HScanner: A Knowledge-Driven Framework for Early-Stage Detection of Hardware Vulnerabilities in IIoT Devices

Recurring hardware vulnerabilities, which refer to previously discovered vulnerabilities inadvertently reintroduced into new devices by designers, pose a significant challenge to the hardware security of Industrial Internet of Things (IIoT). To tackle this issue, we propose a framework called HScanner, which detects recurring hardware vulnerabilities during the design phase of IIoT devices. First, we abstract a hierarchical hardware feature set comprising 16 features (i.e., 6 coarse-grained features and 10 fine-grained features), which encapsulate crucial architectural information of the IIoT device. Next, we construct two knowledge graphs (KGs) by separately extracting hardware features from the design specifications of the target device and a well-known public hardware vulnerability database, namely National Vulnerability Database (NVD). After that, we propose a subgraph matching algorithm that identifies all subgraph mappings between the two KGs, where each mapping indicates a public hardware vulnerability involved in the device. Finally, we conduct experiments on 30 classical IIoT devices spanning four IIoT layers, including the perception, network, processing, and application layers. The results demonstrate the effectiveness of our HScanner. In detail, it finds out 40 recurring hardware vulnerabilities in 15 out of 30 devices. Among them, 34 vulnerabilities are successfully validated to be exploited to launch attacks. Compared to two state-of-the-art feature analysis methods, namely CYBOK and ICScope, as well as a manual analysis approach (MA), HScanner significantly reduces both the false alarm rate (FAR) and false negative rate (FNR). Specifically, HScanner reduces the FAR and FNR by 84.6% and 5.9% to CYBOK, 21.4% and 58.8% to ICScope, and 43.5% and 50% to MA, respectively.