Cross-Architecture IoT Firmware Similarity Comparison Based on Multi-Layer GCN

Yu Wang, Dongdong Huo, Chuang Li, Sixiang Wang, Xiaokun Guo, Qihui Zhou

Abstract: In modern software development, there is a significant amount of reused code in popular software development kits (SDKs). The extensive reuse of third-party SDKs by developers during the development of large, heterogeneous Internet of Things (IoT) devices exacerbates the potential for potential security vulnerabilities and their subsequent mass propagation. One possible way to address these vulnerabilities is to employ cross-platform firmware vulnerability detection techniques, especially those rooted in the concept of similarity. One such technique, graph similarity detection, has become a focal point and has attracted a great deal of attention in the cybersecurity community. Graph Convolutional Networks (GCNs) are deep learning models specifically designed to process graph data. While traditional convolutional neural networks perform convolutional operations on regular grid data (e.g., images), GCN performs convolutional operations on graph data. It has shown excellent performance in many tasks on graph data such as node classification, graph classification and link prediction. In this paper, we propose a PFGCN framework that performs cross-layer graph convolutional network computations by providing an abstract representation of the procedure. Experimental results demonstrate the effectiveness of our scheme for cross-architecture firmware similarity detection.