A neural network-based vulnerability mining method for internet of things devices

Abstract

The application discloses a kind of neural network-based Internet of Things equipment vulnerability mining method, it is related to Internet of Things equipment vulnerability detection technical field, including the following steps: step 1, collection Internet of Things equipment message sequence and pre-processing and annotation;Step 2, determine a message from all messages to be mutated for variation operation;Step 3, determine the variable segment of the message to be mutated, and execute multiple variation strategies;Step 4, fuzzy testing is carried out on Internet of Things equipment using the variable segment, and the feedback information of the fuzzy testing module is obtained by classifying the response of Internet of Things equipment.The application can generate more effective variable sequences through the variable sequence selection based on attention mechanism, and the device response classification based on improved clustering algorithm can reduce the number of mutations, and compared with several popular black-box testing tools, the number of mined vulnerabilities and the number of discovered program coverage paths are improved.

Description

Technical Field

[0001] This invention relates to the field of IoT device vulnerability detection technology, and in particular to a method for discovering IoT device vulnerabilities based on neural networks. Background Technology

[0002] The Internet of Things (IoT) allows for the construction of entire networks using inexpensive IoT devices, but this also means that IoT devices often lack security. IoT device security presents a unique challenge because devices and systems differ in nature and capabilities, and there is currently insufficient review of deployed IoT code, posing a significant risk to overall IoT security. Furthermore, the lack of unified standards for IoT devices and the absence of standardized protocols among manufacturers make vulnerability review difficult.

[0003] Vulnerabilities in IoT devices arise from a variety of reasons. The firmware of IoT devices is typically written in C or C++, meaning that special attention must be paid to security issues, including memory management, input validation, and buffer overflows. IoT firmware often has high privileges, giving it the ability to control hardware operations. If vulnerabilities in specific firmware are exploited by attackers, the consequences can be severe. Due to power consumption and component size limitations, IoT devices often lack features or security mechanisms considered unnecessary, making them vulnerable to attacks.

[0004] Current vulnerability detection methods for IoT devices mainly fall into three categories: static analysis, dynamic analysis, and fuzzing. Static and dynamic analysis both require access to the firmware source code for vulnerability discovery. However, since IoT manufacturers typically do not open-source their product firmware code, various static and dynamic analysis methods based on code analysis become difficult and ineffective. Therefore, fuzzing, which does not require source code, has become the mainstream method for discovering firmware vulnerabilities in IoT devices. Traditional black-box testing methods lack checks on network protocols and formats, often resulting in their inability to explore enough program execution paths within IoT devices.

[0005] Furthermore, fuzzing requires randomly varying the message sequence, which can lead to too many invalid test cases. A targeted mutation algorithm is needed to improve the effectiveness of the mutated sequences and cover more execution paths of IoT devices. Additionally, the new mutation information generated by fuzzing should cover more test directions to avoid repeated testing on already tested execution paths. Duplicate mutation information will negatively impact the efficiency and results of fuzzing.

[0006] Therefore, those skilled in the art are dedicated to developing a neural network-based method for discovering vulnerabilities in IoT devices. This method can examine network protocols and formats, generate more effective mutation sequences, reduce the number of mutations, and improve the efficiency of black-box testing. Summary of the Invention

[0007] In view of the above-mentioned deficiencies of the prior art, the technical problem to be solved by the present invention is how to explore a sufficient number of program execution paths in Internet of Things devices, how to improve the effectiveness of variant sequences, and how to avoid repeated testing on execution paths that have already been tested.

[0008] To achieve the above objectives, this invention provides a method for vulnerability discovery in Internet of Things (IoT) devices based on neural networks, the method comprising the following steps:

[0009] Step 1: Collect message sequences from IoT devices and perform preprocessing and labeling;

[0010] Step 2: Determine the message to be mutated from all the message sequences to be mutated;

[0011] Step 3: Identify the mutable segments of the message to be mutated and execute multiple mutation strategies;

[0012] Step 4: Use mutated fragments to perform fuzz testing on IoT devices. By classifying the responses of IoT devices, feedback information is obtained for the fuzz testing module.

[0013] Furthermore, step 1 also includes:

[0014] Step 1.1: Obtain the communication message sequence of IoT devices through open-source APIs of IoT vendors, third-party libraries, and communication data packet capture;

[0015] Step 1.2: Collect message sequences from open-source APIs and third-party libraries, and directly obtain their protocols and formats; identify the protocols and data formats of communication data obtained through communication data packet capture, parse the communication data network protocols using third-party tools, and extract the corresponding semantic features; if the protocol type cannot be identified, mark the protocol as an unknown protocol, use the standard library to complete the identification of JSON and XML formats, and use a heuristic encoding recognizer to identify the encoding format of the unidentifiable parts and decode them;

[0016] Step 1.3: Mark the message sequence obtained in Step 1.2 as a valid input sample, perform byte-by-byte mutation on the valid input sample, and input the mutated message sequence into the IoT device. If the IoT device responds with "error" or does not respond, mark it as an invalid input sample.

[0017] Furthermore, step 2 also includes:

[0018] Step 2.1: Use a bian model to measure the differences between input byte sequences. Assume an input... Then from the input The probability p(x) of the resulting outcome is equivalent to the number of times x appears in the input sequence pool, c(x). The minimum probability formula is shown below:

[0019]

[0020] Step 2.2: Based on the calculation results of the binary model, the probability... Minimum score min The smallest sequence is the next mutated sequence.

[0021] Furthermore, step 3 also includes:

[0022] Step 3.1: Input the selected message sequence to be mutated into the neural network model, and output the relevance score and classification result of each byte in the message sequence;

[0023] Step 3.2: Obtain the message sequence and its relevance score based on the neural network model. Use a sliding window to find adjacent bytes with similar relevance scores in the segment, treat them as a continuous segment and record them. If the average relevance score of this segment is low, delete it from the message sequence and search for mutated segments again. Return all recorded segments for mutation.

[0024] Step 3.3: After determining the mutated fragment, perform fragment mutation through methods such as setting to null, byte copying, data boundary, special characters, and character replacement.

[0025] Furthermore, the neural network model consists of an LSTM network and a fully connected network; while extracting features from the input sequence, the LSTM network calculates the relevance score of each byte in the output sequence through an attention mechanism; the fully connected network outputs the classification result.

[0026] Furthermore, the calculation formula for the attention mechanism is as follows:

[0027]

[0028]

[0029] In the formula, function g represents the LSTM network, function f represents the fully connected network, and δ represents the parameters determined during training; to constrain the calculation of the loss function... The Softmax function is used as the activation function for function g. In the LSTM network, an input with shape (70, 128, 0) is used, followed by a unidirectional LSTM network with an input dimension of 128, 128 hidden nodes in the hidden layer, and 1 LSTM layer. The output of the LSTM network is passed through the Softmax function to obtain the relevance score corresponding to the attention mechanism. The sum of the product of the relevance score and the input vector is then passed through fully connected layers with 128 and 32 nodes respectively. The fully connected layers contain dropout layers to prevent the model from overfitting.

[0030] Furthermore, the classification result is whether the mutated message sequence passes the device format check. If it fails the device format check, the message is discarded and subsequent procedures are not executed.

[0031] Furthermore, step 4 also includes the following steps:

[0032] Step 4.1: Send the mutated fragment to the IoT device, obtain the IoT device's response, and determine whether a potential vulnerability has been triggered;

[0033] Step 4.2: Vectorize the response into self-similarity score, total response length, number of symbols, number of paired symbols, number of words, and number of digits. Use an improved hierarchical clustering algorithm to classify the received IoT device response with all responses in the response pool and determine whether the response is a new response type.

[0034] Step 4.3: If the response is a new class, continue fuzz testing on the sequence; if it is not a new class, inform the fuzz testing module to stop fuzz testing on the message.

[0035] Step 4.4: Output the results of this fuzz test.

[0036] Furthermore, the improved hierarchical clustering algorithm is as follows: each data point is assigned to a separate cluster, each cluster contains only one data point, the centroid of each cluster is calculated, and the two clusters with the smallest average connection distance are found and merged in each layer iteration. The algorithm is executed n-1 times until only one cluster remains.

[0037] Furthermore, the centroid is calculated as a vector composed of the average values ​​of the components of each dimension of all data points in the cluster.

[0038] Compared with the prior art, the present invention has at least the following beneficial technical effects:

[0039] 1. This invention improves upon several existing popular black-box testing tools in terms of the number of vulnerabilities discovered and the number of program coverage paths found;

[0040] 2. The method proposed in this invention is more efficient in extracting message sequence formats, successfully extracting the non-mutable region of the message sequence, and reducing more unnecessary bytes in the mutated sequence;

[0041] 3. The improved hierarchical clustering algorithm used in this invention is significantly better than edit distance-based classification in terms of accuracy. While it is roughly the same as ordinary average connectivity hierarchical clustering, considering both clustering accuracy and efficiency, the method used is significantly better than average connectivity hierarchical clustering. Through clustering, the repeated paths of fuzzing tests are reduced, and the efficiency of fuzzing tests is improved.

[0042] The following will further explain the concept, specific structure, and technical effects of the present invention in conjunction with the accompanying drawings, so as to fully understand the purpose, features, and effects of the present invention. Attached Figure Description

[0043] Figure 1 This is a method framework diagram of a preferred embodiment of the present invention;

[0044] Figure 2 This is a diagram of a neural network structure for determining variable regions according to a preferred embodiment of the present invention;

[0045] Figure 3 This is a schematic diagram of an improved hierarchical clustering method according to a preferred embodiment of the present invention;

[0046] Figure 4 This is a flowchart of the response classification feedback of a preferred embodiment of the present invention. Detailed Implementation

[0047] The following description, with reference to the accompanying drawings, illustrates several preferred embodiments of the present invention to make its technical content clearer and easier to understand. The present invention can be embodied in many different forms, and the scope of protection of the present invention is not limited to the embodiments mentioned herein.

[0048] In the accompanying drawings, components with the same structure are indicated by the same numerical designation, and components with similar structures or functions are indicated by similar numerical designations. The dimensions and thicknesses of each component shown in the drawings are arbitrary, and the present invention does not limit the dimensions and thicknesses of each component. To make the illustrations clearer, the thickness of some components has been appropriately exaggerated in the drawings.

[0049] like Figure 1As shown, this embodiment provides a method for vulnerability mining of IoT devices based on neural networks, including three parts: data preprocessing, fuzzing, and mutation feedback. First, a large number of communication message sequences from IoT devices are obtained through multiple channels and preprocessed and labeled. Then, the fuzzing module uses an attention mechanism to identify immutable regions and continuously mutated segments in the message sequences to guide the mutation direction. The mutation feedback module judges whether the mutated input covers a completely new program execution path based on the IoT device's response, thereby reducing the number of mutations and improving black-box testing efficiency. The method includes the following steps:

[0050] Step 1: Collect message sequences from IoT devices and perform preprocessing and labeling. The specific process is as follows:

[0051] Step 1.1: Obtain a large number of communication message sequences of IoT devices through open-source APIs, third-party libraries, and communication data packet capture. Some manufacturers open-source their official APIs for IoT devices, and the device firmware type name and the list of supported attributes can be obtained based on the IoT device model. IoT third-party libraries contain the initial message sequences of IoT devices. By actually deploying IoT devices on the network, the communication message sequences can be obtained by clicking on the control terminal and capturing the communication data packets between the IoT devices.

[0052] Step 1.2: Message sequences collected from open-source APIs and third-party libraries can directly reveal their protocols and formats. The protocols and data formats of communication data obtained through packet capture are identified. Third-party tools are used to parse the communication data network protocols and extract corresponding semantic features. If the protocol type cannot be identified, it is marked as an unknown protocol. Standard libraries are used to identify JSON and XML formats. For unidentifiable parts, a heuristic encoding recognizer is used to identify the encoding format and then decode it.

[0053] Step 1.3: Mark the obtained message sequence as a valid input sample, perform byte-by-byte mutation on the valid input sample, and input the mutated message sequence into the IoT device. If the IoT device responds with "error" or does not respond, mark it as an invalid input sample.

[0054] Step 2: Identify the message to be mutated from all the message sequences to be mutated, and determine which sequence to perform fuzz testing using a binary model. The specific process is as follows:

[0055] Step 2.1: Use a bian model to measure the differences between input byte sequences. Assume an input... Then from the input The probability of the resulting outcome, p(x), can be equated to the number of times x appears in the input sequence pool, c(x), and the minimum probability formula is shown in Equation 1.

[0056]

[0057] Step 2.2: Based on the calculation results of the binary model, the probability... Minimum score min The smallest sequence is the next mutated sequence.

[0058] Step 3: Identify the mutable segments of the message to be mutated and execute various mutation strategies. The specific process is as follows:

[0059] Step 3.1, as follows Figure 2 As shown, the input to the neural network is the selected message sequence to be mutated. The entire seq2seq model consists of an LSTM network and a fully connected network. While extracting features from the input sequence, the LSTM network calculates the relevance score of each byte in the output sequence through an attention mechanism. The calculation formula for the attention mechanism is shown in Equation 2. The fully connected network outputs the classification result, i.e., whether the mutated sequence can pass the device format check; otherwise, the message is discarded and subsequent program execution is not performed.

[0060]

[0061]

[0062] Here, function g represents the LSTM network, function f represents the fully connected network, and δ represents the parameters determined during training. This is to constrain the calculation of the loss function. The Softmax function is used as the activation function for function g. In the LSTM network, an input with shape (70, 128, 0) is used, followed by a unidirectional LSTM network with an input dimension of 128, 128 hidden nodes in the hidden layer, and 1 LSTM layer. The output of the LSTM network is passed through the Softmax function to obtain the relevance score corresponding to the attention mechanism. The sum of the product of the relevance score and the input vector is then passed through fully connected layers with 128 and 32 nodes respectively. The fully connected layers contain dropout layers to prevent the model from overfitting.

[0063] Step 3.2: Based on the message sequence and its relevance score obtained from the neural network, a sliding window is used to find adjacent bytes with similar relevance scores within a segment. These are treated as a continuous segment and recorded. If the average relevance score of this segment is low, it is removed from the message sequence, and the search for mutated segments is repeated. All recorded segments are returned for mutation. In this example, a medium relevance score (ranking between 30% and 70% of the total relevance score) is chosen to mutate the input bytes. This preserves important input fields and corrects errors, which helps the network achieve a good fit and generates meaningful samples.

[0064] Step 3.3: After determining the mutated fragment, perform fragment mutation through methods such as setting to null, byte copying, data boundary, special characters, and character replacement.

[0065] Step 4: Perform fuzz testing on IoT devices using mutated fragments. By classifying the responses of IoT devices, feedback information is obtained for the fuzz testing module. The specific process is as follows:

[0066] Step 4.1: Send the mutated fragment to the IoT device and obtain the IoT device's response. The response includes information such as the function name, parameters, and whether the processing was correct. This information can be used to determine which program execution paths the sequence triggered and whether a potential vulnerability was triggered.

[0067] Step 4.2: Vectorize the response into self-similarity score, total response length, number of symbols, number of paired symbols, number of words, and number of digits. Use an improved hierarchical clustering algorithm to classify the received IoT device response against all responses in the response pool to determine whether the response is a new response type. The improved hierarchical clustering algorithm is as follows: Figure 3 As shown, initially, each data point is assigned to a separate cluster, so that each cluster contains only one data point. The centroid of each cluster is calculated, and in each iteration, the two clusters with the smallest calculated average connection distance are merged. The algorithm is executed n-1 times until only one cluster remains. The centroid is calculated as a vector composed of the average values ​​of all dimensional components of all data points in that cluster.

[0068] Step 4.3, as follows Figure 4 As shown, if the response is a new class, then fuzz testing continues on the sequence; if it is not a new class, then the fuzz testing module is not prompted to stop fuzz testing on the message.

[0069] Step 4.4: Output the results of this fuzz test. The IoT devices tested in this embodiment are shown in Table 1, and the vulnerability information discovered during the experiment is shown in Table 2. Seven vulnerabilities were found on eight IoT devices, including two denial-of-service vulnerabilities and five null pointer reference vulnerabilities.

[0070] Table 1. IoT devices tested

[0071] type Manufacturers model Version number Smart Bulb Yeelight YLDP05YL 2.1.70041 Smart Bulb Yeelight YLDP13YL 2.1.70041 Smart Bulb Xiaomi MJDP003 1.4.40031 Smart Plug Xiaomi ZNCZ07CM 2.1.00025 Smart Plug TPlink HS100 1.5.2 Smart Plug TPlink HS110 1.5.2 Router TPlink TL-WR941 V6150312 Router Philips Hue 2.1

[0072] Table 2 Vulnerability Information

[0073] equipment Vulnerability type quantity Yeelight-YLDP05YL Null Pointer Dereference 1 Yeelight-YLDP13YL Null Pointer Dereference 1 Xiaomi-ZNCZ07CM Denial of service 2 TPlink-HS100 Null Pointer Dereference 2 TPlink-HS110 Null Pointer Dereference 1

[0074] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A method for vulnerability discovery in Internet of Things (IoT) devices based on neural networks, characterized in that, The method includes the following steps: Step 1: Collect message sequences from IoT devices and perform preprocessing and labeling; Step 2: Determine a message to be mutated from all the message sequences to be mutated; Step 2 further includes: Step 2.1: Use a bian model to measure the differences between input byte sequences. Assume an input... Then, from the input The probability of the resulting outcome , Equivalent to in the input sequence pool x Number of times The formula for minimum probability is as follows: Step 2.2: Based on the calculation results of the binary model, the probability... Minimum The smallest sequence is the next mutated sequence; Step 3: Determine the mutable fragments of the message to be mutated and execute various mutation strategies; Step 3 further includes: Step 3.1: Input the selected message sequence to be mutated into the neural network model, and output the relevance score and classification result of each byte in the message sequence; Step 3.2: Obtain the message sequence and its relevance score based on the neural network model. Use a sliding window to find adjacent bytes with similar relevance scores in the segment, treat them as a continuous segment and record them. If the average relevance score of this segment is low, delete it from the message sequence and search for mutated segments again. Return all recorded segments for mutation. Step 3.3: After determining the mutated fragment, perform fragment mutation using methods such as setting to null, byte copying, data boundary manipulation, special characters, and character replacement. Step 4: Use mutated fragments to perform fuzz testing on IoT devices. By classifying the responses of IoT devices, feedback information is obtained for the fuzz testing module.

2. The method for vulnerability mining of IoT devices based on neural networks as described in claim 1, characterized in that, Step 1 further includes: Step 1.1: Obtain the communication message sequence of IoT devices through open-source APIs of IoT vendors, third-party libraries, and communication data packet capture; Step 1.2: Collect message sequences from open-source APIs and third-party libraries, and directly obtain their protocols and formats; identify the protocols and data formats of communication data obtained through communication data packet capture, parse the communication data network protocols using third-party tools, and extract the corresponding semantic features; if the protocol type cannot be identified, mark the protocol as an unknown protocol, use the standard library to complete the identification of JSON and XML formats, and use a heuristic encoding recognizer to identify the encoding format of the unidentifiable parts and decode them; Step 1.3: Mark the message sequence obtained in Step 1.2 as a valid sample, perform byte-by-byte mutation on the valid sample, and input the mutated message sequence into the IoT device. If the IoT device responds with "error" or does not respond, mark it as an invalid sample.

3. The method for vulnerability mining of IoT devices based on neural networks as described in claim 2, characterized in that, The neural network model consists of an LSTM network and a fully connected network. While extracting features from the input sequence, the LSTM network calculates the relevance score of each byte in the output sequence through an attention mechanism. The fully connected network outputs the classification result.

4. The method for vulnerability mining of IoT devices based on neural networks as described in claim 3, characterized in that, The calculation formula for the attention mechanism is as follows: In the formula, the function For LSTM networks, the function For a fully connected network, These are parameters determined during the training process; they are used to constrain the calculation of the loss function. ,use Softmax Function as a function The activation function; in the LSTM network, an input of shape (70, 128, 0) is used, followed by a unidirectional LSTM network with an input dimension of 128, 128 hidden nodes in the hidden layer, and 1 LSTM layer; the output of the LSTM network is then passed through... Softmax After obtaining the relevance score corresponding to the attention mechanism, the function sums the product of the relevance score and the input vector and passes it through fully connected layers with 128 and 32 nodes respectively. The fully connected layers contain dropout layers to prevent the model from overfitting.

5. The method for vulnerability mining of IoT devices based on neural networks as described in claim 4, characterized in that, The classification result is whether the mutated message sequence passes the device format check. If it fails the device format check, the message is discarded and subsequent procedures are not executed.

6. The method for vulnerability mining of IoT devices based on neural networks as described in claim 5, characterized in that, Step 4 further includes the following steps: Step 4.1: Send the mutated fragment to the IoT device, obtain the IoT device's response, and determine whether a potential vulnerability has been triggered; Step 4.2: Vectorize the response into self-similarity score, total response length, number of symbols, number of paired symbols, number of words, and number of digits. Use an improved hierarchical clustering algorithm to classify the received IoT device response with all responses in the response pool and determine whether the response is a new response type. Step 4.3: If the response is a new class, continue fuzz testing on the sequence; If it is not a new class, the fuzzing module will be notified to stop fuzzing the message. Step 4.4: Output the results of this fuzz test.

7. The method for vulnerability discovery in IoT devices based on neural networks as described in claim 6, characterized in that, The improved hierarchical clustering algorithm is as follows: each data point is assigned to a separate cluster, each cluster contains only one data point, the centroid of each cluster is calculated, and the two clusters with the smallest average connection distance are found and merged in each layer iteration. The algorithm is executed n-1 times until only one cluster remains.

8. The method for vulnerability mining of IoT devices based on neural networks as described in claim 7, characterized in that, The centroid is calculated as a vector composed of the average values ​​of each dimension component of all data points in the cluster.

Images