Attack trapping system based on firmware simulation

Abstract

The invention relates to an attack trapping system based on firmware simulation. The attack trapping system comprises the following steps: (1) obtaining and analyzing firmware; (2) for the firmware information obtained in the step (1), using a QEMU simulator to simulate target firmware through a system-level simulation technology; (3) on the basis of the step (2), constructing a honeypot system, deploying a high-interaction honeypot system based on an SSH proxy protocol in a virtualization environment, and performing information configuration; and (4) on the basis of the step (3), performing attack behavior capture, monitoring various attack behavior characteristics of the equipment in real time in the honeypot, and capturing information such as an attack initiating way of an attacker andthe like. According to the invention, analog simulation is carried out on the firmware through the QEMU simulator, and the honeypot environment based on the SSH protocol is deployed by using the virtualization technology, so that various attack behaviors for the equipment can be effectively monitored in real time, malicious attacks can be captured, and a more efficient and complete system securityprotection system can be constructed.

Description

technical field [0001] The invention belongs to the technical field of computer security, and in particular relates to computer equipment firmware, simulation simulator and honeypot technology, especially an attack trapping system based on firmware simulation. Background technique [0002] With the rapid development of the Internet of Things and the widespread popularization of embedded devices, more and more embedded devices are connected through the network. Users can use mobile phones, PCs and other mobile devices to control any embedded device connected to the network anywhere. For example, people can use their mobile phones to connect to network cameras in the office to monitor any abnormal situation at home at any time, to observe whether the electrical appliances in the home are turned off, whether there are thieves breaking into the house, etc. While bringing convenience, it also brings many potential problems. Embedded devices have a variety of processor architectu...

AI Technical Summary

Problems solved by technology

However, the disadvantage of this kind of full network scanning is that it can only perform vulnerability scanning for the open ports of embedded devices. If the device has no open ports or is not connected to the Internet at all, it cannot be analyzed for vulnerabilities.

Due to the wide variety of embedded IoT devices with different functions, and there are various security vulnerabilities in the firmware, the security research for embedded devices is very difficult, resulting in an increasing attack surface and frequent also getting higher

Various device manufacturers are not active in firmware security testing and updating, and users will not take the initiative to upgrade the firmware after purchasing the device. Once a vulnerability is found in the firmware of an embedded device, it will affect millions or even tens of millions. The number of users is safe

Images