From Source Code to Network Profile: Automated and Traceable MUD Profile Generation for IoT Devices
AutoMUD builds traceable IoT MUD network profiles from firmware and source code rather than traffic.
Manufacturer Usage Description files let IoT vendors specify expected network behavior so access-control policies can confine a device, but traffic-only profiling misses rare or conditional communications. AutoMUD combines static and syntactic extraction, retrieval-grounded language-model reasoning, and deterministic validation to recover endpoints from firmware and source code and compile them into MUD rules. Each rule is tied to source-level provenance, and excluded findings are kept with explicit reasons. On a Linux-based repository it produced structurally valid profiles, and a controlled semantic fault-injection study showed analysts could detect, localize, explain, and correct errors so policies matched their clean counterparts.
- AutoMUD derives MUD profiles from firmware and source code, not traffic.
- Every generated rule is linked to source-level provenance.
- It recovers rare, conditional, and failure-triggered communication paths.
- Fault injection shows propagated policy errors can be found and corrected.
From the original article
1 min read at arxiv.orgThe Manufacturer Usage Description (MUD) standard allows IoT manufacturers to define expected network behaviors in a MUD file. This file can be translated into enforceable access-control policies, restricting compromised devices to operate solely through manufacturer-defined communication patterns. However, practical adoption of MUD depends on profiles that are accurate, complete, and maintainable.
By Alessandro Lotto · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.