YODA: Middleware for Improving Setup and Preprocessing in Static Analysis of IoT Firmware

Cyber-attacks targeting vulnerabilities in the internet of things (IoT) devices are increasing every year, and various methods and analysis tools for IoT vulnerability detection have been proposed. Concerning the analysis tools, reducing man-hours is crucial to ensure that users concentrate only on the work necessary to perform the analysis. However, the analysis tools proposed by existing studies are time-consuming in their setup, preprocessing, and analysis. To address these issues, we propose the Yielding Optimal Device Analyzer (YODA) middleware for static analysis of IoT firmware. To define the requirements of YODA, we referred to the existing analysis tools, common middleware definitions, and typical middleware requirements for IoT environments. In the construction phase, we developed four functions and an innovation related to the setup. To evaluate the utility of YODA, we compared the time for setup, preprocessing, and analysis with a baseline tool and Karonte, the most popular analysis tool available presently. Accordingly, we observed that YODA was faster than Karonte at every stage: the average setup time was 53 minutes, average preprocessing time was 2 hours and 31 minutes, and average analysis time was ~11 hours for the analysis of a firmware with size 304 MB. Thus, we successfully developed the middleware that fulfills the requirements of firmware analysis.