Method and device for identifying vulnerability information of power internet of things terminal

Abstract

Embodiments of the present application relate to a kind of power internet of things terminal vulnerability information identification method and device, comprising: based on the patch extraction and the associated information related to the vulnerability of vulnerability;Determine target patch data set based on the associated information;Determine vulnerability trigger condition based on the target patch data set, and the general permission list type in target patch data set is classified, obtains the vulnerability feature library of the coverage multiple general permission list type with vulnerability trigger condition as classification feature;Based on the difference file of the difference comparison of vulnerability file and no-vulnerability file, the key variable of the vulnerability is identified, and generation and extraction code slice;Based on the code slice and the vulnerability feature library, the trigger point and reference point of vulnerability are identified.Therefore, based on patch information, the extraction and use of power internet of things terminal vulnerability information can be completed, the normal behavior and abnormal behavior of equipment in power internet of things system can be accurately distinguished, and the complexity is low, false alarm rate is low.

Description

Technical Field

[0001] This invention relates to the field of power Internet of Things (IoT) technology, and in particular to a method and apparatus for identifying vulnerability information of power IoT terminals. Background Technology

[0002] For analyzing vulnerability patches, existing work on applying patches to vulnerability detection and analysis mainly divides vulnerability detection into two modes: pattern-based methods and code similarity-based methods. Code similarity-based methods can be divided into three steps: first, dividing the program into code segments; second, abstracting and representing each code segment, using methods such as tagging, relationship trees, and relationship graphs; and third, calculating the similarity between code segments using the abstract representation obtained in the second step. Li's proposed automatic vulnerability detection system based on code similarity defines patch characteristics, enabling the location of a vulnerability in the source code given one. This is a method of applying patch characteristics to similar code detection. However, this method is limited to detecting the reuse of vulnerable code in software and cannot detect other types of vulnerabilities.

[0003] For training samples in deep learning vulnerability detection, the best internationally recognized deep learning-based vulnerability detection methods currently only achieve an average precision of 41%, an average recall of only 65%, and an average F1 score of only 48% (higher values ​​are better) on three complex open-source software vulnerability datasets. Past work on generating datasets for training intelligent source code vulnerability detection tools has primarily employed the following two methods:

[0004] Method 1: Directly use all function code involved in patching as vulnerability-related code. Although the function-level slicing method is very simple to implement, the problem is that using patched functions as vulnerability-related code will inevitably contain a large number of vulnerability-related statements, introducing a lot of noise during model training. This may cause the resulting intelligent detection system to fail to achieve the target function, resulting in large-scale false positives and false negatives.

[0005] Method 2: Extract all statements with dependencies from the patch location as vulnerability-related code. This method enhances the relevance of the sliced ​​code to the vulnerability by extracting dependencies related to the patch location. However, most of these methods only consider data flow dependencies related to the patch location and do not consider control flow dependencies. This makes it impossible for the relevant vulnerability slices to cover all the semantic information contained in the patch, resulting in a high false negative rate in the trained model. Summary of the Invention

[0006] In view of this, in order to solve the above-mentioned technical problems or some of the technical problems, the present invention provides a method and apparatus for identifying vulnerability information of power Internet of Things terminals.

[0007] In a first aspect, embodiments of the present invention provide a method for identifying vulnerability information in power Internet of Things (IoT) terminals, comprising:

[0008] Based on the vulnerability patch, extract related information associated with the vulnerability;

[0009] The target patch dataset is determined based on the aforementioned association information;

[0010] Based on the target patch dataset, the vulnerability triggering situation is determined, and the common permission list types in the target patch dataset are classified to obtain a vulnerability feature library covering multiple common permission list types with the vulnerability triggering situation as the classification feature.

[0011] Based on the difference files obtained by comparing the vulnerable files and the non-vulnerable files, the key variables of the vulnerability are identified, and code slices are generated and extracted.

[0012] The trigger points and reference points of vulnerabilities are identified based on the code slices and the vulnerability signature database.

[0013] In one possible implementation, the method further includes:

[0014] To locate the function containing the patch code for the vulnerability, search upwards for the function name of the function containing the code as the starting position of the code slice, and search downwards for the end character of the function as the ending position of the slice.

[0015] Analyze the characteristics of the difference files by comparing the vulnerable files and the non-vulnerable files to obtain patch feature information;

[0016] Track control flow changes triggered by patches to determine the location where vulnerabilities are triggered;

[0017] Obtain information about the flow of data along the program execution path;

[0018] Perform forward and backward data flow and control flow analysis on the patch across functions to obtain the patch's cross-function information.

[0019] In one possible implementation, the method further includes:

[0020] A patch dataset containing vulnerability source code and corresponding patching code is pre-built. The patch dataset includes patch-related difference files, vulnerability files, and vulnerability patching files.

[0021] Based on the associated information, query the patch dataset for patch-related difference files, vulnerability files, and vulnerability patching files to determine the target patch dataset.

[0022] In one possible implementation, the method further includes:

[0023] Based on the common permission list in the target patch dataset, the triggering conditions of the vulnerability are determined according to different common permission list types;

[0024] Based on the triggering conditions of the vulnerabilities, the general permission list types are categorized to obtain a vulnerability feature library covering multiple general permission list types with vulnerability triggering conditions as the classification feature. The vulnerability feature library includes the features of vulnerability triggering points and the features of vulnerability referencing points.

[0025] In one possible implementation, the method further includes:

[0026] Determine the format of the difference file;

[0027] Based on the format of the difference file, an advanced merging format is used to process the difference file and the patch file to extract the key variables of the vulnerability;

[0028] Based on the difference file, dependency files are obtained, and multiple code analysis tool diagrams are generated based on the dependency files;

[0029] Based on the multiple code analysis tool graphs and the key variables, a set of key nodes is generated by traversing all points of interest.

[0030] Code slices are generated and extracted based on the set of key nodes to obtain code slice files.

[0031] In one possible implementation, the method further includes:

[0032] Obtain matching information for the vulnerability lines from the code slice file, and generate the target code slices required for the matching information according to the modification blocks;

[0033] Based on the common permission list type in the vulnerability feature library to which the vulnerability belongs, the corresponding rules are matched in the target code slice to obtain a set of candidate vulnerability trigger points for specified key variables;

[0034] For each candidate vulnerability trigger point, a corresponding candidate vulnerability introduction point is matched.

[0035] In one possible implementation, the method further includes:

[0036] The vulnerability signature database is expanded, and the vulnerability matching rules based on vulnerability signatures are updated.

[0037] Secondly, embodiments of the present invention provide a device for identifying vulnerability information of power Internet of Things (IoT) terminals, comprising:

[0038] The extraction module is used to extract associated information related to the vulnerability based on the vulnerability patch;

[0039] The determination module is used to determine the target patch dataset based on the associated information;

[0040] The classification module is used to determine the vulnerability triggering situation based on the target patch dataset, and classify the common permission list types in the target patch dataset to obtain a vulnerability feature library covering multiple common permission list types with the vulnerability triggering situation as the classification feature.

[0041] The identification module is used to identify key variables of the vulnerability based on the difference file of the vulnerability file and the non-vulnerable file by comparing the differences; and to generate and extract code slices.

[0042] The identification module is also used to identify the trigger points and reference points of vulnerabilities based on the code slices and the vulnerability feature library.

[0043] In one possible implementation, the extraction module is further configured to: locate the function where the patch code for the vulnerability is located; search upwards for the function name of the function containing the code as the starting position of the code slice; search downwards for the end symbol of the function as the ending position of the slice; analyze the characteristics of the difference files compared with the vulnerable file and the non-vulnerable file to obtain patch feature information; track the control flow changes triggered by the patch to determine the triggering position of the vulnerability; obtain information on the flow of data along the program execution path; and perform forward and backward data flow and control flow analysis across functions on the patch to obtain cross-function information of the patch.

[0044] In one possible implementation, the determining module is further configured to pre-establish a patch dataset containing vulnerability source code and corresponding patching code, the patch dataset including patch-related difference files, vulnerability files, and vulnerability patching files; and to query the patch dataset for patch-related difference files, vulnerability files, and vulnerability patching files based on the association information to determine the target patch dataset.

[0045] In one possible implementation, the classification module is further configured to determine the vulnerability triggering situation according to different general permission list types based on the general permission list in the target patch dataset; classify the general permission list types based on the vulnerability triggering situation to obtain a vulnerability feature library covering multiple general permission list types with vulnerability triggering situation as the classification feature, the vulnerability feature library including the features of vulnerability triggering points and the features of vulnerability referencing points.

[0046] In one possible implementation, the identification module is further configured to: determine the format of the difference file; process the difference file and patch file using an advanced merging format based on the format of the difference file to extract the key variables of the vulnerability; obtain dependency files based on the difference file, and generate multiple code analysis tool graphs based on the dependency files; traverse all points of concern based on the multiple code analysis tool graphs and the key variables to generate a set of key nodes; and generate and extract code slices based on the set of key nodes to obtain a code slice file.

[0047] In one possible implementation, the identification module is further configured to obtain matching information for the vulnerability lines from the code slice file, and generate the target code slice required for the matching information according to the modification block; based on the general permission list type in the vulnerability feature library to which the vulnerability belongs, match the corresponding rules in the target code slice to obtain a set of candidate vulnerability trigger points for specified key variables; and match the corresponding candidate vulnerability introduction point based on each candidate vulnerability trigger point.

[0048] In one possible implementation, the classification module is further configured to expand the vulnerability feature database and update the vulnerability matching rules based on vulnerability features.

[0049] Thirdly, embodiments of the present invention provide a computer device, including: a processor and a memory, wherein the processor is configured to execute an identification program for power Internet of Things (IoT) terminal vulnerability information stored in the memory, so as to implement the power IoT terminal vulnerability information identification method described in the first aspect above.

[0050] Fourthly, embodiments of the present invention provide a storage medium, comprising: the storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement the method for identifying power Internet of Things terminal vulnerability information as described in the first aspect.

[0051] The power IoT terminal vulnerability identification scheme provided in this invention extracts associated information related to the vulnerability based on the vulnerability patch; determines the target patch dataset based on the associated information; determines the vulnerability triggering situation based on the target patch dataset, and classifies the common permission list types in the target patch dataset to obtain a vulnerability feature library covering multiple common permission list types with vulnerability triggering situation as the classification feature; identifies the key variables of the vulnerability based on the difference file by comparing the vulnerability file and the non-vulnerable file, and generates and extracts code slices; and identifies the trigger point and reference point of the vulnerability based on the code slices and the vulnerability feature library. Compared with the problems of false positives and false negatives caused by the introduction of a large amount of noise in the prior art or the high false negative rate of the model due to incomplete consideration of the influence conditions in the model training, this scheme completes the extraction and utilization of power IoT terminal vulnerability information based on patch information, which can accurately distinguish the normal behavior and abnormal behavior of devices in the power IoT system, and has low complexity and low false positive rate. Attached Figure Description

[0052] Figure 1 A flowchart illustrating a method for identifying vulnerability information in a power Internet of Things (IoT) terminal, as provided in an embodiment of the present invention.

[0053] Figure 2 A flowchart illustrating another method for identifying vulnerability information in a power Internet of Things (IoT) terminal, provided in an embodiment of the present invention.

[0054] Figure 3 This is a schematic diagram of the structure of a device for identifying vulnerability information of a power Internet of Things (IoT) terminal, provided in an embodiment of the present invention.

[0055] Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0057] To facilitate understanding of the embodiments of the present invention, further explanations and descriptions will be provided below with reference to the accompanying drawings and specific embodiments. These embodiments do not constitute a limitation on the embodiments of the present invention.

[0058] Figure 1 This is a flowchart illustrating a method for identifying vulnerability information in a power Internet of Things (IoT) terminal, as provided in an embodiment of the present invention. Figure 1 As shown, the method specifically includes:

[0059] S11. Extract relevant information related to the vulnerability based on the vulnerability patch.

[0060] The embodiments of the present invention are combined with, for example Figure 2 As shown, the system's original files and patch files can be manually analyzed to determine the vulnerability trigger points and reference points estimated by humans, as well as other vulnerability-related information. This related information can also include different system information. Then, the characteristics of the vulnerability trigger points can be determined based on the general permission list.

[0061] Furthermore, in the automation phase, the vulnerability identification system in the computer equipment acquires the vulnerability file and patch file, locates the function where the patch code is located, searches upwards for the function name of the function containing the code as the starting position of the code slice, and searches downwards for the end symbol of the function as the ending position of the slice; analyzes the characteristics of the difference file by comparing the vulnerability file and the non-vulnerable file to obtain patch feature information; tracks the control flow changes triggered by the patch to determine the trigger position of the vulnerability; acquires information on the flow of data along the program execution path; and performs forward and backward data flow and control flow analysis across functions on the patch to obtain cross-function information of the patch.

[0062] Specifically, patch feature analysis: analyzing patch features means analyzing the characteristics of the difference files compared to vulnerable and non-vulnerable files.

[0063] Patch control flow analysis: Studying the control flow changes in patches is crucial for fine-grained slicing of vulnerability-related code, because many patches change the control flow by adding or modifying control statements. Therefore, this system aims to trace the control flow changes that patches may cause in order to accurately locate the triggering point of the vulnerability.

[0064] Patch data flow analysis: Data flow analysis is an information analysis technique used to obtain information about the flow of relevant data along the program execution path. Applying this technique to patch analysis can reveal the execution flow of key variables extracted from the patch within the program. Through forward and backward data flow analysis, the entire execution process of key variables from introduction to triggering can be constructed. By examining assignment statements, control statements, and function call statements containing relevant data, a relatively complete data flow slice can be generated.

[0065] Cross-function analysis of patches: Perform forward and backward data flow and control flow analysis on the patches across functions. If function call statements are found in the patch data flow, inter-procedural analysis using a function call graph is necessary to analyze the internal code of the called functions and complete forward data flow slicing. If the data flow traces back to the function definition header, more information about the vulnerable function call needs to be obtained, requiring tracing the function reference location to complete backward data flow slicing.

[0066] S12. Determine the target patch dataset based on the association information.

[0067] A patch dataset containing the vulnerability source code and corresponding patch code is pre-built. The patch dataset includes patch-related difference files, vulnerability files, and vulnerability patch files.

[0068] Specifically, the patch dataset uses 4076 security patches containing embedded vulnerability source code and corresponding patch code from the U.S. National Vulnerability Database dataset. This patch dataset can provide effective and distinctive vulnerability samples for manual analysis, and can also serve as test samples to verify the system's output and evaluate its performance after the system is automated.

[0069] Furthermore, based on the correlation information query, the target patch dataset is determined by identifying the patch-related difference files, vulnerability files, and patched vulnerability files in the patch dataset.

[0070] S13. Based on the target patch dataset, determine the vulnerability triggering situation and classify the common permission list types in the target patch dataset to obtain a vulnerability feature library covering multiple common permission list types with vulnerability triggering situation as the classification feature.

[0071] To establish comprehensive rules for matching vulnerability trigger points and vulnerability referencing points, this system categorizes vulnerabilities according to their triggering principles. Using the software defect list in the general access control list as the benchmark, it classifies vulnerabilities of different disclosure types according to different general access control list types. Considering the dependencies (such as subordination and inclusion) between general access control list types, the system further categorizes and organizes these types based on different vulnerability triggering scenarios, resulting in a vulnerability feature library covering multiple general access control list types, categorized by vulnerability triggering scenarios. The vulnerability feature library mainly includes two aspects: the characteristics of vulnerability trigger points and the characteristics of vulnerability referencing points.

[0072] This system focuses on establishing a feature database of vulnerability trigger points and defining matching rules for these trigger points. The following is an analysis of different vulnerability trigger scenarios and the common permission list numbers involved, to summarize the vulnerability trigger point matching rules for each scenario. Table 1 shows the different common permission list types and their vulnerability trigger point characteristics:

[0073] Table 1

[0074]

[0075]

[0076] S14. Based on the difference file obtained by comparing the vulnerable file and the non-vulnerable file, identify the key variables of the vulnerability, and generate and extract code slices.

[0077] This invention includes several processing steps in its embodiments:

[0078] Step 1, Preprocess the difference file: The difference file has already divided the patch into patch blocks using @@ according to the position of the patch in the file. To distinguish the patching method of the patch statements, it is necessary to pair the statements in the plus and minus signs. Therefore, in each @@ block, the code of the @@ block is split by unmodified lines, forming consecutive plus and minus line blocks. Then, each block is further split at the statement level, comment lines are filtered out, and the statements in the split lines are merged. The plus and minus line statements for each block are obtained according to the order of the statements in the vulnerable or non-vulnerable file.

[0079] Step 2: Determine the type of the patch statements. For each plus or minus line in each block, determine its statement type. Construct regular expression matching statements using C language keywords and special operators to obtain the statement type of each statement.

[0080] Step 3: Determine the patching method for the statement. Take one statement from the list of statements marked with plus and minus signs. These two statements should have the same relative position in both the original and post-patch files. If the plus and minus statements are of the same type, the patching method is modification, meaning the patch modifies the specific content of the statement, such as adding, deleting, or changing variables, adding or deleting conditional expressions, etc. If the plus and minus statements are of different types, they can only be processed separately, categorized as either add-only or delete-only. In this case, the patch adds or deletes statements on the entire line, such as adding if statements or deleting variable assignment statements.

[0081] Step 4: Extract key variables based on the characteristics of the patched statements. For variable assignment statements, patching might involve adding or deleting a variable assignment statement, or modifying the expression on the right-hand side of the assignment operator. For control statements, patching might involve adding or deleting the entire control statement, or replacing the conditional expression within the control statement. If the modification involves a variable definition statement, the key variable is the modified variable; if the modification involves adding or deleting variables from the definition statement, all defined variables are used as key variables.

[0082] Furthermore, generate and extract code slices:

[0083] Using code analysis tools, control flow graphs and program dependency graphs are generated. Based on these graphs, data flow analysis is performed on the key variables identified in the previous step, both within and between functions, to generate slices. This process includes the following steps:

[0084] Step 1: Generate the control flow graph, program dependency graph, and function call graph, and obtain dependent files: Based on the common vulnerability disclosure number and hash value, obtain a list of modified vulnerable functions. Then, copy the files to be parsed to the working directory of the code analysis tool, run the analysis to obtain the parsing results, and query the set of dependent files from the parsing results, including the files containing the function nodes that call the vulnerable functions. After generating the control flow graph and program dependency graph, obtain the function nodes called by each node, establish directed edges from the called nodes to the calling nodes, and complete the construction of the function call graph.

[0085] Step 2: Preprocess the key variable generation results. For each difference file under the common vulnerability disclosure number and hash value, iterate through the key variable generation results from the previous stage, saving the lines of code to be analyzed as points of interest. After the iteration, for a target analysis file, extract the list of vulnerable functions from the target analysis file based on the difference behavior information, and then filter out the names of the vulnerable functions containing the points of interest. For each key variable of the points of interest, return the key variable nodes from the code analysis tool's graphical database, iterate through all points of interest, and finally generate a set of key nodes.

[0086] Step 3: Use the set of key nodes to generate slices. For each node, obtain the program dependency graph of the current vulnerable function based on the node attributes, find the nodes of interest in the program dependency graph, and finally generate a list of nodes of interest.

[0087] Step 4: Save the slicing results. The final slice set consists of: deduplicated slices within functions, slices across functions, and slices across functions. Write the slice set into a slice file in a specific format.

[0088] S15. Identify the trigger points and reference points of vulnerabilities based on the code slices and the vulnerability feature library.

[0089] The basic principle of the vulnerability-related code extraction system is to generate key variables based on patch characteristics, extract forward and backward cross-function slices centered on these key variables, and automatically identify candidate vulnerability trigger points and vulnerability reference points in the slice files according to vulnerability feature libraries of different general permission list types. Therefore, the automatic identification of vulnerability trigger points and vulnerability reference points provides users with accurate vulnerability introduction and trigger locations, including the following steps:

[0090] Step 1: Slice file preprocessing. Obtain the information needed to match the vulnerability lines from the slice file, and generate the required slices according to the modified blocks.

[0091] Step 2: Vulnerability trigger point matching. Based on the general permission list type to which the vulnerability belongs, match the corresponding rules in the slice to obtain a set of candidate vulnerability trigger points for the specified key variables.

[0092] Step 3: Vulnerability introduction point matching. Match the corresponding candidate vulnerability introduction point according to each candidate vulnerability trigger point.

[0093] Optionally, embodiments of the present invention can also enhance the strategy through manual feedback, using test points that generate abnormal output as analysis cases to expand the vulnerability feature library for different general permission list types and modify the expression of vulnerability matching rules based on vulnerability features. The manual feedback steps are as follows:

[0094] Step 1: By examining different types of vulnerabilities, we summarized the vulnerability triggering scenarios for 16 vulnerability types and generated a preliminary vulnerability signature database.

[0095] Step 2: Test the output of the semi-automated tool using a small number of manually labeled samples. If the test results do not include the manually labeled vulnerability trigger points and ingress points, it is necessary to analyze and identify the reasons for the failure, find the root cause of the problem, and optimize the various functional components of the system.

[0096] Step 3: Expand the vulnerability signature database and modify the expression of vulnerability matching rules based on vulnerability signatures.

[0097] The method for identifying vulnerability information in power IoT terminals provided in this invention extracts associated information related to the vulnerability based on the vulnerability patch; determines a target patch dataset based on the associated information; determines the vulnerability triggering situation based on the target patch dataset, and classifies the common permission list types in the target patch dataset to obtain a vulnerability feature library covering multiple common permission list types with vulnerability triggering situation as the classification feature; identifies the key variables of the vulnerability based on the difference file of the vulnerability file and the non-vulnerable file by comparing the difference files, and generates and extracts code slices; and identifies the trigger point and reference point of the vulnerability based on the code slices and the vulnerability feature library. Compared with the problems of false positives and false negatives caused by the introduction of a large amount of noise in the prior art or the high false negative rate of the model due to incomplete consideration of the influence conditions in the model training, this method completes the extraction and utilization of power IoT terminal vulnerability information based on patch information. It can accurately distinguish between normal and abnormal behavior of devices in the power IoT system, and has low complexity and low false positive rate. It is suitable for the identification of abnormal behavior of IoT devices. It can provide software developers and security industry beginners with automatic analysis and location services for existing vulnerabilities, and can also provide high-quality datasets to improve the performance of deep learning-oriented power IoT vulnerability static detection tools.

[0098] Figure 3 This diagram illustrates the structure of a device for identifying vulnerabilities in power IoT terminals according to an embodiment of the present invention. Figure 3 As shown, the device includes:

[0099] Extraction module 301 is used to extract associated information related to the vulnerability based on the vulnerability patch. For detailed explanation, please refer to the relevant descriptions in the above method embodiments; they will not be repeated here.

[0100] The determination module 302 is used to determine the target patch dataset based on the association information. For detailed explanations, please refer to the relevant descriptions in the above method embodiments; they will not be repeated here.

[0101] The classification module 303 is used to determine the vulnerability triggering situation based on the target patch dataset, and to classify the common permission list types in the target patch dataset to obtain a vulnerability feature library covering multiple common permission list types with vulnerability triggering situation as the classification feature. For detailed explanations, please refer to the relevant descriptions in the above method embodiments, which will not be repeated here.

[0102] The identification module 304 is used to identify key variables of the vulnerability based on the difference file obtained by comparing the vulnerable file and the non-vulnerable file, and to generate and extract code slices. For detailed explanations, please refer to the relevant descriptions in the above method embodiments, which will not be repeated here.

[0103] The identification module 304 is further configured to identify the trigger points and reference points of vulnerabilities based on the code slices and the vulnerability feature library. For detailed explanations, please refer to the relevant descriptions in the above method embodiments; they will not be repeated here.

[0104] The device for identifying power Internet of Things (IoT) terminal vulnerability information provided in this embodiment of the invention is used to execute the power IoT terminal vulnerability information identification method provided in the above embodiment. Its implementation method and principle are the same. For details, please refer to the relevant description of the above method embodiment, which will not be repeated here.

[0105] Figure 4 A computer device according to an embodiment of the present invention is shown, such as Figure 4 As shown, the computer device may include a processor 401 and a memory 402, wherein the processor 401 and the memory 402 may be connected via a bus or other means. Figure 4 Taking the example of a connection between China and Israel via a bus.

[0106] Processor 401 may be a central processing unit (CPU). Processor 401 may also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations thereof.

[0107] The memory 402, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the methods provided in the embodiments of the present invention. The processor 401 executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions, and modules stored in the memory 402, thereby implementing the methods in the above-described method embodiments.

[0108] The memory 402 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor 401, etc. Furthermore, the memory 402 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 402 may optionally include memory remotely located relative to the processor 401, and these remote memories may be connected to the processor 401 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0109] One or more modules are stored in memory 402 and, when executed by processor 401, perform the methods described in the above method embodiments.

[0110] The specific details of the aforementioned computer equipment can be understood by referring to the relevant descriptions and effects in the above method embodiments, and will not be repeated here.

[0111] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0112] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for identifying vulnerability information in power Internet of Things (IoT) terminals, characterized in that, include: Based on the vulnerability patch, extract related information associated with the vulnerability; The target patch dataset is determined based on the aforementioned association information; Based on the target patch dataset, the vulnerability triggering situation is determined, and the common permission list types in the target patch dataset are classified to obtain a vulnerability feature library covering multiple common permission list types with the vulnerability triggering situation as the classification feature. Based on the difference files obtained by comparing the vulnerable files and the non-vulnerable files, the key variables of the vulnerability are identified, and code slices are generated and extracted. Based on the code slices and the vulnerability signature database, the trigger points and reference points of the vulnerabilities are identified; The process of identifying key variables of the vulnerability based on a difference comparison between the vulnerable file and the non-vulnerable file, and generating and extracting code slices, includes: Determine the format of the difference file; Based on the format of the difference file, an advanced merging format is used to process the difference file and the patch file to extract the key variables of the vulnerability; Based on the difference file, dependency files are obtained, and multiple code analysis tool diagrams are generated based on the dependency files; Based on the multiple code analysis tool graphs and the key variables, a set of key nodes is generated by traversing all points of interest. Code slices are generated and extracted based on the set of key nodes to obtain code slice files.

2. The method according to claim 1, characterized in that, The vulnerability-based patch extraction of associated information related to the vulnerability includes: To locate the function containing the patch code for the vulnerability, search upwards for the function name of the function containing the code as the starting position of the code slice, and search downwards for the end character of the function as the ending position of the slice. Analyze the characteristics of the difference files by comparing the vulnerable files and the non-vulnerable files to obtain patch feature information; Track control flow changes triggered by patches to determine the location where vulnerabilities are triggered; Obtain information about the flow of data along the program execution path; Perform forward and backward data flow and control flow analysis on the patch across functions to obtain the patch's cross-function information.

3. The method according to claim 1, characterized in that, The step of determining the target patch dataset based on the association information includes: A patch dataset containing vulnerability source code and corresponding patching code is pre-built. The patch dataset includes patch-related difference files, vulnerability files, and vulnerability patching files. Based on the associated information, query the patch dataset for patch-related difference files, vulnerability files, and vulnerability patching files to determine the target patch dataset.

4. The method according to claim 3, characterized in that, The process involves determining vulnerability triggering conditions based on the target patch dataset and categorizing the common permission list types within the target patch dataset to obtain a vulnerability feature library covering multiple common permission list types, categorized by vulnerability triggering conditions. This library includes: Based on the common permission list in the target patch dataset, the triggering conditions of the vulnerability are determined according to different common permission list types; Based on the triggering conditions of the vulnerabilities, the general permission list types are categorized to obtain a vulnerability feature library covering multiple general permission list types with vulnerability triggering conditions as the classification feature. The vulnerability feature library includes the features of vulnerability triggering points and the features of vulnerability referencing points.

5. The method according to claim 1, characterized in that, The identification of vulnerability trigger points and reference points based on the code slices and the vulnerability signature database includes: Obtain matching information for the vulnerability lines from the code slice file, and generate the target code slices required for the matching information according to the modification blocks; Based on the common permission list type in the vulnerability feature library to which the vulnerability belongs, the corresponding rules are matched in the target code slice to obtain a set of candidate vulnerability trigger points for specified key variables; For each candidate vulnerability trigger point, a corresponding candidate vulnerability introduction point is matched.

6. The method according to claim 1, characterized in that, After identifying the trigger points and reference points of vulnerabilities based on the code slices and the vulnerability signature database, the method further includes: The vulnerability signature database is expanded, and the vulnerability matching rules based on vulnerability signatures are updated.

7. A device for identifying vulnerabilities in power Internet of Things (IoT) terminals, characterized in that, include: The extraction module is used to extract associated information related to the vulnerability based on the vulnerability patch; The determination module is used to determine the target patch dataset based on the associated information; The classification module is used to determine the vulnerability triggering situation based on the target patch dataset, and classify the common permission list types in the target patch dataset to obtain a vulnerability feature library covering multiple common permission list types with the vulnerability triggering situation as the classification feature. The identification module is used to identify key variables of the vulnerability based on the difference file of the vulnerability file and the non-vulnerable file by comparing the differences; and to generate and extract code slices. The identification module is also used to identify the trigger point and reference point of the vulnerability based on the code slice and the vulnerability feature library; The identification module is also used to determine the format of the difference file; based on the format of the difference file, an advanced merging format is used to process the difference file and the patch file to extract the key variables of the vulnerability; Based on the difference file, obtain the dependency file, and generate multiple code analysis tool graphs based on the dependency file; based on the multiple code analysis tool graphs and the key variables, traverse all points of interest to generate a set of key nodes; Code slices are generated and extracted based on the set of key nodes to obtain code slice files.

8. The apparatus according to claim 7, characterized in that, The extraction module is also used to locate the function where the patch code for the vulnerability is located, search upwards for the function name of the function where the code is located as the starting position of the code slice, and search downwards for the end character of the function as the ending position of the slice; analyze the characteristics of the difference file compared with the vulnerable file and the non-vulnerable file to obtain patch feature information; Track control flow changes triggered by patches to determine the location where vulnerabilities are triggered; obtain information about data flow along the program execution path; perform forward and backward data flow and control flow analysis on patches across functions to obtain cross-function information of patches.

9. The apparatus according to claim 7, characterized in that, The determining module is also used to pre-build a patch dataset containing vulnerability source code and corresponding patching code, wherein the patch dataset includes patch-related difference files, vulnerability files, and vulnerability patching files; Based on the associated information, query the patch dataset for patch-related difference files, vulnerability files, and vulnerability patching files to determine the target patch dataset.

10. The apparatus according to claim 9, characterized in that, The classification module is further configured to determine the vulnerability triggering situation according to different general permission list types based on the general permission list in the target patch dataset; classify the general permission list types based on the vulnerability triggering situation to obtain a vulnerability feature library covering multiple general permission list types with vulnerability triggering situation as the classification feature, the vulnerability feature library including the features of vulnerability triggering points and the features of vulnerability referencing points.

11. The apparatus according to claim 7, characterized in that, The identification module is also used to obtain matching information of the vulnerability lines from the code slice file, and generate the target code slice required by the matching information according to the modification block; Based on the common permission list type in the vulnerability feature library to which the vulnerability belongs, the corresponding rules are matched in the target code slice to obtain a set of candidate vulnerability trigger points for specified key variables; For each candidate vulnerability trigger point, a corresponding candidate vulnerability introduction point is matched.

12. The apparatus according to claim 7, characterized in that, The classification module is also used to expand the vulnerability feature database and update the vulnerability matching rules based on vulnerability features.

13. A computer device, characterized in that, include: A processor and a memory, wherein the processor is configured to execute an identification program for power Internet of Things (IoT) terminal vulnerability information stored in the memory, to implement the power IoT terminal vulnerability information identification method according to any one of claims 1 to 6.

14. A storage medium, characterized in that, The storage medium stores one or more programs, which can be executed by one or more processors to implement the method for identifying power Internet of Things terminal vulnerability information as described in any one of claims 1 to 6.

Images