# A Survey of Security Vulnerability Analysis, Discovery, Detection, and Mitigation on IoT Devices
## 3 Vulnerability Analysis, Discovery, Detection, and Mitigation
### Research on Vulnerability Discovery
#### 3.2.1 Dynamic Analysis Method  
The dynamic analysis method needs tools of simulation firmware for dynamic debugging or performs on-chip debugging on a physical device to obtain feedback information. It mainly adopts fuzz testing to find the trigger point of the vulnerability.  
**Technical requirements:** The ability to dynamically debug on an IoT device.  
In card security research, [PERSON] et al. [52] used a universal algorithm to generate test samples and fuzz mobile phone cards or bank cards. For some modern smart cards containing web servers, [PERSON] et al. [53] have found some bugs based on the generated method of the HTTP protocol to fuzz these web servers. In terms of car safety, [PERSON] [54] and [PERSON] [55] can change the state of the car by mutating the packets sent to the Controller Area Network (CAN) bus [56] to a fuzz smart system of the car. Due to the difficulty of extracting firmware from the IoT device, _IoTFuzzer_[57] captures crash information by the user side to avoid this problem. Firstly, it inserts a stub to the interaction protocol code of the mobile application. Secondly, the authors of _IoTFuzzer_ mutate data that are captured from the stub and sent to the device. Finally, they judge the effect of fuzzing by heartbeat packets and response. Because devices are difficult to debug directly, researchers have begun to combine simulation technology to find the vulnerability. [PERSON] et al. [58] implement the fully automated framework that applies dynamic firmware analysis techniques to achieve automated vulnerability discovery of Web interfaces within embedded firmware images. Recently, targets of [PERSON] et al. [59] are no longer limited to web interfaces. They present FirmFuzz [59], an automated device-independent emulation and dynamic analysis framework for Linux-based firmware images (camera and router). [PERSON] et al. [60] proposed Firm-AFL, the first high-throughput greybox fuzzer for IoT firmware. In addition, they extended AFL [61], which is the currently popular fuzzer to the field of IoT. For research of fuzzing, [PERSON] et al. [62] analyzed the universality of traditional anomaly state detection methods for the IoT device, and they implemented a system based on _Avatar  
\begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Ref.**} & \multicolumn{2}{c}{**Architecture Support**} & \multirow{2}{*}{**Simulation Type**} \\ \cline{2-3} \cline{5-4}  & **ARM** & & **MIPS** & **x86** \\ \hline Avatar [43] & \(\surd\) & & Semi-simulation \\ Prospect [44] & & \(\surd\) & Semi-simulation \\ Surrogate [45] & \(\surd\) & & Semi-simulation \\ Avatar2 [46] & \(\surd\) & & Semi-simulation \\ Firmadyne [47] & \(\surd\) & \(\surd\) & Full simulation \\ \hline \hline \end{tabular}
\end{table}
Table 1: This table is a summary of the basic framework of vulnerability analysis. \(\surd\) = Yes. Semi-simulation = The framework needs to rely on the real-world device to receive forwarded I/O access.  
[43] and _Panda_[63]. In addition, they compare the throughput of a blackbox fuzzer under different configurations, including native execution (directly sending inputs to the hardware), partial emulation (redirecting only hardware requests to the hardware), and full emulation [60]. This is a performance evaluation of vulnerability analysis techniques. In conclusion, the types of vulnerabilities discovered by the aforementioned dynamic analysis techniques are diverse in Table 2. They are mainly memory issues such as buffer overflow (OB) and null pointer dereference (NPD). There will also be some web server vulnerabilities such as XSS, SQL injection because of the study of the web interface.