An industrial control device vulnerability mining method based on a heterogeneous information network

Abstract

The application realizes an industrial control equipment vulnerability mining method based on a heterogeneous information network through a method in the field of network security. Based on the heterogeneous information network, the correlation in the industrial control equipment software code is modeled by using the meta path, the abnormal values in the meta path are detected by using the graph neural network, and finally the mined abnormal values are verified as the vulnerabilities in the software code. The method includes three processes: first, heterogeneous information network modeling; second, custom meta path representation; and third, multi-core learning vulnerability mining. The method provided by the application can deeply and comprehensively mine the industrial control equipment vulnerability method to improve the security of the industrial control equipment. Meanwhile, the method needs to be able to support different equipment types to reduce the vulnerability mining cost and expand the use range.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network search, and in particular to a method for mining vulnerabilities of industrial control equipment based on a heterogeneous information network. BACKGROUND

[0002] Industrial control, that is, industrial automation control, mainly combines information technology, electronic technology and mechanical technology to realize the intellectualization and automation of industrial production processes, making machines more intelligent and greatly improving production efficiency. Industrial control has irreplaceable advantages in important fields such as large nuclear power plants and aerospace, but this also means that there are very high requirements for the security of industrial control equipment. If there is a vulnerability in the industrial control equipment, it is easy to cause irreparable loss. Industrial control equipment has complex functions and large code size, and manual testing inevitably leaves some unmined security vulnerabilities. There are many methods for vulnerability mining today, but there are still some limitations:

[0003] 1. The vulnerability feature extraction is relatively simple, but there are many types of vulnerabilities, and existing methods are difficult to mine all of them.

[0004] 2. The existing detection method is difficult to capture the complex association between a large number of device firmware and vulnerabilities. The use of device library and vulnerability library is limited to the surface and the means is single. The vulnerability mining mostly uses simple methods such as feature comparison, and the mining is not deep enough and the quality is not good.

[0005] 3. There are many types of industrial control equipment, and the application scenarios are extremely wide, from large-scale infrastructure such as aerospace to small civilian devices such as delivery cabinets and cameras. Different devices have different architectures and different functions. The current mining method is difficult to solve all problems and has poor versatility.

[0006] Therefore, a method for in-depth and comprehensive mining of industrial control equipment vulnerabilities is needed to improve the security of industrial control equipment. At the same time, the method needs to support different types of devices to reduce the cost of vulnerability mining and expand the range of use.

[0007] As mentioned above, in order to in-depth and comprehensive mine the vulnerabilities of industrial control equipment, we propose a vulnerability mining method based on a heterogeneous information network. The method performs code-level static detection on the firmware of the industrial control equipment, disassembles the firmware of the device to be detected, and performs correlation analysis with the massive device firmware in the existing device library. Abstractly construct a heterogeneous information network according to the basic block logic relationship, interface call relationship, etc. Represent the node by graph neural network, generate exchange matrix to represent meta path, use multi-core learning to classify the meta path, thereby realizing in-depth and comprehensive mining of industrial control equipment vulnerabilities, and providing security protection for industrial control equipment. Compared with manual inspection and some existing vulnerability mining methods, the method proposed by us has the following advantages;

[0008] 1. The method introduces the association of the isomorphic information network modeling to be detected equipment and the related program in the vulnerability library and the equipment library, uses the graph neural network for node representation, extracts the meta path in the graph for classification, can extract the vulnerability characteristics completely and efficiently, and can fully mine the security vulnerabilities.

[0009] 2. Abstract from the code level, build an isomorphic information network from the code core level of the industrial control equipment, start from a deep enough point, and can mine deep security vulnerabilities.

[0010] 3. The deep learning method is used to mine the industrial control equipment vulnerabilities from the code level, without too much attention to the types of industrial control equipment, and can be used for various equipment, and has good universality. SUMMARY

[0011] Therefore, the application first proposes an industrial control equipment vulnerability mining method based on an isomorphic information network, models the association relationship in the industrial control equipment software code by using a meta path based on an isomorphic information network, detects abnormal values in the meta path by using a graph neural network, and finally verifies the abnormal values mined as vulnerabilities in the software code.

[0012] The method includes three processes:

[0013] First, isomorphic information network modeling: analyze and process the industrial control equipment software code, abstract the interface call logic, fuse the code information in the vulnerability library and the equipment library, model the relationship between the software to be detected, the industrial control software module in the equipment library and the interface, and build an isomorphic information network graph based on the two entities of the interface and the industrial control software module.

[0014] Second, custom meta path representation: according to the pre-defined four kinds of node relationships, define the meta path in the isomorphic information graph, represent the similar association relationship in the industrial control equipment software code by using the meta path, and serve the subsequent mining algorithm.

[0015] Third, multi-core learning vulnerability mining: merge the meta path into a matrix, model the constraint condition as a convex optimization problem for solving, finally learn the weight of different paths and take it as a core, and then perform vulnerability mining through a clustering algorithm.

[0016] The isomorphic information network modeling process first performs basic abstract definition, and then builds an isomorphic information network.

[0017] The specific process of the basic abstract definition is: firstly, entity abstraction is performed, and two entities of "interface" and "software module" are abstracted from the software code in the industrial control device; then, entity relationship definition is performed, taking the commonly used programming language of the industrial control device as an example, the relationship between the interface and the software module is considered, and the following four kinds of entity relationships are defined: the containing relationship, which means that the software module contains an interface; the same code block relationship, which means that the interfaces are in the same code block; the same dependent library relationship, which means that the interfaces are in the same dependent library; and the dependent function relationship, which means that the interfaces call the same dependent library function;

[0018] Then, based on the two entities and the four relationships, the following four matrixes representing the relationships between the entities are defined: matrix A, where a ij =1 represents that module i contains interface j; matrix B, where b ij =1 represents that interface i and interface j belong to the same code block relationship; matrix C, where c ij =1 represents that interface i and interface j belong to the same dependent library relationship; and matrix D, where d ij =1 represents that interface i and interface j belong to the dependent function relationship.

[0019] The specific method of constructing the heterogeneous information network is: analyzing and processing the software code of the industrial control device, extracting the interface call stack information and the interface coupling relationship between different modules, and building the heterogeneous information network based on the extracted information. First, a extractor is constructed to abstractly model the code, identify the interface information in all industrial control modules, and bind a global flag to each interface for subsequent relationship modeling analysis. Then, a heterogeneous information network constructor is constructed to build the heterogeneous information network based on the extracted interface and industrial control module entities, and map the four defined relationships to the entity connections in the graph.

[0020] The specific method of the self-defined meta-path representation is: defining a meta-path between entities on the heterogeneous information graph, where the meta-path represents the logical relationship between entities and represents that two modules use the same interface.

[0021] The specific method of the multi-core learning vulnerability mining is: different meta-paths are inducted and merged into cores, and then a multi-core learning method is used for automatic algorithm calculation, so as to learn the similarity between the meta-paths and determine the weight allocated to each meta-path when performing vulnerability mining;

[0022] Specifically, the modeling of the convex optimization problem is performed on the heterogeneous graph data, a relaxation factor is introduced to allow partial error division, a nonlinear mapping relationship of features in Hilbert space is introduced to further constrain the weight, and a representation theorem is used, and finally the different weights of each meta-path are obtained by solving the convex optimization problem. After learning the weight of each meta-path as a core, a multi-core clustering method is used for vulnerability mining.

[0023] The technical effect to be achieved by the present application is that:

[0024] 1. The present application uses a graph neural network to represent nodes and extracts meta-paths in the graph for classification. The extracted features are comprehensive and can mine various types of security vulnerabilities.

[0025] 2. The present application abstracts from the code level and starts from a deep enough point to directly access the code core of the industrial control device, ensuring the depth of vulnerability mining.

[0026] 3. The present application uses a deep learning method to mine industrial control device vulnerabilities from the code level, without needing to pay too much attention to the types of industrial control devices. It can be used for various devices and has good versatility and portability. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 Execution flow;

[0028] Figure 2 Heterogeneous information network graph DETAILED DESCRIPTION

[0029] The following is a preferred embodiment of the present application and further describes the technical solution of the present application in conjunction with the drawings, but the present application is not limited to this embodiment.

[0030] The present application proposes a method for mining industrial control device vulnerabilities based on a heterogeneous information network.

[0031] The technical solution in this embodiment is aimed at the vulnerability detection scene of industrial cameras, automatic switches and other networked devices under the background of industrial interconnection. It collects a large amount of device firmware of networked devices (including an equal amount of known abnormal samples and normal samples) to form a firmware library, reverses each firmware in the firmware library to obtain the assembly code of each firmware, and constructs a large-scale heterogeneous information network according to the complex logical relationship between the firmware code blocks and system calls. On the basis of the above, the technical method first reverses the industrial control device firmware to be detected and associates the analysis result with the above heterogeneous information network, secondly uses meta-paths to model the association relationship between the device firmware to be detected and all firmware in the firmware library, further uses a graph neural network to detect abnormalities in the meta-paths, and finally uses multi-core learning to extract abnormal features and classify the abnormal types, thereby determining whether the device firmware to be detected has vulnerabilities and what kind of vulnerabilities exist.

[0032] The method includes the following processes:

[0033] 1. Heterogeneous information network modeling: Analyzing and processing the firmware code of industrial control devices, abstracting the interface call logic, fusing the code information in the vulnerability library and device library, modeling the relationship between the software to be detected, the industrial control software modules in the device library and the interfaces, and constructing a heterogeneous information network graph based on the two entities of interfaces and device software modules. The extraction of entities is obtained according to the relevant definitions in the industrial control device software code, and then the relationship between entities is modeled through the judgment of position, that is, whether two interfaces are in the same code block, and the judgment of logic, that is, whether two interfaces come from the same dependent library or call the same dependent function, and whether a function module uses a certain interface. The four types of relationships between entities are represented using four adjacency matrices. For example, matrix A is used to describe the inclusion relationship between modules and interfaces. If module i contains interface j, then A i,j = 1, otherwise A i,j = 0.

[0034] 2. Custom meta-path representation: According to the pre-defined four types of node relationships, define the meta-path in the heterogeneous information graph, represent the similar association relationship in the industrial control device software code with the meta-path, and serve the subsequent mining algorithm. The meta-path is represented by the product of the adjacency matrix on the path, and the edge on the meta-path is a directed edge, containing a unique one-way relationship, and its reverse relationship is represented by the transpose of the matrix. For example, the inclusion relationship from module 1 to interface 2 is represented by A, and the inclusion relationship from interface 2 to module 3 is represented by A T . In this way, AA T describes the meta-path from module 1 to module 3. Although there are many meta-paths, not all of them are useful for detecting vulnerabilities. Only the symmetric meta-path from module to module needs to be considered, which can reflect the similarity between modules.

[0035] 3. Multi-core learning vulnerability mining: By merging the meta-path into a matrix, modeling the constraint condition as a convex optimization problem for solving, and finally learning the weight matrix of different paths as a kernel function to perform vulnerability mining through a clustering algorithm. That is, use the matrix x obtained by merging the meta-path to represent the industrial control device software, and use the kernel function to map the meta-path matrix to a high-dimensional feature space for better classification. That is, for a meta-path matrix x, the goal is to classify it using weight matrix w and b by calculating . The specific construction of the model is as follows: assuming that there are m labeled software {(z1,y1),(z2,y2),…(z m ,y m} in the data set, y i ∈(-1,1), x i is the meta-path matrix corresponding to z i , and the final goal is such that Assume that there is a kernel function Convert it into a dual problem by Lagrange multiplier method

[0036]

[0037] Solve alpha by quadratic programming algorithm i Then use Classify the software of industrial control equipment.

[0038] The execution flow of the technical solution is as shown in Figure 1 .

[0039] The modeling process of the heterogeneous information network first carries out basic abstract definition, and then constructs the heterogeneous information network.

[0040] Basic abstract definition:

[0041] Entity abstraction: abstract two entities of "interface (API)" and "software module" from the software code in the industrial control equipment.

[0042] Entity relationship definition: taking the commonly used programming language of the industrial control equipment as an example, considering the relationship between the interface and the software module, the technical solution defines the following four kinds of entity relationships:

[0043] Containment relationship: refers to that the software module contains a certain interface;

[0044] Same code block relationship: refers to that the interfaces are in the same code block;

[0045] Same dependency library relationship: refers to that the interfaces are in the same dependency library;

[0046] Dependency function relationship: refers to that the interface calls the same dependency library function.

[0047] Based on the two kinds of entities and the four kinds of relationships, the technical solution defines the following four kinds of matrixes representing the relationships between the entities

[0048]

[0049] Matrix A, wherein a ij =1 represents that module i contains interface j;

[0050] Matrix B, wherein b ij =1 represents that interface i and interface j belong to the same code block relationship;

[0051] Matrix C, wherein c ij =1 represents that interface i and interface j belong to the same dependency library relationship;

[0052] Matrix D, wherein d ij =1 represents that interface i and interface j belong to the dependency function relationship.​

[0053] Building a heterogeneous information network:

[0054] In order to build an information network, it is necessary to analyze and process the software code of industrial control equipment, extract its interface call stack information and the interface coupling relationship between different modules, and build a heterogeneous information network based on the extracted information.

[0055] Extractor: This technical solution provides an extractor to perform abstract modeling on the code, identify the interface information in all industrial control modules, and bind a global flag to each interface for subsequent relationship modeling and analysis.

[0056] Heterogeneous information network constructor: Based on the extracted interfaces and industrial control module entities, a heterogeneous information network is constructed, and the four defined relationships are mapped to the entity connections in the diagram. The constructed heterogeneous information network diagram is as follows: Figure 2 As shown:

[0057] Custom meta path representation:

[0058] To discover vulnerabilities, this technical solution defines meta-paths between entities in a heterogeneous information graph. Meta-paths represent logical relationships between entities. For example, the formula "module contains API1, which is contained in module2" indicates that two modules use the same interface. Based on meta-paths, entity relationships in the heterogeneous graph are mined to detect abnormal path intersections in the graph and thus identify software vulnerabilities.

[0059] Based on customized meta-paths, this technical solution represents and models entities in heterogeneous graphs. Different representations represent different entity relationships. By combining multiple meta-paths, comprehensive and complex modeling of software codes in industrial control equipment can be performed, thereby discovering deep vulnerabilities.

[0060] Multi-core learning vulnerability mining:

[0061] After customizing the meta-path, this technical solution can mine multiple meta-paths from different entities and relationships. The different meta-paths are then summarized and merged into cores. Multi-core learning is then used to perform automated algorithm calculations to learn the similarities between meta-paths and determine the weight assigned to each meta-path when performing vulnerability mining.

[0062] Specifically, we model a convex optimization problem for heterogeneous graph data, introduce a relaxation factor to allow for some incorrect partitioning, introduce a nonlinear mapping relationship between features in Hilbert space to further constrain the weights, and then apply the presentation theorem to ultimately solve the convex optimization problem to obtain different weights for each meta-path. After learning the weights for each meta-path and using them as kernels, this technical solution uses a multi-kernel clustering method for vulnerability discovery.

Claims

1. A method for discovering vulnerabilities in industrial control equipment based on a heterogeneous information network, characterized by: Based on heterogeneous information networks, we use meta-paths to model the associations in the software code of industrial control equipment. We then use graph neural networks to detect outliers in the meta-paths. Finally, we use the mined outliers as vulnerabilities in the software code for verification. Finally, we use multi-core learning to extract anomaly features and classify anomaly types, ultimately outputting a conclusion on whether the device firmware to be tested has vulnerabilities and the types of vulnerabilities that exist. The method consists of three steps: First, heterogeneous information network modeling: Analyze and process the industrial control equipment software code, extract the interface call logic, integrate the code information in the vulnerability library and the equipment library, model the relationship between the detection software, the industrial control software modules in the equipment library and the interface, and build a heterogeneous information network diagram based on the two entities of interface and equipment software module. The extraction of entities is obtained according to the relevant definitions in the industrial control equipment software code, and then the relationship between entities is modeled by positional judgment, that is, whether the two interfaces are in the same code block, and logical judgment, that is, whether the two interfaces come from the same dependent library or call the same dependent function, and whether the functional module uses a certain interface. The four types of relationships between entities are represented by four adjacency matrices. For example, matrix A is used to describe the inclusion relationship between modules and interfaces. If module i contains interface j, then A i,j =1, otherwise A i,j =0; Second, custom meta-path representation: Based on the four predefined node relationships, meta-paths are defined in the heterogeneous information graph. Meta-paths are used to represent similar associations in the software code of industrial control equipment. Meta-paths are represented by the product of the adjacency matrices on the path. The edges on the meta-path are directed edges, including the only unidirectional relationship, and its reverse relationship is represented by the transpose of the matrix. Third, multi-core learning vulnerability mining: By merging meta-paths into a matrix, the constraints are modeled as a convex optimization problem for solution. Finally, the weight matrices of different paths are learned and used as kernel functions to perform vulnerability mining through clustering algorithms. That is, the matrix x obtained by merging meta-paths is used to represent the industrial control equipment software, and the kernel function is used. Map the meta-path matrix to a high-dimensional feature space for better classification. That is, for a meta-path matrix x, the goal is to use the weight matrices w and b to calculate The vulnerability classification model is constructed as follows: Assume that there are m labeled software {(z1,y1),(z2,y2),…(z m ,y m )},y i ∈(-1,1), where x i For z i The corresponding element path matrix, the final objective function is Make Assume that there is a kernel function It is transformed into a dual problem by Lagrange multiplier method. Solve α by quadratic programming algorithm i You can use it later Classify industrial control equipment software.

2. The method for mining industrial control equipment vulnerabilities based on a heterogeneous information network according to claim 1, characterized in that: The heterogeneous information network modeling process first performs basic abstract definitions and then constructs the heterogeneous information network.

3. The method for mining industrial control equipment vulnerabilities based on a heterogeneous information network according to claim 2, characterized in that: The specific process of the basic abstract definition is as follows: first, entity abstraction is performed to abstract the two entities "interface" and "software module" from the software code in the industrial control equipment; then, entity relationship definition is performed. Taking the commonly used programming languages ​​of industrial control equipment as an example, considering the relationship between the interface and the software module, the following four entity relationships are defined: ① containment relationship, which means that the software module contains a certain interface; ② same code block relationship, which means that the interfaces are in the same code block; ③ same dependency library relationship, which means that the interfaces are in the same dependency library; ④ dependency function relationship, which means that the interfaces call the same dependency library function; Then, based on two entities and four relationships, the following four matrices are defined to represent the relationships between the entities: Matrix A, where a ij =1 means module i contains interface j; matrix B, where b ij =1 means that interface i and interface j belong to the same code block; matrix C, where c ij =1 means that interface i and interface j belong to the same dependency library; matrix D, where d ij =1 means that interface i and interface j belong to a dependency function relationship.

4. The method for exploiting industrial control equipment vulnerabilities based on a heterogeneous information network according to claim 3, wherein: The specific method for constructing a heterogeneous information network is as follows: analyzing and processing the software code of industrial control equipment, extracting its interface call stack information and the interface coupling relationship between different modules, and building a heterogeneous information network based on the extracted information. First, an extractor is constructed to perform abstract modeling on the code, identify the interface information in all industrial control modules, and bind a global flag to each interface for subsequent relationship modeling and analysis; Then, a heterogeneous information network constructor is constructed. Based on the extracted interfaces and industrial control module entities, a heterogeneous information network is built, and the four defined relationships are mapped to the entity connections in the graph.

5. The method for mining industrial control equipment vulnerabilities based on a heterogeneous information network according to claim 4, characterized in that: The specific method of the custom meta-path representation is: defining a meta-path between entities on a heterogeneous information graph, where the meta-path represents the logical relationship between the entities and indicates that two modules use the same interface.

6. The method for mining industrial control equipment vulnerabilities based on a heterogeneous information network according to claim 5, characterized in that: The specific method of multi-core learning vulnerability mining is: different meta-paths are summarized and merged into cores, and then an automated algorithm calculation is performed using multi-core learning to learn the similarities between meta-paths and determine the weight assigned to each meta-path when performing vulnerability mining; Specifically, for modeling the convex optimization problem of heterogeneous graph data, a relaxation factor is introduced to allow some incorrect partitioning, and the nonlinear mapping relationship of features in the Hilbert space is introduced to further constrain the weights. Then, the presentation theorem is used to finally obtain different weights for each meta-path by solving the convex optimization problem. After learning the weight of each meta-path and using it as the kernel, the multi-kernel clustering method is used for vulnerability mining.

Images