RECURRING VULNERABILITY DETECTION IN IOT FIRMWARE VIA REACHING-DEFINITION-GUIDED FINGERPRINTING

Abstract

Existing recurring-vulnerability detection schemes based on vulnerability fingerprints commonly suffer from low fingerprint-extraction efficiency and limited robustness to code mutation. To address these problems, this paper proposes ReVuln, an automated method for detecting recurring vulnerabilities in IoT firmware. ReVuln first uses a large language model (LLM) agent to extract high-level vulnerability features from vulnerability reports. It then derives path constraints by combining reaching definition analysis (RDA) with constrained symbolic execution, and analyzes the neighboring nodes of the function call graph, to build a semantic-structural, two-dimensional vulnerability fingerprint. Finally, based on this fingerprint, a multi-stage matching strategy detects recurring vulnerabilities in target firmware. Experimental results show that ReVuln achieves an average fingerprint matching ratio of 92.59% on mutated samples. For vulnerability detection, ReVuln attains a precision of 50.7% and a recall of 69.2%; its precision is comparable to FirmRec's 51.2% and well above SaTC's 19.0%, while its recall exceeds FirmRec's 59.0% and SaTC's 29.4%. Compared with FirmRec, ReVuln reduces fingerprint-extraction time by 24%. These results show that ReVuln improves fingerprint-extraction efficiency, mutation robustness, and detection recall while maintaining detection precision.