A Firmware Vulnerability Detection Method Based on Feature Filtering

Open source code reuse and code cross-platform deployment accelerate the spread of software vulnerabilities, and pose challenges for accurate detection of cross-platform vulnerabilities. The binary vulnerability similarity detection method based on machine learning lacks a fine-grained vulnerability similarity feature filtering mechanism, and cannot solve cross-function vulnerabilities triggered by data dependencies, resulting in a high vulnerability false positive rate in existing solutions, which limits practical applications. Software code vulnerabilities are usually caused by function key statements. Therefore, based on binary function decompilation, we identify the key statement that causes the vulnerability, analyze the cross-function data dependency of the key statements, extract the code similarity features and code vulnerability features of the key statements, and propose a feature filtering-based Binary vulnerability detection method SimFilter. SimFilter calculates the similarity of key statements by comparing the characteristics of function key statements, and infers the similarity of binary function vulnerabilities based on the similarity of key statements. The experimental results show that the vulnerability semantic features extracted by SimFilter are highly interpretable, and the accuracy rate is increased by 10.8% compared with other models. At the same time, we analyzed and evaluated the impact of different similarity features on the accuracy of SimFilter, and gave the best empirical value of the SimFilter model in firmware vulnerability detection.