An internet of things vulnerability security analysis method and system based on a knowledge graph

Abstract

The application provides a knowledge graph-based Internet of Things vulnerability security analysis method and system. The method analyzes large-scale Internet of Things firmware files in advance, stores feature information and existing vulnerabilities obtained by analysis into a graph database, and displays on an interface. When uploading new firmware, the information obtained by unpacking and analysis is stored into the graph database, and compared with the firmware information stored in the previous graph database. The firmware with the same information is associated and displayed on the interface. When querying the firmware, the input key is compared with the existing information in the graph database, the firmware with the same information is associated and displayed on the interface. The application solves the problems of large data volume, complex logical relationship and unsuitable capture of security association in the current Internet of Things firmware analysis, can improve the efficiency of Internet of Things firmware analysis personnel in studying Internet of Things firmware information and vulnerabilities, and further improves the level of Internet of Things firmware security analysis.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, and specifically to a knowledge graph-based IoT vulnerability security analysis method and system. Background Technology

[0002] With the continuous advancement of IoT technology, IoT devices are ubiquitous in our daily lives. Examples include printers, mobile phones, home routers, computer components and peripherals, and so on. They also exist in many less consumer-facing devices, such as video surveillance systems, medical implants, automotive components, SCADA and PLC equipment, and basically any device commonly referred to as an electronic product. The emerging phenomenon of IoT in recent years will make them even more widespread and interconnected.

[0003] Today, the term "IoT firmware" is more broadly used to describe software embedded in hardware devices. Like traditional software, embedded device firmware can contain bugs or misconfigurations, potentially leading to vulnerabilities in devices running that specific code. For example, a public security camera could be maliciously compromised; a home Wi-Fi router might be found to have a backdoor. Currently, while IoT security researchers have made significant progress in analyzing individual firmware samples or large-scale batches of firmware, the same vulnerabilities can persist across different devices. These devices remain vulnerable and easily exploited by malicious actors until other researchers independently rediscover these flaws. This often occurs when multiple integration vendors rely on the same subcontractors, tools, or SDKs provided by development vendors. Furthermore, devices may have different names but actually run the same or similar firmware, often resulting in devices being affected by the exact same vulnerabilities.

[0004] If we analyze the firmware and internal relationships of IoT devices in advance and then display them in the form of a knowledge graph, and perform correlation analysis on IoT vulnerabilities, we can identify these similarities. If there is an updated firmware, we can unpack and analyze it, and compare the obtained feature information with the previous firmware information to link them together, predict potential vulnerabilities in advance, and improve the efficiency of IoT firmware security analysis. Summary of the Invention

[0005] To address the challenges of large data volumes, complex logical relationships, and difficulty in capturing vulnerability correlations in IoT firmware analysis, this invention proposes an IoT vulnerability security analysis method and system based on knowledge graphs.

[0006] The technical solution adopted in this invention is as follows:

[0007] A knowledge graph-based method for IoT vulnerability security analysis includes the following steps:

[0008] Collect firmware for the Internet of Things on a large scale, unpack and analyze the firmware, and store the analyzed firmware information in a graph database to form a large-scale firmware repository.

[0009] The associated firmware is obtained from the firmware information in the graph database and displayed in a graphical form. A knowledge graph is formed based on the data and associations in the graph database.

[0010] The firmware information of the firmware under test is stored in the graph database through unpacking analysis. Based on the firmware information of the firmware under test, the firmware under test is associated with the original firmware in the graph database and displayed in a graphical form.

[0011] Based on the association display results between the firmware under test and the existing firmware in the graph database, IoT vulnerability security analysis is performed on the firmware under test.

[0012] Furthermore, the above method also has a query function: input a query statement, perform a query in the graph database based on the keywords in the query statement, and display the related firmware with keyword information in graphical form.

[0013] Furthermore, the above method also has an upload function: upload the firmware to be tested, and store the firmware information (various feature information and vulnerability information obtained from the vulnerability database) of the firmware to be tested into the graph database through unpacking and analysis.

[0014] Furthermore, after the graph database updates the information, the new firmware information is linked with the previous firmware information and displayed in a graphical form.

[0015] Furthermore, the above method also has the function of batch uploading firmware, that is, performing the above steps of uploading firmware and unpacking and analyzing each firmware under test in a loop, and after updating the information in the graph database, linking the new firmware information with the previous firmware information and displaying it in a graphical form.

[0016] Furthermore, the unpacking and analysis of the firmware includes:

[0017] Use an unpacking tool to unpack the firmware;

[0018] Firmware analysis tools are used to analyze the unpacked firmware. The information obtained includes the tagged firmware ID, project version, vendor, firmware type, release time, file list, signature regular expression, built-in software, architecture, file system, operating system, and existing vulnerability CVE (Common Vulnerabilities and Exposures) numbers, which are stored in a graph database.

[0019] Furthermore, the step of obtaining the associated firmware based on the firmware information in the graph database and displaying it graphically includes:

[0020] Compare the firmware information in the graph database;

[0021] Based on the information comparison results, the information in the graph database is correlated to obtain the firmware information correlation table;

[0022] A graph database is used to display the firmware information associated with each other in a graphical form.

[0023] Furthermore, the query function includes:

[0024] Enter query statements into the system, including but not limited to firmware name, manufacturer, vulnerability, etc.

[0025] Based on the keywords in the query statement, the relevant firmware information is retrieved from the graph database, and the relevant firmware information is displayed in a graphical form.

[0026] Furthermore, the upload function includes:

[0027] Upload the firmware to be tested to the graph database;

[0028] Use an unpacking tool to unpack the firmware under test;

[0029] The unpacked firmware is analyzed using firmware analysis tools, and the obtained information (various feature information of the firmware under test and vulnerability information obtained from the vulnerability database) is stored in the graph database.

[0030] Furthermore, after updating the information in the graph database, linking the new firmware information with the previous firmware information and displaying it graphically includes:

[0031] After the graph database information is updated, the information in the graph database is re-associated to obtain the firmware information association table;

[0032] Update the displayed results.

[0033] A knowledge graph-based IoT vulnerability security analysis system, comprising:

[0034] The unpacking and analysis module is used for unpacking and analyzing the firmware.

[0035] The graph database module is used to store the firmware information obtained by the unpacking and analysis module into the graph database;

[0036] The information comparison module is used to compare information based on firmware information in the graph database, obtain related firmware, and store it in the firmware information association table.

[0037] The firmware display module is used to construct a knowledge graph related to firmware based on the firmware information association table obtained by the information comparison module.

[0038] The vulnerability security analysis module is used to perform IoT vulnerability security analysis on the firmware under test based on the knowledge graph constructed by the associated firmware display module.

[0039] This invention addresses the challenges of large data volumes, complex logical relationships, and difficulty in capturing security correlations in IoT firmware analysis. By utilizing popular graph databases, it links large-scale firmware information and displays it graphically on the system interface. This facilitates firmware security researchers in querying related firmware with keywords and linking uploaded firmware to previously analyzed firmware, allowing them to understand the internal connections within the firmware in advance and improving the efficiency of firmware security research. Attached Figure Description

[0040] Figure 1 This is a schematic diagram of the overall module structure of this system.

[0041] Figure 2 Flowchart for unpacking, analyzing, and storing data in a graph database.

[0042] Figure 3 This is a flowchart for the information comparison module.

[0043] Figure 4 The flowchart shows the interconnected firmware module.

[0044] Figure 5 Provides a display style diagram for the knowledge graph. Detailed Implementation

[0045] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be noted that the embodiments described below are intended to facilitate the understanding of the present invention and do not limit it in any way.

[0046] The present invention provides a knowledge graph-based IoT vulnerability security analysis method, which mainly includes the following steps and functions:

[0047] (1) Collect firmware of IoT on a large scale, unpack and analyze the firmware, store the information obtained from the analysis into a graph database to form a large-scale firmware repository, and display its related firmware. Based on the data and associations in the graph database, a knowledge graph is formed.

[0048] (2) Query function: Input a query statement, and the database will be searched based on the keywords in the query statement. The firmware with the keyword information will be displayed in a graphical form.

[0049] (3) Upload function: Upload the firmware to be tested, and store the various feature information of the firmware to be tested and the vulnerability information obtained from the vulnerability database into the graph database through unpacking analysis;

[0050] (4) After updating the information in the graph database, the new firmware information is linked with the previous firmware information and displayed in a graphical form.

[0051] (5) Batch upload firmware, and repeat steps (3)-(4) for each firmware to be tested.

[0052] (6) Based on the association display results between the firmware under test and the original firmware in the graph database, perform IoT vulnerability security analysis on the firmware under test.

[0053] Further, step (1) includes:

[0054] (1-1) Use an unpacking tool to unpack the firmware;

[0055] (1-2) Use firmware analysis tools to analyze the unpacked firmware. The information obtained includes the tagged firmware ID, project version, manufacturer, firmware type, release time, file list, feature regular expression, built-in software, architecture, file system, operating system, and existing vulnerability CVE (Common Vulnerabilities and Exposures) numbers, which are stored in the graph database.

[0056] (1-3) Link the information in the graph database to obtain the firmware information association table;

[0057] (1-4) Use graph databases to display the associated firmware in graphical form.

[0058] Furthermore, step (2) includes:

[0059] (2-1) Input query statements into the system, including but not limited to firmware name, manufacturer, vulnerability, etc.;

[0060] (2-2) Based on the keywords in the query statement, retrieve the relevant firmware information from the graph database, and display the relevant firmware information in a graphical form.

[0061] Furthermore, step (3) includes:

[0062] (3-1) Upload the firmware to be tested to the system;

[0063] (3-2) is the same as (1-1), using an unpacking tool to unpack the firmware to be tested;

[0064] (3-3) is the same as (1-2). The unpacked firmware is analyzed using a firmware analysis tool, and the obtained information (various feature information of the firmware under test and vulnerability information obtained from the vulnerability database) is stored in the graph database.

[0065] Further, step (4) includes:

[0066] (4-1) After the graph database information is updated, the information in the graph database is re-associated to obtain the firmware information association table;

[0067] (4-2) Update the display results.

[0068] like Figure 1 As shown, the present invention discloses an IoT vulnerability security analysis system based on a knowledge graph, comprising: a query module, an upload module, an unpacking analysis module, a graph database storage module, an information comparison module, and a connected firmware display module. Each module will be described in detail below.

[0069] The process of unpacking and analyzing data and storing it in the graph database by the unpacking and analysis module is as follows: Figure 2 As shown. For the firmware to be analyzed, this invention first uses firmware unpacking and analysis technology to complete preprocessing work such as firmware file system extraction and firmware architecture identification. The process is as follows:

[0070] (1) Label the firmware with an ID;

[0071] (2) Use unpacking tools such as Binwalk to unpack the firmware image to obtain the program in each firmware;

[0072] (3) Obtain specific firmware information such as project version, manufacturer, firmware type, release time, file list, feature regular expression (feature code of the initial address of the file system in the firmware), built-in software, architecture, file system, operating system and existing vulnerability CVE (Common Vulnerabilities and Exposures) number through firmware analysis program.

[0073] (4) Store firmware information with firmware ID as the first column and other information listed in step (3) as other columns. Store them together in the firmware information CSV (Comma-Separated Values) table and store them in the cloud map database.

[0074] The processing flow of the information comparison module is as follows: Figure 3 As shown, the main steps include:

[0075] (1) Compare the keywords of firmware information in each aspect (project version, manufacturer, firmware type, release time, file list, feature regular expression, built-in software, architecture, file system, operating system and existing vulnerability CVE (Common Vulnerabilities and Exposures) number). That is, compare the above information included in each uploaded firmware to see if they are the same (for example, both file systems are Yaffs2). If there is the same information, record the IDs of the two (i.e., they are related firmware) to prepare for building the firmware information association table later.

[0076] (2) The types include firmware type (e.g., router, camera, smart product, switch, medical device, toy, etc.), manufacturer, release time, file list, and feature regular expression;

[0077] (3) Built-in software is the software that comes pre-installed with the firmware at the factory.

[0078] (4) Architectures include MIPS, ARM, etc.;

[0079] (5) Operating systems include Linux, Unix, VxWorks, NucleusRTOS, and Windows CE, etc.

[0080] (6) File systems include Squashfs, Cramfs, Yaffs2, etc.;

[0081] (7) Store the associated firmware information separately in the firmware information association table. The firmware information association table uses the firmware ID as the first column, the associated firmware ID (the ID obtained in step (1)) as the second column, and the firmware type, built-in software, architecture, operating system, file system and other information as the remaining columns.

[0082] Connected firmware display module, such as Figure 4 As shown, the main steps include:

[0083] (1) Based on the firmware information association table obtained by the information comparison module, construct the associated firmware image using Neo4J graph database exclusive statements;

[0084] (2) Based on the firmware information association table, display the associated firmware images on the system interface to form a knowledge graph.

[0085] Knowledge graph display style as follows Figure 5 As shown, where:

[0086] (1) Extract the firmware IDs stored in the firmware information association table in sequence and match them with the information in the firmware information association table, and display the firmware name node on the interface.

[0087] (2) Clicking the firmware name node will display the information of a single firmware in the form of a relationship diagram;

[0088] (3) Obtain the firmware ID of the firmware name node clicked in step (2), navigate to the row of its ID storage information in the firmware information association table, and obtain the associated firmware ID in the second column; navigate to the row of the associated firmware ID storage information, compare the information stored in the other columns of the two, and obtain the same information (i.e., related information), and create a bidirectional arrow pointing to the firmware name node corresponding to the associated firmware ID in the expanded firmware information.

[0089] (4) Click the generated associated firmware node and repeat steps (2)-(3).

[0090] Furthermore, this system also includes a vulnerability security analysis module, which is used to perform IoT vulnerability security analysis on the firmware under test based on the knowledge graph constructed by the associated firmware display module.

[0091] At the outset, this system will first upload a firmware library prepared by developers (all available firmware on the market), constructing a preliminary knowledge graph framework. IoT vulnerability security analysts can use this system to learn a general framework of vulnerabilities. For example, based on a CVE (Common Vulnerabilities and Exposures), they can determine which firmware or file systems it is prevalent in; they can also search for the name of the firmware to be tested and obtain specific information such as project version, manufacturer, firmware type, release date, file list, signature regular expressions, built-in software, architecture, file system, operating system, and existing CVEs (Common Vulnerabilities and Exposures) and related firmware, identifying similarities. If newer firmware is released, the system can identify vulnerabilities in advance.

[0092] Another embodiment of the present invention provides an electronic device (computer, server, smartphone, etc.) including a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the steps of the method of the present invention.

[0093] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, optical disk) storing a computer program that, when executed by a computer, implements the various steps of the method of the present invention.

[0094] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and to implement it accordingly. Those skilled in the art will understand that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the content disclosed in the embodiments of this specification; the scope of protection of the present invention is defined by the claims.

Claims

1. A knowledge graph-based IoT vulnerability security analysis method, characterized in that, Includes the following steps: Collect firmware for IoT on a large scale, unpack and analyze the firmware, and store the analyzed firmware information into a graph database. The associated firmware is obtained from the firmware information in the graph database and displayed in a graphical form. A knowledge graph is formed based on the data and associations in the graph database. The firmware information of the firmware under test is stored in the graph database through unpacking analysis. Based on the firmware information of the firmware under test, the firmware under test is associated with the original firmware in the graph database and displayed in a graphical form. Based on the association display results between the firmware under test and the existing firmware in the graph database, IoT vulnerability security analysis is performed on the firmware under test. The process of obtaining associated firmware based on firmware information in the graph database and displaying it graphically, and forming a knowledge graph based on the data and associations in the graph database, includes: Compare the firmware information in the graph database; Based on the information comparison results, the information in the graph database is correlated to obtain the firmware information association table; A graph database is used to display the firmware associated with each other in a graphical form. The keywords of the firmware information are compared in each aspect. If there is the same information, they are associated firmware and the ID of the associated firmware is recorded. The firmware information of the associated firmware is stored in the firmware information association table, with the firmware ID as the first column and the associated firmware ID as the second column. Retrieve the firmware IDs stored in the firmware information association table sequentially and match them with the information in the firmware information association table to display the firmware name node on the interface; click on the firmware name node to display a single firmware information in the form of a relationship diagram; obtain the firmware ID based on the clicked firmware name node, navigate to the row where the ID information is stored in the firmware information association table, and obtain the associated firmware ID in the second column; navigate to the row where the associated firmware ID information is stored, compare the information stored in other columns to obtain the associated information, and create a bidirectional arrow pointing to the firmware name node corresponding to the associated firmware ID based on the associated information.

2. The method according to claim 1, characterized in that, The unpacking and analysis of the firmware includes: Use an unpacking tool to unpack the firmware; The unpacked firmware is analyzed using firmware analysis tools. The information obtained includes the tagged firmware ID, project version, manufacturer, firmware type, release time, file list, feature regular expressions, built-in software, architecture, file system, operating system, and CVE numbers of existing vulnerabilities, which are stored in a graph database.

3. The method according to claim 1, characterized in that, The process involves performing IoT vulnerability security analysis on the firmware under test based on the association display results between the firmware under test and the existing firmware in the graph database, including: Based on the association display results between the firmware under test and the existing firmware in the graph database, the internal connections of the firmware and the potential vulnerabilities of the firmware under test can be obtained.

4. The method according to claim 1, characterized in that, The method also has a query function: input a query statement, perform a query in the graph database based on the keywords in the query statement, and display the related firmware with keyword information in graphical form.

5. A knowledge graph-based Internet of Things (IoT) vulnerability security analysis system employing the method described in any one of claims 1 to 4, characterized in that, include: The unpacking and analysis module is used for unpacking and analyzing the firmware. The graph database module is used to store the firmware information obtained by the unpacking and analysis module into the graph database; The information comparison module is used to compare information based on firmware information in the graph database, obtain related firmware, and store it in the firmware information association table. The firmware display module is used to construct a knowledge graph related to firmware based on the firmware information association table obtained by the information comparison module. The vulnerability security analysis module is used to perform IoT vulnerability security analysis on the firmware under test based on the knowledge graph constructed by the associated firmware display module.

6. An electronic device, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a computer, implements the method according to any one of claims 1 to 4.

Images