Evaluation and Application of Two Fuzzing Approaches for Security Testing of IoT Applications

  • Omar M. K. Alhawi
  • Alex Akinbi
  • Ali DehghantanhaEmail author


The proliferation of Internet of Things (IoT) embedded with vulnerable software has raised serious doubts about security of IoT devices and networks. Enhancing fuzzing performance and efficiency to enable testing these software samples is a challenge. Fuzzing is an automated technique widely used to provide software quality assurance during testing to find flaws and bugs by providing random or invalid inputs to a computer software. However, the technique could take significant amount of time and effort to complete during the test phase of the software development lifecycle. Reducing the time required to fuzz a software will improve efficiency and productivity during the software testing phase to enable detailed analysis and fixing of bugs or flaws found in the computer program. There are a number of factors that influence the fuzzing technique, such as quality of test cases or invalid inputs used during the test and how these samples were collected or created. In this paper, we introduce a technique to leverage from the different crashes discovered from two fuzzing approaches to improve fuzzers by concentrating on utilised test cases. The code coverage is used as an efficiency metric to measure the test case on the tested software and to assess the quality of a given input. Different sample features were created and analysed to identify the most effective and efficient feature used as input for the fuzzer program to test the target software.


Fuzzing Fuzzing analysis Software testing Software quality assurance IoT Test case construction 


  1. 1.
    D. Kiwia, A. Dehghantanha, K.-K. R. Choo, and J. Slaughter, “A cyber kill chain based taxonomy of banking Trojans for evolutionary computational intelligence,” J. Comput. Sci., Nov. 2017.Google Scholar
  2. 2.
    Y.-Y. Teing, D. Ali, K. Choo, M. T. Abdullah, and Z. Muda, “Greening Cloud-Enabled Big Data Storage Forensics: Syncany as a Case Study,” IEEE Trans. Sustain. Comput., pp. 1–1, 2017.Google Scholar
  3. 3.
    Y.-Y. Teing, A. Dehghantanha, K.-K. R. Choo, and L. T. Yang, “Forensic investigation of P2P cloud storage services and backbone for IoT networks: BitTorrent Sync as a case study,” Comput. Electr. Eng., vol. 58, pp. 350–363, Feb. 2017.Google Scholar
  4. 4.
    Y.-Y. Teing, A. Dehghantanha, and K.-K. R. Choo, “CloudMe forensics: A case of big data forensic investigation,” Concurr. Comput. Pract. Exp., p. e4277, Jul. 2017.Google Scholar
  5. 5.
    S. Homayoun, A. Dehghantanha, M. Ahmadzadeh, S. Hashemi, and R. Khayami, “Know Abnormal, Find Evil: Frequent Pattern Mining for Ransomware Threat Hunting and Intelligence,” IEEE Trans. Emerg. Top. Comput., 2017.Google Scholar
  6. 6.
    H. H. Pajouh, A. Dehghantanha, R. Khayami, and K.-K. R. Choo, “Intelligent OS X malware threat detection with code inspection,” J. Comput. Virol. Hacking Tech., 2017.Google Scholar
  7. 7.
    F. Norouzizadeh Dezfouli, A. Dehghantanha, B. Eterovic-Soric, and K.-K. R. Choo, “Investigating Social Networking applications on smartphones detecting Facebook, Twitter, LinkedIn and Google+ artefacts on Android and iOS platforms,” Aust. J. Forensic Sci., pp. 1–20, Aug. 2015.Google Scholar
  8. 8.
    O. Osanaiye, H. Cai, K.-K. R. Choo, A. Dehghantanha, Z. Xu, and M. Dlodlo, “Ensemble-based multi-filter feature selection method for DDoS detection in cloud computing,” Eurasip J. Wirel. Commun. Netw., vol. 2016, no. 1, 2016.Google Scholar
  9. 9.
    A. Shalaginov, S. Banin, A. Dehghantanha, and K. Franke, “Machine Learning Aided Static Malware Analysis: A Survey and Tutorial,” 2018, pp. 7–45.Google Scholar
  10. 10.
    J. Baldwin and A. Dehghantanha, Leveraging support vector machine for opcode density based detection of crypto-ransomware, vol. 70. 2018.Google Scholar
  11. 11.
    O. M. K. Alhawi, J. Baldwin, and A. Dehghantanha, Leveraging machine learning techniques for windows ransomware network traffic detection, vol. 70. 2018.Google Scholar
  12. 12.
    S. Homayoun, M. Ahmadzadeh, S. Hashemi, A. Dehghantanha, and R. Khayami, “BoTShark: A Deep Learning Approach for Botnet Traffic Detection,” Springer, Cham, 2018, pp. 137–153.Google Scholar
  13. 13.
    M. Petraityte, A. Dehghantanha, and G. Epiphaniou, “A Model for Android and iOS Applications Risk Calculation: CVSS Analysis and Enhancement Using Case-Control Studies,” Springer, Cham, 2018, pp. 219–237.Google Scholar
  14. 14.
    M. Conti, A. Dehghantanha, K. Franke, and S. Watson, “Internet of Things security and forensics: Challenges and opportunities,” Futur. Gener. Comput. Syst., vol. 78, pp. 544–546, Jan. 2018.Google Scholar
  15. 15.
    M. Hopkins and A. Dehghantanha, “Exploit Kits: The production line of the Cybercrime economy?,” in 2015 Second International Conference on Information Security and Cyber Forensics (InfoSec), 2015, pp. 23–27.Google Scholar
  16. 16.
    H. Haddadpajouh, A. Dehghantanha, R. Khayami, and K.-K. R. Choo, “A Deep Recurrent Neural Network Based Approach for Internet of Things Malware Threat Hunting,” Futur. Gener. Comput. Syst., 2018.Google Scholar
  17. 17.
    S. Watson and A. Dehghantanha, “Digital forensics: the missing piece of the Internet of Things promise,” Comput. Fraud Secur., vol. 2016, no. 6, pp. 5–8, Jun. 2016.Google Scholar
  18. 18.
    A. Azmoodeh, A. Dehghantanha, and K.-K. R. Choo, “Robust Malware Detection for Internet Of (Battlefield) Things Devices Using Deep Eigenspace Learning,” IEEE Trans. Sustain. Comput., pp. 1–1, 2018.Google Scholar
  19. 19.
    N. Milosevic, A. Dehghantanha, and K.-K. R. Choo, “Machine learning aided Android malware classification,” Comput. Electr. Eng., vol. 61, 2017.Google Scholar
  20. 20.
    G. Epiphaniou, P. Karadimas, D. K. B. Ismail, H. Al-Khateeb, A. Dehghantanha, and K. R. Choo, “Non-Reciprocity Compensation Combined with Turbo Codes for Secret Key Generation in Vehicular Ad Hoc Social IoT Networks,” IEEE Internet Things J., 2017.Google Scholar
  21. 21.
    H. Haddad Pajouh, R. Javidan, R. Khayami, D. Ali, and K.-K. R. Choo, “A Two-layer Dimension Reduction and Two-tier Classification Model for Anomaly-Based Intrusion Detection in IoT Backbone Networks,” IEEE Trans. Emerg. Top. Comput., pp. 1–1, 2016.Google Scholar
  22. 22.
    G. Mcgraw, “Software security,” IEEE Secur. Priv. Mag., vol. 2, no. 2, pp. 80–83, Mar. 2004.Google Scholar
  23. 23.
    A. Azmoodeh, A. Dehghantanha, M. Conti, and K.-K. R. Choo, “Detecting crypto-ransomware in IoT networks based on energy consumption footprint,” J. Ambient Intell. Humaniz. Comput., pp. 1–12, Aug. 2017.Google Scholar
  24. 24.
    S. Walker-Roberts, M. Hammoudeh, and A. Dehghantanha, “A Systematic Review of the Availability and Efficacy of Countermeasures to Internal Threats in Healthcare Critical Infrastructure,” IEEE Access, 2018.Google Scholar
  25. 25.
    A. Causevic, D. Sundmark, and S. Punnekkat, “An Industrial Survey on Contemporary Aspects of Software Testing,” in 2010 Third International Conference on Software Testing, Verification and Validation, 2010, pp. 393–401.Google Scholar
  26. 26.
    P. Godefroid, M. Y. Levin, and D. Molnar, “Automated Whitebox Fuzz Testing,” 2008.Google Scholar
  27. 27.
    & A. G. Michael Sutton, Adam Greene, “Fuzzing: Brute Force Vulnerability Discovery - Google Books.” 2007.Google Scholar
  28. 28.
    Charlie Miller and Zachary N.J. Peterson, “Analysis of Mutation and Generation-Based Fuzzing,” 2007.Google Scholar
  29. 29.
    John Neystadt, “Automated Penetration Testing with White-Box Fuzzing.” 2008.Google Scholar
  30. 30.
    P. Godefroid, M. Y. Levin, and D. Molnar, “SAGE: Whitebox Fuzzing for Security Testing SAGE has had a remarkable impact at Microsoft. THE HIGH COST OF SECURITY BUGS A Sample JPG Image,” 2012.Google Scholar
  31. 31.
    V. W. Cadar Cristian, Godefroid Patrice, Khurshid Sarfraz, Corina S. Pasareanu, Sen Koushik, Tillmann Nikolai, “Symbolic Execution for Software Testing in Practice – Preliminary Assessment,” 2011.Google Scholar
  32. 32.
    A. Rebert, J. Foote, J. Org, D. Warren, and D. Brumley, “Optimizing Seed Selection for Fuzzing.”Google Scholar
  33. 33.
    Microsoft, “Introduction to Instrumentation and Tracing.” 2013.Google Scholar
  34. 34.
    P. Feiner, A. D. Brown, and A. Goel, “Comprehensive Kernel Instrumentation via Dynamic Binary Translation,” 2012.Google Scholar
  35. 35.
    A. Takanen, J. DeMott, and C. Miller, “Fuzzing for Software Security Testing and Quality Assurance (Artech House Information Security and Privacy),” 2008.Google Scholar
  36. 36.
    PeachTech, “Peach Fuzzer: Discover unknown vulnerabilities.”Google Scholar
  37. 37.
    R. Luk, Chi-Keung, Cohn, Robert, Muth, G. Patil, Harish, Klauser, Artur, Lowney, and K. Vijay, Steven Wallace, Reddi, Janapa, Hazelwood, “Pin: Building Customized Program Analysis Tools with Dynamic Instrumentation,” 2005.Google Scholar
  38. 38.
    J. S. Dave Weinstein, “The History of the !exploitable Crash Analyzer – Security Research & Defense.” 2009.Google Scholar
  39. 39.
    L. de Moura and N. Bjørner, “Z3: An Efficient SMT Solver,” 2008, pp. 337–340.Google Scholar

Copyright information

© Springer Nature Switzerland AG 2019

Authors and Affiliations

  • Omar M. K. Alhawi
    • 1
  • Alex Akinbi
    • 2
  • Ali Dehghantanha
    • 3
    Email author
  1. 1.Department of Computer ScienceUniversity of SalfordManchesterUK
  2. 2.School of Computer Science, Liverpool John Moores UniversityLiverpoolUK
  3. 3.Cyber Science Lab, School of Computer ScienceUniversity of GuelphGuelphCanada

Personalised recommendations