. Gemini [142] is a neural network-based method for detecting the similarity of firmware. It leverages a graph embedding network to convert the attributed control flow graph (ACFG) of images into an embedding and uses a neural network model to train the datasets of firmware and vulnerabilities. Specifically, with similarity detection, Gemini uses previous CVEs to identify more vulnerable firmware images with higher precision and lower time overhead than the state-of-the-art methods, i.e., Genius [141]. Inception [94] is a complex framework for testing complete real-world embedded firmware. The inception translator generates and merges high-level and low-level semantic code to preserve the semantics of the source code, thus improving the effectiveness of detecting vulnerabilities. Based on KLEE, an inception symbolic virtual machine performs symbolic execution, and handles memory abstractions of peripherals and interruptions with several strategies. Finally, the inception debugger redirects memory accesses to the peripherals on real hardware from a virtual machine. Evaluated on four real-world open-source and three industrial applications, Inception found eight crashes and two previously unknown vulnerabilities, which proves its ability to assist embedded image testing. Avatar [160] can allow a user to emulate the firmware of an embedded device, which facilitates dynamic analysis. By injecting a software proxy, Avatar can execute instructions in the emulator while communicating with the physical hardware. Avatar2 [161] further supports orchestrating executions among multiple testing environments. It can organize different systems by \"moving\" the execution of binary code from one to another. PRETENDER [143] is a framework that creates models of peripherals to allow the execution of firmware in a fully emulated environment. It first records the execution process in the MMIO region and locates the boundaries of each distinct periphery in the memory space of devices. Then, it uses multiple iterations of linear regression modeling to obtain proper models for each memory location. Tested on three hardware platforms with different embedded CPUs, PRETENDER successfully allows rehosting and survivable execution on six example firmware and supports smart fuzzing.