CITA: Enhancing Multi-Binary Vulnerability Detection in IoT Firmware via Path-Aware Static Taint Analyssi

The rapid proliferation of Internet of Things devices has led to more ways to attack firmware. Multi-binary vulnerabilities resulting from insecure interactions between firmware components are becoming more common. Existing static analysis struggle to accurately reconstruct multi-binary data flows. These approaches frequently encounter critical challenges, including path explosion and taint propagation interruptions. In this paper, we present CITA, a path-aware static taint analysis framework that serves as a new approach for detecting multibinary vulnerabilities in IoT firmware. CITA constructs path dependency graphs to model more multi-binary interactions through an extended communication paradigm finder. We propose path behavior feature vectors to enable management policies for a large number of paths through in-depth analysis of path features, and further construct a taint analysis engine that incorporates path behavior analysis. We evaluate CITA on 69 realworld firmware samples, and it significantly outperforms other comparative methods by reducing false positives by 38.6 % while maintaining 86.2 % precision, and successfully finds 27 more bugs, including 17 multi-binary vulnerabilities. These results demonstrate CITA's superiority over state-of-the-art tools in accuracy and scalability.