Method and system for detecting internet of things device credential trigger type backdoor

Abstract

The application provides a kind of detection method and system of Internet of Things equipment credential trigger type backdoor, comprising: the binary code library is formed by decompressing device firmware;Executable file in code library is analyzed reversely, and backdoor verification key code is positioned using string comparison function and backdoor model feature;The code segment related to backdoor verification key code is stripped from original program, and complete credential generation process code is obtained;Each credential generation process code is subjected to data abstraction and process modeling processing, forming formal description of verification credential, and the semantics and uncertainty of each input variable in formal description are calculated;According to the semantics and uncertainty of each input variable, it is judged whether the verification credential is predictable, and whether the device has a backdoor that can be triggered by predictable credential.The application can automatically detect whether there is a backdoor triggered by credential in the device through static analysis of binary program in Internet of Things firmware.

Description

Technical Field

[0001] The present invention relates to the technical field of security analysis of Internet of Things devices, and in particular to a method and system for detecting credential-triggered backdoors in Internet of Things devices. Background Art

[0002] With the continuous development of the Internet of Things (IoT), a wide variety of IoT devices have emerged. However, some device manufacturers, either intentionally or unintentionally, fail to remove covert testing channels after product release, leaving backdoors in their products. Alternatively, they configure device control methods based on proprietary protocols for post-release maintenance. Security researchers generally believe that these hidden control methods, regardless of their purpose, are likely to be discovered and exploited by attackers, compromising the security of IoT devices.

[0003] To conceal backdoors and pre-defined control channels, designers often configure special triggering methods. A common triggering method is credential authentication, where the device accepts a user-entered password and compares it with a pre-coded password. A match triggers the backdoor or control command. Existing technologies are capable of detecting backdoors triggered by hard-coded credentials, but current research has found that some backdoors use the hash value of a hard-coded string as a triggering credential, or calculate the triggering credential by combining device and operating environment information. Currently, there is no reasonable solution for detecting backdoors triggered by complexly encoded credentials.

[0004] Therefore, the market is in urgent need of a method and system for detecting credential-triggered backdoors in IoT devices that can identify backdoors that are triggered by credentials and implanted in a complex, non-hardcoded manner. Summary of the Invention

[0005] In view of the defects in the prior art, the purpose of the present invention is to provide a method and system for detecting credential-triggered backdoors in IoT devices.

[0006] According to the present invention, a method for detecting a credential-triggered backdoor in an IoT device includes:

[0007] Step S1: decompress the device firmware to form a binary code library;

[0008] Step S2: reverse-analyze the executable files in the code base, and locate the backdoor verification key code using string comparison functions and backdoor model features;

[0009] Step S3: extracting the code segments related to the backdoor verification key code from the original program to obtain the complete credential generation process code;

[0010] Step S4: performing data abstraction and process modeling on each of the credential generation process codes to form a formal description of the verification credential, and calculating the semantics and uncertainty of each input variable in the formal description;

[0011] Step S5: Based on the semantics and uncertainty of each input variable, determine whether the uncertainty of all inputs generating the verification credential is less than their respective maximum uncertainty. If so, the verification credential is predictable, and the device has a backdoor that can be triggered by the predictable credential; if not, the verification credential is unpredictable, and the corresponding device does not have a backdoor that can be triggered by the predictable credential.

[0012] Preferably, step S2 includes:

[0013] Step S2.1: Perform reverse engineering on the executable files in the code base to detect whether there are string comparison functions and cross-references to string comparison functions in the files. If so, trigger step S2.2; if not, re-trigger step S2 to detect the next code base file;

[0014] Step S2.2: querying the address of the cross-reference string comparison function, finding the function that calls the string comparison function according to the address, and generating a function control flow graph of the calling function;

[0015] Step S2.3: Query the basic block that calls the string comparison function in the function control flow chart, perform backdoor feature scanning on the subsequent blocks of the basic block, and determine whether the subsequent blocks contain backdoor features. If so, mark the code contained in the basic block that calls the string comparison function as credential verification key code; if not, trigger module M2.2 to query the address of the next cross-reference string comparison function.

[0016] Preferably, the stripping processing method includes stain analysis and program slicing technology;

[0017] The program slicing technology includes selecting at least one variable as the source of slicing, and then extracting all instructions related to the source variable in the entire program based on the definition and usage relationship between the program variable and the statement;

[0018] The usage relationship includes: variable initialization, variable assignment and calculation.

[0019] Preferably, the data abstraction and process modeling processing includes: abstracting the variables involved in the verification code generation process, identifying the type and length of the variables, and abstracting the functions that operate on the variables in the verification code generation process, identifying the type and length of the input and output parameters of the functions;

[0020] The formal description of the verification credential is formed based on the call flow diagram and data flow diagram of the generated code process fragment.

[0021] Preferably, the semantics refers to the meaning inherent in the input itself, including device information, configuration, and user information stored by the device;

[0022] The calculation formula of the uncertainty is as follows:

[0023] H(X k )=-∑p ki log p ki i=1,2,3,…,n

[0024] H(X)=∑H(X k )k=1,2,3,…,m

[0025] Where H(X) represents the uncertainty of the verification credential X, H(X k ) represents a single input variable X in the formal description of the verification credential k The uncertainty of p ki Represents a single input variable X k Some input value X ki The corresponding probability, n represents a single input variable X k The number of all possible input values, m represents the number of single input variables in the formal description of the verification credential.

[0026] According to the present invention, a system for detecting credential-triggered backdoors in IoT devices includes:

[0027] Module M1: decompresses the device firmware to form a binary code library;

[0028] Module M2: reverse-engineering the executable files in the code base, using string comparison functions and backdoor model features to locate the backdoor verification key code;

[0029] Module M3: Extract the code segments related to the backdoor verification key code from the original program to obtain the complete credential generation process code;

[0030] Module M4: Performing data abstraction and process modeling on each of the credential generation process codes to form a formal description of the verification credential, and calculating the semantics and uncertainty of each input variable in the formal description;

[0031] Module M5: Based on the semantics and uncertainty of the various input variables, determine whether the uncertainty of all inputs used to generate the verification credentials is less than their respective maximum uncertainties. If so, the verification credentials are predictable, and the device has a backdoor that can be triggered by predictable credentials; if not, the verification credentials are unpredictable, and the corresponding device does not have a backdoor that can be triggered by predictable credentials.

[0032] Preferably, the module M2 includes:

[0033] Module M2.1: Performs reverse engineering on the executable files in the code base to detect whether there are string comparison functions and cross-references to string comparison functions in the files. If so, module M2.2 is triggered. If not, module M2 is retriggered to detect the next code base file.

[0034] Module M2.2: querying the address of the cross-reference string comparison function, finding the function that calls the string comparison function according to the address, and generating a function control flow graph of the calling function;

[0035] Module M2.3: Query the basic block that calls the string comparison function in the function control flow graph, perform backdoor feature scanning on the subsequent blocks of the basic block, and determine whether the subsequent blocks contain backdoor features. If so, mark the code contained in the basic block that calls the string comparison function as credential verification key code; if not, trigger module M2.2 to query the address of the next cross-reference string comparison function.

[0036] Preferably, the stripping processing method includes stain analysis and program slicing technology;

[0037] The program slicing technology includes selecting at least one variable as the source of slicing, and then extracting all instructions related to the source variable in the entire program based on the definition and usage relationship between the program variable and the statement;

[0038] The usage relationship includes: variable initialization, variable assignment and calculation.

[0039] Preferably, the data abstraction and process modeling processing includes: abstracting the variables involved in the verification code generation process, identifying the type and length of the variables, and abstracting the functions that operate on the variables in the verification code generation process, identifying the type and length of the input and output parameters of the functions;

[0040] The formal description of the verification credential is formed based on the call flow diagram and data flow diagram of the generated code process fragment.

[0041] Preferably, the semantics refers to the meaning inherent in the input itself, including device information, configuration, and user information stored by the device;

[0042] The calculation formula of the uncertainty is as follows:

[0043] H(X k )=-∑p ki log p ki i=1,2,3,…,n

[0044] H(X0=∑H(X k ) k=1,2,3,…,m

[0045] Where H(X) represents the uncertainty of the verification credential X, H(X k ) represents a single input variable X in the formal description of the verification credential k The uncertainty of p ki Represents a single input variable X k Some input value X ki The corresponding probability, n represents a single input variable X k The number of all possible input values, m represents the number of single input variables in the formal description of the verification credential.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] 1. The present invention can automatically detect whether there are more complex backdoors in the device that are not hard-coded and are triggered by credentials through static analysis of binary programs in IoT firmware.

[0048] 2. The present invention can quickly detect a large amount of firmware through efficient static program analysis technology, thereby improving detection efficiency.

[0049] 3. The present invention tracks the data in the code slice through context-sensitive function parameter recognition technology, so as to determine the type and length of the variables in the code slice, provide a basis for calculating the uncertainty of the variables, and improve the accuracy of vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Other features, objects and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments with reference to the following drawings:

[0051] Figure 1 Schematic diagram of the overall process of the method of the present invention.

[0052] Figure 2 This is a flowchart of the firmware unpacking and binary code library screening process in the present invention.

[0053] Figure 3 This is a flow chart of the present invention for identifying and slicing characteristic code segments.

[0054] Figure 4 This is a flow chart of the present invention performing data flow graph analysis on credential generation code snippets. DETAILED DESCRIPTION

[0055] The present invention will be described in detail below with reference to specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those skilled in the art, several changes and improvements can be made without departing from the scope of the present invention. These all fall within the scope of protection of the present invention.

[0056] Example 1

[0057] According to the present invention, a method for detecting a credential-triggered backdoor in an IoT device is provided. Figure 1 Shown, including:

[0058] Step S1: Decompress the device firmware to form a binary code library. Specifically, Figure 2 shown.

[0059] First, the firmware unpacking framework is used to unpack the firmware of the device under test, obtaining the firmware file system contents. Unpacking methods include using Binwalk. Common IoT device firmware is typically compressed and packaged using a compression algorithm and data encapsulation format. The tool includes multiple built-in signatures to identify the compression algorithm and automatically unpack the firmware. For unknown data encapsulation formats, pattern matching is used to locate and segment files.

[0060] Then, after extracting the firmware content, the executable files are identified one by one, and the executable binary files are screened out to form a binary code library.

[0061] Step S2: Reverse-engineer the executable files in the code library and locate the key backdoor verification code using string comparison functions and backdoor model features. Specifically, backdoor features include, but are not limited to, data references to privileged operation-related feature strings in basic blocks and code references to privileged operation-related functions in basic blocks. Privileged operations include, but are not limited to, executing high-privilege commands, controlling devices, or modifying device settings. Step S2 includes:

[0062] Step S2.1: Perform reverse analysis on the executable file in the code library to detect whether there is a string comparison function and a cross-reference to the string comparison function in the file. If so, trigger step S2.2; if not, re-trigger step S2 to detect the next code library file.

[0063] Step S2.2: query the address of the cross-reference string comparison function, find the function that calls the string comparison function according to the address, and generate a function control flow chart of the calling function.

[0064] Step S2.3: Query the basic block that calls the string comparison function in the function control flow chart, perform backdoor feature scanning on the subsequent blocks of the basic block, and determine whether the subsequent blocks contain backdoor features. If so, mark the code contained in the basic block that calls the string comparison function as credential verification key code; if not, trigger module M2.2 to query the address of the next cross-reference string comparison function.

[0065] Specifically, if Figure 3 As shown, the executable file is first statically scanned for common string comparison functions, such as strcmp(), strncmp(), and memcmp(). For dynamically linked executables, this step can be performed by searching the GOT (global symbol table). For statically linked executables, candidate string comparison functions are identified based on characteristics such as the number of basic blocks, loops, and memory comparison instructions within each function. The starting addresses of these functions are then used as target addresses to find the source addresses of all cross-references, thereby locating a string comparison step.

[0066] Then, with the located comparison step as the target, find the function to which it belongs, and use program analysis technology to generate the intra-function control flow graph and inter-function control flow graph of the function respectively. Binary static analysis tools such as Ghidra or Angr can be used for this step. For the intra-function control flow graph, analyze all subsequent blocks of the basic block where the located string comparison step is located, and check whether there are control operation features that meet the conditions, such as the execution of the system() system call. For the inter-function control flow graph, analyze all subsequent blocks of the basic block where the function to which the comparison step belongs is located, and check whether there are control operation features that meet the conditions. In this way, a key step for verifying the control operation is located.

[0067] Step S3: Extract the code segments related to the backdoor verification key code from the original program to obtain the complete credential generation process code. Stripping refers to the process of separating the target code from the entire program code. Stripping methods include taint analysis and program slicing technology. The program slicing technology involves selecting at least one variable as the source of the slice, and then extracting all instructions related to the source variable in the entire program based on the definition and usage relationship between the program variables and statements. The usage relationship includes variable initialization, variable assignment, and calculation.

[0068] Specifically, if Figure 3 As shown, with the relevant code of the call string comparison function located in step S2 as the target, the program variables corresponding to the generated credentials are found. Using program slicing technology, mature binary static analysis tools such as Ghidra or Angr can be used to perform this step. Its purpose is to strip out all the codes related to generating verification credentials and form a complete credential generation code snippet.

[0069] Step S4: Perform data abstraction and process modeling on each credential generation process code to form a formal description of the verification credential. The semantics and uncertainty of each input variable in the formal description are calculated. Semantics refers to the meaning inherent in the input, including device information, configuration, and user information stored by the device. The uncertainty calculation formula is as follows:

[0070] H(X k )=-∑p hi logp ki =1,2,3,…,n

[0071] H(X)=H(X k )=1,2,3,…,m

[0072] Where H(X) represents the uncertainty of the verification credential X, H(X k ) represents a single input variable X in the formal description of the verification credential k The uncertainty of p ki Represents a single input variable X k Some input value X ki The corresponding probability, n represents a single input variable X k The number of all possible input values, m represents the number of single input variables in the formal description of the verification credential.

[0073] Formal description refers to the use of rigorous mathematical models and methods to accurately, abstractly, and formally describe things. Specifically, formal description defines a credential as the output obtained by applying a finite number of injective functions to a number of variables as input.

[0074] Data abstraction and process modeling involve abstracting the variables involved in the verification code generation process, identifying their types and lengths. Functions that operate on these variables are also abstracted, identifying the types and lengths of their input and output parameters. A formal description of the verification credentials is generated based on the call flow diagram and data flow diagram of the generated code process fragment.

[0075] Specifically, if Figure 4As shown, first, program analysis techniques are used to perform parameter tracking on the functions called in the credential generation code snippet to identify the parameter data types and lengths. This step requires function matching of the functions called in the credential generation code snippet: if the function is identified as a standard cryptographic API function, the function's input and output parameter information is generated based on the existing function summary. If the function cannot be identified, the function's input and output parameter information is inferred based on the call status in the verification code snippet.

[0076] Next, program analysis technology is used to obtain the control flow graph and data flow graph of the credential generation code process fragment. Then, taint tracking technology is used, with the variables representing the credentials as the convergence point and device information and operating environment information acquisition functions such as nvram_get(), fgets(), fread() and other functions as taint sources, to find all input variables related to credential generation and obtain the function expression of verifying the credentials with respect to several input variables.

[0077] Finally, the semantics and length of the input variables are identified by obtaining the function call parameters based on the device information and operating environment information. The semantics of the input variables can be marked by obtaining the characteristic character strings in the function call parameters. Then, according to the semantics of the input variables, they are divided into three categories: completely random, predictable, and completely deterministic. The maximum uncertainty of the input variable is calculated based on the length. If the length of the input variable is n bits, the maximum uncertainty is n bits according to the formula. Then, according to the classification of the input variable, its actual uncertainty is calculated. For example, the uncertainty of a completely deterministic input variable is 0; for a predictable input variable, if p types of symbols may appear, assuming that the probability of each symbol appearing is the same, its uncertainty is calculated as logp bits according to the formula; for a completely random input variable, its uncertainty is the maximum uncertainty about the length.

[0078] Step S5: Based on the semantics and uncertainty of each input variable, determine whether the uncertainty of all inputs generating the verification credential is less than their respective maximum uncertainty. If so, the verification credential is predictable, and the device has a backdoor that can be triggered by the predictable credential; if not, the verification credential is unpredictable, and the corresponding device does not have a backdoor that can be triggered by the predictable credential.

[0079] Specifically, if Figure 4 As shown, the uncertainty of all input variables is judged. If the uncertainty of some inputs among all the inputs generating the verification credentials is less than their respective maximum uncertainty, or the types of some inputs among all the inputs are predictable or completely determined, then it can be determined that the verification credentials are predictable and the device has a backdoor that can be triggered by the predictable credentials.

[0080] Example 2

[0081] The present invention also provides a detection system for credential-triggered backdoors of Internet of Things devices. Those skilled in the art can implement the detection system for credential-triggered backdoors of Internet of Things devices by executing the step flow of the detection method for credential-triggered backdoors of Internet of Things devices. That is, the detection method for credential-triggered backdoors of Internet of Things devices can be understood as a preferred implementation of the detection system for credential-triggered backdoors of Internet of Things devices.

[0082] According to the present invention, a system for detecting credential-triggered backdoors in IoT devices includes:

[0083] Module M1: Decompresses the device firmware to form a binary code library.

[0084] Module M2: reverse analyzes the executable files in the code library and locates the backdoor verification key code using string comparison functions and backdoor model features.

[0085] Specifically, first, reverse analysis is performed on the executable file in the code library to detect whether there is a string comparison function and a cross-reference to the string comparison function in the file. If so, the address of the cross-referenced string comparison function is queried, and the function that calls the string comparison function is found according to the address, and a function control flow chart of the calling function is generated; if not, the module M2 is re-triggered to detect the next code library file.

[0086] Then, the basic block that calls the string comparison function is queried in the function control flow chart, and the subsequent blocks of the basic block are scanned for backdoor features to determine whether the subsequent blocks contain backdoor features. If so, the code contained in the basic block that calls the string comparison function is marked as the credential verification key code; if not, the module M2.2 is triggered to query the address of the next cross-reference string comparison function.

[0087] Module M3: Extract the code segments related to the backdoor verification key code from the original program to obtain the complete credential generation process code. This extraction process involves taint analysis and program slicing. The program slicing technique involves selecting at least one variable as the source of the slice. Then, based on the definition and usage relationships between program variables and statements, all instructions related to the source variable in the entire program are extracted. These usage relationships include variable initialization, variable assignment, and calculation.

[0088] Module M4: Performs data abstraction and process modeling on each credential generation process code to form a formal description of the verification credential and calculates the semantics and uncertainty of each input variable in the formal description. This data abstraction and process modeling process includes abstracting the variables involved in the verification code generation process, identifying their types and lengths, and abstracting the functions that operate on the variables in the verification code generation process, identifying the types and lengths of the function's input and output parameters. The formal description of the verification credential is formed based on the call flow diagram and data flow diagram of the code generation process fragment.

[0089] Semantics refers to the meaning inherent in the input itself, including device information, configuration, and user information stored by the device. The uncertainty calculation formula is as follows:

[0090] H(X k )=-∑p ki logp ki =1,2,3,…,n

[0091] H(X)=H(X k )=1,2,3,…,m

[0092] Where H(X) represents the uncertainty of the verification credential X, H(X k ) represents a single input variable X in the formal description of the verification credential k The uncertainty of p ki Represents a single input variable X k Some input value X ki The corresponding probability, n represents a single input variable X k The number of all possible input values, m represents the number of single input variables in the formal description of the verification credential.

[0093] Module M5: Based on the semantics and uncertainty of the various input variables, determine whether the uncertainty of all inputs used to generate the verification credentials is less than their respective maximum uncertainties. If so, the verification credentials are predictable, and the device has a backdoor that can be triggered by predictable credentials; if not, the verification credentials are unpredictable, and the corresponding device does not have a backdoor that can be triggered by predictable credentials.

[0094] Those skilled in the art will appreciate that, in addition to implementing the system, device, and various modules provided by the present invention in purely computer-readable program code, it is entirely possible to implement the same program in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, embedded microcontrollers, and the like by logically programming the method steps. Therefore, the system, device, and various modules provided by the present invention can be considered a hardware component, and the modules included therein for implementing various programs can also be considered structures within the hardware component; the modules for implementing various functions can also be considered both software programs for implementing the method and structures within the hardware component.

[0095] The above describes specific embodiments of the present invention. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art may make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. The embodiments of this application and the features in the embodiments may be combined with each other in any manner unless there is a conflict.

Claims

1. A method for detecting a credential-triggered backdoor in an IoT device, characterized in that: include: Step S1: decompress the device firmware to form a binary code library; Step S2: reverse-analyze the executable files in the code base, and locate the backdoor verification key code using string comparison functions and backdoor model features; Step S3: extracting the code segments related to the backdoor verification key code from the original program to obtain the complete credential generation process code; Step S4: performing data abstraction and process modeling on each of the credential generation process codes to form a formal description of the verification credential, and calculating the semantics and uncertainty of each input variable in the formal description; Step S5: Based on the semantics and uncertainty of each input variable, determine whether the uncertainty of all inputs used to generate the verification credential is less than their respective maximum uncertainty. If so, the verification credential is predictable and the device has a backdoor that can be triggered by the predictable credential. If not, the authentication credentials are unpredictable, and the corresponding device does not have a backdoor that can be triggered by predictable credentials; The step S2 comprises: Step S2.1: Perform reverse engineering on the executable files in the code base to detect whether there are string comparison functions and cross-references to string comparison functions in the files. If so, trigger step S2.2; if not, re-trigger step S2 to detect the next code base file; Step S2.2: querying the address of the cross-reference string comparison function, finding the function that calls the string comparison function according to the address, and generating a function control flow graph of the calling function; Step S2.3: Query the basic block that calls the string comparison function in the function control flow graph, perform a backdoor feature scan on the subsequent blocks of the basic block, and determine whether the subsequent blocks contain backdoor features. If so, mark the code contained in the basic block that calls the string comparison function as credential verification key code; if not, trigger step S2.2 to query the address of the next cross-reference string comparison function; Semantics refers to the meaning inherent in the input itself, including device information, configuration, and user information stored by the device; The calculation formula of the uncertainty is as follows: H(X k )=-∑p ki logp ki i=1,2,3,…,n H(X)=∑H(X k ) k=1,2,3,…,m Where H(X) represents the uncertainty of the verification credential X, H(X k ) represents a single input variable X in the formal description of the verification credential k The uncertainty of p ki Represents a single input variable X k Some input value X ki The corresponding probability, n represents a single input variable X k The number of all possible input values, m represents the number of single input variables in the formal description of the verification credential.

2. The method for detecting a credential-triggered backdoor in an IoT device according to claim 1, wherein: The stripping processing method includes stain analysis and program slicing technology; The program slicing technology includes selecting at least one variable as the source of slicing, and then extracting all instructions related to the source variable in the entire program based on the definition and usage relationship between the program variable and the statement; The usage relationship includes: variable initialization, variable assignment and calculation.

3. The method for detecting a credential-triggered backdoor in an IoT device according to claim 1, wherein: The data abstraction and process modeling process includes: abstracting the variables involved in the verification code generation process, identifying the type and length of the variables, and abstracting the functions that operate on the variables in the verification code generation process, identifying the type and length of the input and output parameters of the functions; The formal description of the verification credential is formed based on the call flow diagram and data flow diagram of the generated code process fragment.

4. A detection system for credential-triggered backdoors in IoT devices, characterized in that: include: Module M1: decompresses the device firmware to form a binary code library; Module M2: reverse-engineering the executable files in the code base, using string comparison functions and backdoor model features to locate the backdoor verification key code; Module M3: Extract the code segments related to the backdoor verification key code from the original program to obtain the complete credential generation process code; Module M4: Performing data abstraction and process modeling on each of the credential generation process codes to form a formal description of the verification credential, and calculating the semantics and uncertainty of each input variable in the formal description; Module M5: Based on the semantics and uncertainty of each input variable, determine whether the uncertainty of all inputs used to generate the verification credential is less than their respective maximum uncertainty. If so, the verification credential is predictable and the device has a backdoor that can be triggered by the predictable credential. If not, the authentication credentials are unpredictable, and the corresponding device does not have a backdoor that can be triggered by predictable credentials; The module M2 includes: Module M2.1: Performs reverse engineering on the executable files in the code base to detect whether there are string comparison functions and cross-references to string comparison functions in the files. If so, module M2.2 is triggered. If not, module M2 is retriggered to detect the next code base file. Module M2.2: querying the address of the cross-reference string comparison function, finding the function that calls the string comparison function according to the address, and generating a function control flow graph of the calling function; Module M2.3: Query the basic block that calls the string comparison function in the function control flow graph, perform a backdoor feature scan on the subsequent blocks of the basic block, and determine whether the subsequent blocks contain backdoor features. If so, mark the code contained in the basic block that calls the string comparison function as credential verification key code; if not, trigger module M2.2 to query the address of the next cross-reference string comparison function; Semantics refers to the meaning inherent in the input itself, including device information, configuration, and user information stored by the device; The calculation formula of the uncertainty is as follows: H(X k )=-∑p ki logp ki i=1,2,3,…,n H(X)=∑H(X k )k=1,2,3,…,m Where H(X) represents the uncertainty of the verification credential X, H(X k ) represents a single input variable X in the formal description of the verification credential k The uncertainty of p ki Represents a single input variable X k Some input value X ki The corresponding probability, n represents a single input variable X k The number of all possible input values, m represents the number of single input variables in the formal description of the verification credential.

5. The detection system for credential-triggered backdoors in IoT devices according to claim 4, characterized in that: The stripping processing method includes stain analysis and program slicing technology; The program slicing technology includes selecting at least one variable as the source of slicing, and then extracting all instructions related to the source variable in the entire program based on the definition and usage relationship between the program variable and the statement; The usage relationship includes: variable initialization, variable assignment and calculation.

6. The detection system for credential-triggered backdoors in IoT devices according to claim 4, characterized in that: The data abstraction and process modeling process includes: abstracting the variables involved in the verification code generation process, identifying the type and length of the variables, and abstracting the functions that operate on the variables in the verification code generation process, identifying the type and length of the input and output parameters of the functions; The formal description of the verification credential is formed based on the call flow diagram and data flow diagram of the generated code process fragment.

Images