💻 computer science

EvoPatch-IoT: Evolution-Aware Cross-Architecture Vulnerability Retrieval and Patch-State Profiling for BusyBox-Based IoT Firmware

EvoPatch-IoT is an evolution-aware framework that enables cross-architecture vulnerability retrieval and patch-state profiling in stripped BusyBox-based IoT firmware by leveraging anonymous instruction features and historical function prototypes, achieving significant performance improvements over baselines and reducing manual inspection efforts by nearly 99%.

Original authors: Yinhao Xiao, Huixi Li, Yongluo Shen

Published 2026-04-22

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yinhao Xiao, Huixi Li, Yongluo Shen

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a digital detective trying to find a specific, dangerous flaw in a massive library of locked, anonymous books. These aren't normal books; they are IoT firmware (the software inside your smart cameras, routers, and thermostats).

Here is the problem:

The Books are Stripped: The publishers (device manufacturers) have removed all the names, chapter titles, and author signatures from the books. They are just pages of code with no labels.
The Library is Huge and Mixed: The library contains thousands of versions of the same book (BusyBox, a common software toolkit), printed in different languages (different computer architectures like ARM, MIPS, x86).
The Goal: You need to find a specific "bad page" (a vulnerability) in one of these anonymous books to see if your device is safe. But without names, how do you know which page is which?

This is where EvoPatch-IoT comes in. Think of it as a super-smart, time-traveling detective that solves this mystery.

The Detective's Toolkit: How It Works

Instead of trying to read the whole book at once, EvoPatch-IoT uses three clever tricks to match the anonymous pages to known "bad pages" from the past.

1. The "Shape" of the Page (Geometric Priors)

Imagine you have a torn page from a mystery novel. You can't read the text, but you can measure it.

How long is the page?
Where does it sit in the book?
How many paragraphs (lines of code) does it have?
How many times does it jump to another page?

EvoPatch-IoT measures these physical "shapes" of the code. Even if the text is gone, the shape of the code often stays the same. It's like recognizing a friend in a crowd not by their face (which is hidden), but by their height, stride, and how they carry their bag.

2. The "Time Machine" (Evolution-Aware Prototypes)

This is the secret sauce. The detective doesn't just look at the current book; they look at history.

They know that in 2015, a specific chapter had a typo.
They know that in 2020, the publisher fixed that typo.
They know that in 2024, the publisher changed the font but kept the story the same.

EvoPatch-IoT builds a "Time Machine" database. It remembers how functions (the chapters) changed over 57 different versions of the software. When it sees a new, anonymous page, it asks: "Does this page look like the 'bad' version from 2015, or the 'fixed' version from 2020?" This helps it guess the patch state—is the device vulnerable, or has it been patched?

3. The "Universal Translator" (Cross-Architecture)

The library has books written in different languages (AArch64, ARM, MIPS, etc.). A sentence in one language might look completely different in another, even if it means the same thing.

EvoPatch-IoT acts as a translator. It normalizes the "shape" and "story" of the code so it can compare a page written in "MIPS" with a page written in "x86."
It realizes that even though the words are different, the structure of the story is identical.

The Results: Why This Matters

In the past, security experts had to manually read thousands of these anonymous, stripped books to find a flaw. It was slow, expensive, and often missed the danger.

With EvoPatch-IoT:

Speed: It can scan a massive library and find the suspicious pages in seconds.
Accuracy: It successfully identified the right "bad page" 34.56% of the time on the very first guess (Hit@1), which is a huge jump compared to previous methods.
Efficiency: It reduced the amount of manual work security experts need to do by 99%. Instead of reading 600 pages to find the bad one, they only need to check about 6.

The Real-World Test

The researchers tested this on a real-world bug called CVE-2021-42386 (a flaw in the "AWK" tool used for text processing).

They asked the system: "Is this device using the old, broken version of the AWK tool, or the new, fixed version?"
The system correctly identified the state of the device 82% of the time, even when the device was running on a completely different type of processor than the one the researchers studied.

The Bottom Line

EvoPatch-IoT is like giving security experts a magnifying glass that can see through time and language barriers. It doesn't need the book's title or author to find the dangerous pages. By looking at the "shape" of the code and remembering how it changed over the years, it can tell you if your smart camera or router is vulnerable to hackers, saving us from having to manually inspect every single device in the world.

1. Problem Statement

The security auditing of Internet of Things (IoT) firmware is hindered by three primary challenges:

Stripped Binaries: Real-world firmware images are distributed as stripped binaries, lacking function symbols, source paths, or version strings, making reverse engineering difficult.
Heterogeneous Architectures: The same open-source component (e.g., BusyBox) is compiled for diverse Instruction Set Architectures (ISAs) such as ARM, MIPS, AArch64, and x86_64.
Version Evolution & Inconsistent Patching: Vendors often reuse old versions, backport only partial patches, or customize components. Auditors need to determine if a specific stripped function corresponds to a known vulnerable upstream routine and whether the binary represents a "vulnerable" or "patched" lineage, despite significant version drift.

Existing methods often focus on generic binary similarity or cross-architecture matching but lack evolution-awareness (tracking changes over time) and function-level granularity specifically for stripped BusyBox components.

2. Methodology: EvoPatch-IoT

EvoPatch-IoT is a retrieval framework designed to localize homologous functions in stripped binaries and profile their patch states without relying on symbols. It operates through four main layers:

A. Benchmark Construction

The authors constructed a large-scale, reproducible benchmark comprising:

57 Historical Versions of BusyBox (v1.11.0 to v1.37.0).
270 Unstripped and 285 Stripped binaries across 5 architectures (AArch64, ARM, MIPS, MIPSEL, x86_64).
130 Source Releases for verification.
155,845 High-Confidence Matches: Established via a bidirectional alignment process between stripped and unstripped binaries.

B. Feature Extraction (Stripped-Compatible)

Since symbols are missing, the system extracts anonymous features using a headless Ghidra exporter:

Geometric Shape Descriptor: A 5-dimensional vector capturing the function's location, size, and rank within the binary (e.g., log(size), normalized address, address rank). This serves as a robust local prior.
Anonymous Multi-View Features:
- Tokens: Instruction tokens converted to TF-IDF embeddings.
- Context: Call references, strings, and constants converted to embeddings.
- Graph Statistics: Control Flow Graph (CFG) metrics (basic blocks, edges, branch densities).
Fused Representation: These views are concatenated into a 361-dimensional vector $z(f)$ , normalized per architecture.

C. Bidirectional Anonymous Alignment

To bridge the gap between stripped and unstripped binaries without leaking labels during testing:

A bidirectional nearest-neighbor matching algorithm is used within version-architecture buckets.
It enforces mutual consistency: A stripped function $s$ and a labeled function $l$ are matched only if $s$ is the nearest neighbor of $l$ and $l$ is the nearest neighbor of $s$ , based on geometric distance.
This creates "anchors" used to train prototypes and evaluate performance.

D. Evolution-Aware Retrieval Scoring

The final ranking score $R(q, c)$ for a query $q$ and candidate $c$ combines three components (Eq. 11):
$R(q, c) = \lambda_s [-D_s(q, c)] + \lambda_f \cos(z(q), z(c)) + \lambda_p \cos(z(c), p_{u(q)})$

Geometric Term ( $\lambda_s = 0.70$ ): Negative shape distance. This is the backbone, ensuring local structural similarity.
Multi-View Fusion ( $\lambda_f = 0.10$ ): Cosine similarity of the fused semantic embeddings to resolve ambiguity.
Historical Prototype ( $\lambda_p = 0.20$ ): Compares the candidate against a historical prototype $p_u$ (an average of fused vectors from older versions of the same function identity). This injects "evolution memory" to handle version drift.

E. Patch-State Profiling

A lightweight proxy classifier uses whole-binary statistics (file size, symbol counts, function size distributions) to predict whether a binary is in a "vulnerable" or "patched" state for specific CVEs.

3. Key Contributions

First Large-Scale BusyBox Benchmark: A unique dataset exposing cross-version evolution and stripped/unstripped correspondence across 57 versions and 5 architectures.
EvoPatch-IoT Framework: A novel retrieval method that fuses geometric priors, multi-view semantic embeddings, and historical evolution prototypes.
Bidirectional Alignment Algorithm: A rigorous method for establishing high-confidence anchors between stripped and unstripped binaries without symbol leakage.
Comprehensive Evaluation: Extensive testing on 1,020 architecture pairs and 128,084 queries, including a specific case study on CVE-2021-42386 (an AWK vulnerability).

4. Experimental Results

Evaluated against 12 baseline families (including transformer-based, graph-based, and heuristic methods):

Retrieval Performance:
- Weighted Hit@1: 34.56% (outperforming the strongest baseline, Array 2025, by 16.04%).
- Weighted Hit@10: 56.24% (outperforming the baseline by 26.85%).
- Mean Inspected@10: Reduced the manual inspection space by 98.98% (auditors only need to inspect ~6.2 functions on average before finding the match, down from a pool of ~609).
Robustness:
- EvoPatch-IoT was the best-performing method on 56 out of 57 BusyBox versions.
- It maintained consistent advantages even on difficult architecture pairs (e.g., ARM to MIPS).
Evolution Transfer:
- Version-change transfer studies achieved a mean ROC-AUC of 0.9887, proving that version evolution signals are transferable across architectures.
Patch-State Profiling:
- On the CVE-2021-42386 case study, the proxy achieved 82.44% accuracy and 88.47% F1-score across held-out architectures.

5. Significance and Implications

Practical Auditing: The framework significantly reduces the "search space" for security analysts, transforming a massive reverse-engineering task into a manageable ranked list of candidates.
Evolution as a Signal: The study demonstrates that historical version data is not just noise but a critical supervisory signal that improves retrieval robustness when version drift is high.
Geometry vs. Semantics: The results highlight that in stripped binary analysis, local geometric priors are the most reliable backbone, while semantic fusion and historical prototypes are essential for resolving ambiguities in complex neighborhoods.
Scalability: The lightweight, deterministic nature of the pipeline allows for scalable monitoring of large IoT device fleets.

In conclusion, EvoPatch-IoT provides a practical, evolution-aware foundation for auditing stripped IoT firmware, effectively bridging the gap between heterogeneous, stripped binaries and known vulnerable upstream code.