CG-Fuzzing: a comprehensive fuzzy algorithm for ZigBee. (2016)

• Record Type: Journal Article
• Authors: Cui, Baojiang; Wang, Ziyue; Zhao, Bing; Liang, Xiaobing
• Is Part Of: International journal of ad hoc and ubiquitous computing. Volume 23:Number 3/4(2016)
• Page Start: 203
• Page End: 215
• Publication Date: 2016
• Subjects: CG-fuzzing -- fuzz tests -- ZigBee vulnerability -- IoT -- internet of things -- network security -- MAC layer -- medium access control -- genetic-based fuzzing -- genetic algorithms -- filtering rules -- vulnerability triggering; Ubiquitous computing -- Periodicals; Embedded computer systems -- Periodicals; Electronic data processing -- Distributed processing -- Periodicals; Wireless communication systems -- Periodicals; Computer architecture -- Periodicals; 004.2
• Languages: English
• ISSNs: 1743-8225

Abstract

ZigBee defines several security services on the MAC layer, including sequential freshness, frame integrity, data encryption and access control. Unfortunately, there are still security vulnerabilities that could result in network meltdown. Therefore, it is necessary to detect these defects by using a fuzzing test. However, fuzzing tests have usually been inefficient because test cases are either too numerous or invalid. In this paper, a novel comprehensive fuzzing test algorithm, CG-Fuzzing (comprehensive genetic-based-fuzzing) is proposed. The CG-Fuzzing algorithm contains three parts: structure-based, boundary-based and genetic algorithms. This paper establishes an evolutionary model that helps achieve high rates of passing filtering rules and vulnerability triggering. Compared with the traditional fuzzing methods, the number of test cases is reduced and they are more efficient. Experimental results prove that the synthesised performance of CG-Fuzzing is outstanding. The fuzzing test with the algorithm takes only 4 min to exploit a previously known vulnerability of ZigBee.