A method for locating nodes reinforced with firmware buffer overflow vulnerability patches

Abstract

The present invention discloses a method for locating a firmware buffer overflow vulnerability patch reinforcement node, and belongs to the field of information security technology. The locating method comprises the following steps: Step 1, vulnerability exploitation path perception: parsing the binary data of the firmware, restoring the calling relationship between functions, performing mixed symbolic execution on the buffer operations involved in the vulnerability, and capturing the vulnerability exploitation process; Step 2, buffer attribute weight allocation: using an objectively weighted entropy weight method to integrate and sort a variety of buffer operation data, and improve the exploitation details of the overflow vulnerability from the perspective of multiple attribute aggregation; Step 3, patch reinforcement node positioning: establishing a multi-attribute decision model based on probabilistic hesitant fuzzy elements and prospect theory to locate the patch reinforcement node of the firmware buffer overflow vulnerability. The present invention is conducive to quickly and efficiently positioning the key nodes of patch reinforcement.

Description

Technical Field

[0001] The invention belongs to the technical field of information security, and in particular relates to a method for locating a firmware buffer overflow vulnerability patch reinforcement node. Background Art

[0002] With the rapid development of IoT technology, embedded IoT devices have become the primary target of cyber attackers. In September 2016, the worm Mirai infected millions of IoT devices such as routers, webcams, and wireless printers to launch DDoS attacks, making the official websites and online services of many Internet companies including Amazon, Twitter, and Spotify inaccessible, and cutting off the Internet in half of the United States. In 2017, IoT_Reaper exploited vulnerabilities in routers, cameras and other devices to spread zombie programs to the Internet, infecting and controlling a large number of online hosts, with the number of infections reaching nearly 2 million. In May 2018, the Cisco security team disclosed a highly scalable and destructive malware VPNFilter, which can burn firmware devices to cover its own tracks, and can also monitor device traffic to steal user information.

[0003] The vulnerability report of the National Information Security Vulnerability Database (CNNVD) shows that in 2020, CNNVD collected a total of 3,047 IoT device vulnerabilities. The top three vulnerability types are permission bypass, information leakage, and buffer overflow. The buffer is a continuous storage space in the operating system memory. Figure 3 As shown in the figure, buffer overflow is caused by the program failing to correctly check whether the length of the user input data exceeds the size of the target buffer. Excessive data is written to the buffer, causing the overflow data to overwrite the memory area adjacent to the buffer, which may lead to control flow hijacking. Buffer overflow is reflected in the code as the existence of a function or variable related to buffer operations.

[0004] According to Intel China's forecast, the number of IoT devices worldwide will reach 100 billion in 2025. IoT devices are usually closed embedded systems, and firmware is a binary program specially customized for embedded systems. In 2020, the Fraunhofer Institute for Communications in Germany conducted a security analysis of 127 router firmwares from 7 brands and found that on average each router had 53 high-risk CVE vulnerabilities, and the average time for vulnerability repair was 378 days. For buffer overflow vulnerabilities, the difficulty in vulnerability repair is mainly to select the appropriate location node for patch reinforcement to block the vulnerability exploitation process. Therefore, it is urgent to further study the operating principle of device firmware, starting from the vertical attack chain of buffer overflow vulnerabilities, analyze the attack path, and select the appropriate location to block external malicious input based on a full understanding of the execution path of buffer overflow vulnerabilities in firmware. Summary of the invention

[0005] Technical problem to be solved: In view of the incomplete coverage of vulnerability paths in the prior art, there is a great deal of randomness in the process of which node in the vulnerability path can be patched and reinforced to block the exploitation of the vulnerability. The present invention provides a method for locating firmware buffer overflow vulnerability patch reinforcement nodes, which is conducive to quickly and efficiently locating key nodes for patch reinforcement.

[0006] Technical solution: A method for locating a firmware buffer overflow vulnerability patch reinforced node, comprising the following steps:

[0007] Step 1, vulnerability exploitation path perception: parse the binary data of the firmware, restore the calling relationship between functions, perform hybrid symbolic execution on the buffer operations involved in the vulnerability, obtain fine-grained information about the firmware operation, and capture the vulnerability exploitation process;

[0008] Step 2: Buffer attribute weight allocation: The objectively weighted entropy weight method is used to integrate and sort various buffer operation data, and the details of the overflow vulnerability are improved from the perspective of multiple attribute aggregation;

[0009] Step 3, patch reinforcement node location: A multi-attribute decision-making model is established based on probabilistic hesitant fuzzy elements and prospect theory to locate the patch reinforcement node of the firmware buffer overflow vulnerability.

[0010] Preferably, step 1 comprises the following steps:

[0011] Step 1.1 Restore the calling relationship between functions;

[0012] Step 1.2 Hybrid symbolic execution: When the function name matches the hard-coded string in the firmware, external information is input into the function as the entry point of symbolic execution, and the vulnerability crash point is used as the end point of symbolic execution. Based on remote debugging, the binary instrumentation method is used to build a specific execution environment to obtain fine-grained information.

[0013] Step 1.3 performs constraint solving: while searching for paths, records the high-level constraints on each path during symbolic execution.

[0014] Preferably, the restoration of the calling relationship between functions in step 1.1 includes function name restoration, function address repair and symbol table restoration.

[0015] Preferably, the fine-grained information in step 1.2 includes the executed binary instruction stream, the specific value in the memory at a specified time, and the specific value in the register.

[0016] Preferably, step 2 comprises the following steps:

[0017] Step 2.1 Normalize the attribute set: Integrate various data of buffer operations, divide the data into corresponding primary and secondary attributes, uniformly scale the secondary attributes of buffer operations, and define the complexity factor of a single attribute as γ′ ij , indicating the impact of a single attribute on the overall complexity after quantification, and assigning the attribute with the greatest impact on the overall complexity a value of 0.9, marked as The attribute with the least impact is assigned a value of 0.1 and is marked as By analogy, each attribute is quantitatively assigned a fixed value; the hesitant fuzzy number h is used to indicate that a single attribute may be assigned multiple values ​​in a symbolic execution result. The normalized formula is:

[0018]

[0019] Among them, l is the number of times the attribute is assigned;

[0020] Step 2.2 Unify the evaluation criteria: Divide the normalized attributes into benefit type and cost type. For benefit type attributes, their attribute values ​​remain unchanged. For cost-type attributes, they are converted into benefit-type attributes. The conversion formula is:

[0021]

[0022] The hesitant fuzzy entropy is introduced to unify the evaluation criteria of various attributes, namely:

[0023]

[0024] Where m is the number of attributes, h σ(i) represents the i-th largest element in the image fuzzy number h, q>0, j=1,2,…,n, T=(1+q)ln(1+q)-(2+q)(ln(2+q)-ln2);

[0025] Step 2.3 Objective weighting of entropy value: Use entropy value to judge the amount of information contained in the attribute. The higher the entropy value, the less information there is, and the smaller the influence of the attribute on the whole. The weight of the jth attribute is w. j ,Right now:

[0026]

[0027] Preferably, step 3 comprises the following steps:

[0028] Step 3.1 Construct a decision matrix: select the input point of external information, the trigger point of the vulnerability, and the crash point of the vulnerability as the decision objects of the patch reinforcement node, take the multiple attributes of the evolution of the high-level constraint conditions triggered by the vulnerability as the existing decision considerations, and use the assignment result h of symbolic execution as the decision matrix. ijEstablish a decision matrix M, that is:

[0029]

[0030] Step 3.2 Normalized decision matrix: De-dimensionalize the decision matrix M, convert all attributes into benefit attributes, and multiply the objective weighted entropy value result with each benefit attribute to obtain the normalized decision matrix Right now:

[0031]

[0032] Step 3.3 Calculate the prospect matrix: Calculate the prospect matrix of each decision object under each attribute respectively. The calculation formula is:

[0033]

[0034] in, For hesitation blurs Euclidean distance, is the smallest value in the hesitant fuzzy number h, l represents the number of elements in the hesitant fuzzy number h, that is, the number of times each attribute is assigned. Indicates gain, Indicates a loss; α and β reflect the sensitivity of the decision-making process to gains and losses, α>0, β<1; θ indicates that the decision-making process is more sensitive to losses, θ>1;

[0035] Step 3.4 Calculate the gain-loss ratio: Calculate the gain-loss ratio C of each decision object i , select the decision object with the largest benefit-loss ratio as the patch reinforcement node, where the calculation formula of the benefit-loss ratio is:

[0036]

[0037] Beneficial effect: The method for locating firmware buffer overflow vulnerability patch reinforcement nodes provided by the present invention starts from the external information input point that is easy to trigger the buffer overflow vulnerability, adopts slicing technology to obtain the path from the data input source to the function crash point, and performs hybrid symbolic execution on the firmware, thereby reducing the occupancy of internal resources of the embedded system and reducing the possibility of path explosion problems in the symbolic execution process.

[0038] The method for locating firmware buffer overflow vulnerability patch reinforcement nodes provided by the present invention classifies and formally describes the process of utilizing the buffer overflow vulnerability, understands the dynamic propagation process of the buffer overflow vulnerability from the perspective of a reverse analyst, and improves the accuracy of vulnerability analysis.

[0039] The method for locating patch reinforcement nodes for firmware buffer overflow vulnerabilities provided by the present invention summarizes functions and variables involved in buffer operations, reconstructs the specifications of buffer operations using upper-level semantics to establish a multi-attribute decision model, extracts and deduces patch reinforcement rules, obtains the correlation between control flow defects and data flow directions, sorts suspected patch nodes of overflow vulnerabilities, and locates reinforcement nodes for patch repair. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is the algorithm flow chart of the present invention;

[0041] Figure 2 Schematic diagram for hybrid symbolic execution;

[0042] Figure 3 Schematic diagram of buffer overflow. DETAILED DESCRIPTION

[0043] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments.

[0044] Example 1

[0045] See also Figure 1 ,A method for locating nodes for firmware buffer overflow vulnerability patch reinforcement, the specific steps are as follows:

[0046] Step 1. Vulnerability exploit path perception: parse the binary data of the firmware, restore the calling relationship between functions, perform hybrid symbolic execution on the buffer operations involved in the vulnerability, obtain fine-grained information about the firmware operation, and capture the vulnerability exploitation process.

[0047] The step 1 mainly includes three steps, namely, recovery of the calling relationship between functions, hybrid symbolic execution, and execution constraint solving. The main purpose of step 1 is to extract and cluster the exploit features of buffer overflow vulnerabilities by combining dynamic and static analysis methods, and characterize the dynamic propagation process of vulnerability exploitation into different buffer operation attribute features, so as to facilitate the next step of buffer attribute weight allocation.

[0048] Step 1.1 First, use static analysis methods to restore the calling relationship between functions, including function name recovery, function address repair, symbol table recovery, etc.

[0049] Step 1.2 Once the function name matches the hard-coded string in the firmware, external information is input into the function as the entry point of symbolic execution, and the vulnerability crash point is used as the end point of symbolic execution. Based on remote debugging, the binary instrumentation method is used to build a specific execution environment to obtain fine-grained information, including the executed binary instruction stream, the specific values ​​in the memory and registers at the specified time, to guide symbolic execution, such as Figure 2 shown.

[0050] Step 1.3: While searching for paths, record the high-level constraints on each path during symbolic execution. These constraints indicate which functions and how the external input variables on the path are processed to trigger the vulnerability. By summarizing the functions, input parameters, and return values ​​involved in buffer operations in the constraints, we assign values ​​to Table 1.

[0051] Table 1 Buffer overflow properties

[0052]

[0053]

[0054]

[0055] Step 2. Buffer attribute weight allocation: The objectively weighted entropy weight method is used to integrate and sort various buffer operation data, and the details of the overflow vulnerability are improved from the perspective of multi-attribute aggregation.

[0056] Step 2 mainly includes three steps, namely, normalizing the attribute set, unifying the evaluation criteria, and objectively weighting the entropy value. The main purpose of step 2 is that because the symbolic execution results are different, the attribute weight plays an important role in the ranking of the solutions, and the data must be further processed with appropriate weights.

[0057] Step 2.1: To quantify qualitative attributes into quantitative attributes, a 0-1 scaling method is used to calculate the secondary attribute C of the buffer operation. ij Perform unified scaling and define the complexity factor of a single attribute as γ′ ij , which represents the impact of a single attribute on the overall complexity after quantization. Assume that there are m primary attributes, i is the index of the primary attribute, i∈[1,m], and there are n secondary attributes under the primary attribute i, j is the index of the secondary attribute, j∈[1,n], for example, C 11 It represents the first type of secondary attribute replication function under the primary attribute function C1. Among them, 9 scores are selected as the quantization range, and the attribute with the greatest impact on the overall complexity is assigned a value of 0.9, which is marked as The attribute with the least impact is assigned a value of 0.1, which is abbreviated as In the same way, each attribute is quantitatively assigned a fixed value. In order to facilitate the comparison and weighting of attributes of different units or magnitudes, normalization is used to de-dimensionalize each attribute to simplify the calculation process. The hesitant fuzzy number h is used to indicate that a single attribute may be assigned multiple times in a symbolic execution result. Where l represents the number of times each attribute is assigned. The normalization formula is:

[0058]

[0059] Step 2.2 divides the evaluation attributes into benefit type and cost type. In order to eliminate the influence of different attributes on the final decision result, for the benefit type attribute, its attribute value remains unchanged, For cost-type attributes, they are converted into benefit-type attributes. The conversion formula is:

[0060]

[0061] Fuzzy entropy can effectively measure the uncertainty of information. Hesitant fuzzy entropy is introduced to unify various evaluation attributes, namely:

[0062]

[0063] where h σ(i) It represents the i-th largest element in the image fuzzy number h, q>0, j=1,2,…,n, T=(1+q)ln(1+q)-(2+q)(ln(2+q)-ln2).

[0064] Step 2.3 uses the entropy value to determine the amount of information contained in the attribute. The higher the entropy value, the less information there is, and the smaller the influence of the attribute on the whole. Therefore, the weight of the jth attribute is w j ,Right now:

[0065]

[0066] Step 3. Patch reinforcement node location: A multi-attribute decision-making model is established based on probabilistic hesitant fuzzy elements and prospect theory to locate the repair node of the firmware buffer overflow vulnerability.

[0067] The step 3 mainly includes four steps, namely constructing a decision matrix, normalizing the decision matrix, calculating the prospect matrix, and calculating the profit-loss ratio. The main purpose of step 3 is to establish a multi-attribute decision model based on probabilistic hesitant fuzzy elements and prospect theory, extract and deduce patch reinforcement rules, obtain a comprehensive evaluation result of the decision object by calculating the profit-loss ratio of each scheme, and locate the location information of the implanted patch.

[0068] Step 3.1: For the specific details of the buffer overflow vulnerability, select the input point of external information, the trigger point of the vulnerability, and the crash point as the decision object of the patch reinforcement node, and use the multiple attributes C evolved from the high-level constraint conditions triggered by the vulnerability ij As an existing decision consideration, the assignment result h of symbolic execution ij Establish a decision matrix M, that is:

[0069]

[0070] Step 3.2 De-dimensionalize the decision matrix M to facilitate the comparison and weighting of attributes of different units or magnitudes. At the same time, convert all attributes into benefit attributes, and multiply the objective weighted entropy value result with each benefit attribute to obtain the normalized decision matrix Right now:

[0071]

[0072] Step 3.3 takes zero point as the decision reference point, the reference point is in a neutral state, the value is 0, and the gain or loss is greater than zero or less than zero. Taking full account of the characteristics of the value itself, the hesitant fuzzy Euclidean distance is used to measure the size of each decision object and the reference point, and the prospect matrix of each decision object under each attribute is calculated respectively. The calculation formula is:

[0073]

[0074] in, For hesitation blurs Euclidean distance, is the smallest value in the hesitant fuzzy number h, and l represents the number of elements in the hesitant fuzzy number h, that is, the number of times each attribute is assigned. Indicates gain, Indicates loss; α and β reflect the sensitivity of the decision-making process to gains and losses, α>0, β<1; θ indicates that the decision-making process is more sensitive to losses, θ>1.

[0075] Step 3.4 Calculate the gain-loss ratio C of each decision object i , select the decision object with the largest benefit-loss ratio as the patch reinforcement node. The calculation formula is:

[0076]

[0077] The technical solutions provided by the embodiments of the present invention are introduced in detail above. Specific embodiments are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the principles of the implementation of the present invention. At the same time, for those skilled in the art, the embodiments of the present invention may vary in specific implementation methods and application scope. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A method for locating nodes for firmware buffer overflow vulnerability patch reinforcement, characterized in that: The steps include: Step 1, vulnerability exploitation path perception: parse the binary data of the firmware, restore the calling relationship between functions, perform hybrid symbolic execution on the buffer operations involved in the vulnerability, obtain fine-grained information about the firmware operation, and capture the vulnerability exploitation process; Step 2: Buffer attribute weight allocation: The objectively weighted entropy weight method is used to integrate and sort various buffer operation data, and the details of the overflow vulnerability are improved from the perspective of multiple attribute aggregation; Step 2.1 Normalize the attribute set: Integrate various data of buffer operations, divide the data into corresponding primary and secondary attributes, uniformly scale the secondary attributes of buffer operations, and define the complexity factor of a single attribute as γ′ ij , indicating the impact of a single attribute on the overall complexity after quantification, and assigning the attribute with the greatest impact on the overall complexity a value of 0.9, marked as The attribute with the least impact is assigned a value of 0.1 and is marked as By analogy, each attribute is quantitatively assigned a fixed value; the hesitant fuzzy number h is used to indicate that a single attribute may be assigned multiple values ​​in a symbolic execution result. The normalized formula is: Among them, l is the number of times the attribute is assigned; Step 2.2 Unify the evaluation criteria: Divide the normalized attributes into benefit type and cost type. For benefit type attributes, their attribute values ​​remain unchanged. For cost-type attributes, they are converted into benefit-type attributes. The conversion formula is: The hesitant fuzzy entropy is introduced to unify the evaluation criteria of various attributes, namely: Where m is the number of attributes, h σ(i) represents the i-th largest element in the image fuzzy number h, q>0, j=1, 2, ..., n, T=(1+q)ln(1+q)-(2+q)(ln(2+q)-ln 2); Step 2.3 Objective weighting of entropy value: Use entropy value to judge the amount of information contained in the attribute. The higher the entropy value, the less information there is, and the smaller the influence of the attribute on the whole. The weight of the jth attribute is w. j ,Right now: Step 3: Patch reinforcement node location: A multi-attribute decision-making model is established based on probabilistic hesitant fuzzy elements and prospect theory to locate the patch reinforcement node of the firmware buffer overflow vulnerability; Step 3.1 Construct a decision matrix: select the input point of external information, the trigger point of the vulnerability, and the crash point of the vulnerability as the decision objects of the patch reinforcement node, take the multiple attributes of the evolution of the high-level constraint conditions triggered by the vulnerability as the existing decision considerations, and use the assignment result h of symbolic execution as the decision matrix. ij Establish a decision matrix M, that is: Step 3.2 Normalized decision matrix: De-dimensionalize the decision matrix M, convert all attributes into benefit attributes, and multiply the objective weighted entropy value result with each benefit attribute to obtain the normalized decision matrix Right now: Step 3.3 Calculate the prospect matrix: Calculate the prospect matrix of each decision object under each attribute respectively. The calculation formula is: in, For hesitation blurs Euclidean distance, is the smallest value in the hesitant fuzzy number h, l represents the number of elements in the hesitant fuzzy number h, that is, the number of times each attribute is assigned. Indicates gain, Indicates a loss; α and β reflect the sensitivity of the decision-making process to gains and losses, α>0, β<1; θ indicates that the decision-making process is more sensitive to losses, θ>1; Step 3.4 Calculate the gain-loss ratio: Calculate the gain-loss ratio C of each decision object i , select the decision object with the largest benefit-loss ratio as the patch reinforcement node, where the calculation formula of the benefit-loss ratio is:

2. According to claim 1, a method for locating nodes for firmware buffer overflow vulnerability patch reinforcement, characterized in that: The step 1 comprises the following steps: Step 1.1 Restore the calling relationship between functions; Step 1.2 Hybrid symbolic execution: When the function name matches the hard-coded string in the firmware, external information is input into the function as the entry point of symbolic execution, and the vulnerability crash point is used as the end point of symbolic execution. Based on remote debugging, the binary instrumentation method is used to build a specific execution environment to obtain fine-grained information. Step 1.3 performs constraint solving: while searching for paths, records the high-level constraints on each path during symbolic execution.

3. A method for locating nodes for firmware buffer overflow vulnerability patch reinforcement according to claim 2, characterized in that: The restoration of the calling relationship between functions in step 1.1 includes function name restoration, function address restoration and symbol table restoration.

4. According to claim 2, a method for locating a firmware buffer overflow vulnerability patch reinforcement node is characterized in that: The fine-grained information in step 1.2 includes the executed binary instruction stream, the specific value in the memory at a specified time, and the specific value in the register.

Images