TIR-VD: Binary vulnerability detection based on texture and input-related embeddings

Abstract

The rapid expansion of IoT systems fuels the reuse of vulnerable code in firmware binaries, exposing IoT devices to network attacks. Current dynamic analysis, which relies on emulation and fuzzing, suffers from high latency, hindering large-scale vulnerability detection that is especially critical today. Static analysis leverages program structure and statistical features for vulnerability detection. However, existing Static approaches fail to accurately reconstruct vulnerability logic due to limited feature sets, and IoT programs are typically closed-source binary programs lacking code features, leading to high false positive and false negative rates. We propose TIR-VD, an innovative method that addresses the limitations of existing approaches, significantly improving binary vulnerability detection in IoT system. First, we convert binary sample into images using the Bin2Img algorithm and extract texture features with a lightweight deep learning model. Next, we construct a weighted input-related control flow graph (WIR-CFG) and extract semantic features by a semantic-aware deep learning framework. For vulnerability detection, we match the target binary against vulnerability samples by integrating both texture and semantic features. The experimental results indicate that TIR-VD surpasses existing open-source tools in vulnerability detection accuracy and efficiency. Additionally, we identified two 0-day vulnerabilities in binary and reported them to the vendor. TIR-VD significantly enhances vulnerability detection accuracy and efficiency in IoT firmware binaries by integrating texture and semantic features, enabling scalable and accurate analysis of closed-source IoT binaries.