On feasibility of network based firmware change detection
Year: 2026
Type: conference-paper
Abstract: The proliferation of Internet of Things (IoT) devices introduces significant security challenges, particularly concerning hidden firmware updates and insider threats that exploit legitimate update mechanisms. Traditional methods for detecting firmware version changes often require extensive human interaction or privileged access to the device, motivating the need for novel detection approaches. This paper proposes a novel network-based fingerprinting technique to reliably detect firmware changes in IoT devices without requiring reverse engineering. Our method involves collecting a diverse set of firmware-module specific features, including network latency, throughput, and system reactions to fuzzed inputs, and applying statistical analysis to establish a "ground truth" baseline. Subsequent measurements are then compared against this baseline to determine whether modifications have occurred. We detail an experimental setup utilizing a modified fuzzer in a real laboratory environment with actual hardware. Feasibility tests on home gateways equipped with different firmware versions demonstrate that non-deterministic factors have minimal impact, allowing for reliable identification of both unaltered devices and those running different firmware versions. This approach offers a scalable and efficient solution to enhance IoT supply chain security by providing a robust mechanism for detecting subtle, yet critical, firmware modifications.
Institutions: SINTEF, SINTEF Digital
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7171978744