A safety detection method and system for industrial robots

Abstract

The object of the present invention is to provide a safety detection method and system for industrial robots, which can achieve tasks such as automatic firmware extraction, code preprocessing, processor identification, code restoration, structural analysis, verification, file scanning, data preprocessing, cross-reference analysis, protocol frame reconstruction, semantic extraction, formatting processing, and analysis of robot-specific protocols. The present invention can disassemble the integrated system and the robot body, analyze the security vulnerabilities of each part, construct a vulnerability theoretical model, form a unique vulnerability mining method for robots, develop a vulnerability mining tool set for industrial robots, monitor system security threats, analyze the situation, and perform perception prediction.

Description

Technical Field

[0001] The present invention relates to the technical field of safety detection, and specifically, to a safety detection method and system for industrial robots. Background Art

[0002] Industry 4.0 is the fourth industrial revolution mainly based on intelligent manufacturing, which combines traditional manufacturing technologies with Internet technologies to achieve a high degree of integration of informatization and automation, forming intelligent production manufacturing, and is a strong driving force for China to move towards a manufacturing power. The process of building and evolving Industry 4.0 in China is a process of continuous iterative development of manufacturing enterprises from informatization to industrial Internet platforms.

[0003] From the comprehensive consideration of various factors such as industry development and policy guidance, China's industrial development is in the process of consolidating the foundation for the implementation of intelligent manufacturing technologies and promoting the gradual transition of industrial digital technology innovation to the industrial Internet. In "Made in China 2025", ten key fields are defined, including the new generation of information technology industry, high-grade CNC machine tools and robots, aerospace equipment, marine engineering equipment and high-tech ships, advanced rail transit equipment, energy-saving and new energy vehicles, power equipment, agricultural machinery equipment, new materials, biomedicine and high-performance medical devices, etc. Among them, the second key field: high-grade CNC machine tools and robots, clearly states that in the field of robots, new products should be actively developed around the application requirements of industrial robots such as those in the automotive, machinery, electronics, dangerous goods manufacturing, national defense, chemical industry, light industry, etc., special robots, as well as service robots in the fields of medical health, household service, education and entertainment, etc., to promote the standardized and modular development of robots and expand market applications. Break through the technical bottlenecks such as the design and manufacturing of key components and system integration of robot bodies, reducers, servo motors, controllers, sensors and drivers, etc.

[0004] In such a general environment, in the process of implementing and comprehensively promoting intelligent manufacturing technologies, it is necessary to effectively control the new safety risks brought by new technologies during the technology implementation process. Forming a situation where development is pursued while ensuring safety and controllability is the cornerstone of a virtuous cycle of the industry ecosystem.

[0005] With the development and increasing maturity of Internet of Things, industrialization, and artificial intelligence technologies, robots are becoming fully popularized. Whether in the medical field, service field, or military war field, intelligent industrial robots will play an important role. Currently, major countries in the world are competing fiercely in this field, striving to seize the high ground in this field and form an overwhelming advantage.

[0006] As one of the core areas of intelligent manufacturing, intelligent industrial robots widely apply industrial control / Internet of Things protocols and technologies in their operating environments such as devices, firmware, and control networks. According to third-party statistical data (organizations such as CNVD), in 2021, 152 new vulnerabilities were discovered in the industrial control system industry, including 58 high-risk vulnerabilities, 82 medium-risk vulnerabilities, and 12 low-risk vulnerabilities. These vulnerabilities are distributed in the products and systems of major international and domestic industrial control manufacturers.

[0007] Regarding the existing security vulnerability issues, such as Figure 1 As shown, the existing industrial Internet security detection technology realizes the discovery, identification, understanding, analysis, response, and handling of security threats at all levels through technical means, mainly including key technologies such as security monitoring and auditing, and security situation awareness. The currently mainly used situation awareness technology adds the asset characteristics of industrial control systems and devices on the basis of a cyber space search engine, and uses software code to simulate common industrial control system services or industrial control specific protocols (such as Modbus, S7, FINS, etc.) to parse and restore the protocols at the network layer and application layer (such as industrial control specific protocols, general protocols, etc.), and complete security monitoring work such as industrial control device asset detection, industrial control vulnerability and security event identification, so as to achieve security protection for devices. However, the existing technology cannot be flexibly applied to the industrial robot control systems of various different platforms currently, and the detection effect is poor. There is an urgent need for an industrial robot security detection system with better cross-platform detection effect. Summary of the Invention

[0008] The purpose of the present invention is to provide a security detection method and system for industrial robots aiming at the defects of the existing technology, so as to realize the security detection of different industrial robot system platforms, not only can detect and identify the existing known vulnerabilities, but also can identify unknown vulnerability types, and achieve all-round security vulnerability detection.

[0009] The purpose of the present invention can be achieved by the following technical measures:

[0010] A security detection method for industrial robots, which realizes the excavation of security vulnerabilities, including the following steps:

[0011] Read the firmware information in the memories of the robot and the robot integrated application system, and the firmware information includes the file system, operating system, kernel version, encryption algorithm, and CPU instruction set of the robot and the robot integrated application system;

[0012] Perform horizontal and vertical splicing on multiple target code files, perform bitwise negation and / or byte swapping and / or byte reverse order transformation operations on specified data bits according to the actual situation, and perform code relocation according to the physical distribution parameters of the memory to restore the structural rules of the target code;

[0013] Determine the instruction set type used by the target code based on the characteristic information contained in the target code itself;

[0014] By distinguishing between firmware information and instruction sets, the firmware information is converted into a code file that can be read and further analyzed;

[0015] By analyzing the process and functional structure in the code file, the process and functional structure are expressed in the form of abstract diagrams to achieve the purpose of understanding the target code behavior and design intent;

[0016] By means of a virtual hardware environment or the hardware environment where the firmware actually works, the results of the reverse analysis are tested and verified, and the results of the reverse analysis are corrected in real time;

[0017] Scanning the industrial control software in the robot integrated application system and filtering out communication-related operations through positioning protocol analysis; the industrial control software includes configuration software;

[0018] Read the disassembled assembly code, mark the functions in the DLL, and remove functions related to the communication process;

[0019] By calling the IDC function, the cross-reference information between different protocol functions in the robot integrated application system is obtained, and the information is classified and stored. The protocol functions in the robot integrated application system are obtained, and the function types are statistically inferred from the obtained protocol functions to construct the dependency relationship of the protocol functions.

[0020] Based on the function dependencies and the inference of function types, the function code features are judged, and the protocol frames existing in the target protocol are reconstructed and classified to form a protocol frame set.

[0021] By retrieving and processing the binary codes of the fields of the protocol frame, it is determined whether there are relevant features and the semantic information of the protocol frame is extracted; redundancy is achieved by comparing the known semantics of the protocol frames in the protocol frame set, and the protocol frames in the set are formatted into protocol information, which is then output to a result file in a tabular format;

[0022] Provides a human-computer interaction interface for the conversion and processing of protocol packets in different formats. Users can convert protocol packets into target packets by searching for packet conversion rules, and also provide judgment on the completion of packet conversion.

[0023] Preferably, the firmware information in the memory of the robot and the robot integrated application system is read by a programmer to read the flash memory chip storing the firmware code and obtain the binary file in the flash memory chip; and the file system of the binary file is obtained by analyzing the binary file and the embedded system used by the binary file.

[0024] After reading the flash chip storing the firmware code through a programmer, an anti-disassembly tool is further used to convert the binary file machine code into readable object code, analyze the object code, and extract the storage rule of the object code, which includes the logical function structure of the object code.

[0025] Preferably, the step of reading the firmware information in the memory of the reading robot and the robot integrated application system further includes obtaining user operation information in the device, including identifying the operating system type of the device by extracting the device target file.

[0026] Preferably, the specific steps for identifying the operating system type of the device are as follows: stripping and parsing the firmware information, identifying the operating system type, and identifying the kernel version. Among them, the stripping and parsing of the firmware information is to read the binary firmware image of the device target file, divide the address range in combination with the module feature database, and transfer different firmware information; the identification of the operating system type is to extract the identification features of the operating system type, screen them in combination with the type identification feature library, exclude the operating systems that do not meet the screening features, and obtain the operating system type identification result according to the similarity sorting result between the screened operating system and the operating system to be identified in the firmware module; the identification of the kernel version is to use the function matching of static library functions to match the kernel to be identified with the functions of the standard kernel, and calculate the similarity between the two by using the number of function matches to identify the kernel version.

[0027] Preferably, the transfer of different firmware information is to restore the compressed file by using decompression software; and for the file system image, release the internal data of the file system according to the file system storage mechanism.

[0028] Preferably, the process of using the function matching of static library functions specifically includes: loading the kernel function library signature, performing a first match on the kernel function using the function matching method; then, for the functions that fail to match successfully, performing function structure matching through the structure matching method; finally, collecting all the functions that match successfully, calculating the similarity between the kernel to be identified and the standard kernel, and selecting the kernel with the highest similarity to the kernel to be identified in the static library function as the identification result.

[0029] Another object of the present invention is to provide a safety detection system for industrial robots, including a firmware reverse analysis subsystem and a protocol reverse processing subsystem. The firmware reverse analysis subsystem includes a firmware automatic extraction module, a code preprocessing module, a processor category identification module, a code restoration module, a structure analysis module, and a verification module; the protocol reverse processing subsystem includes a file scanning module, a data preprocessing module, a cross-reference analysis module, a protocol frame reconstruction module, a semantic extraction module, a formatting processing module, and a message conversion interface module; among them,

[0030] Firmware automatic extraction module: used to read the firmware information in the memory of the robot and the robot integrated application system, the firmware information includes the file system, operating system, kernel version, encryption algorithm, and CPU instruction set of the robot and the robot integrated application system;

[0031] Code preprocessing module: used to horizontally and vertically splice multiple target code files, perform operations such as inverting specified data bits and / or byte swapping and / or byte reverse conversion according to actual conditions, relocate the code according to the physical distribution parameters of the memory, and restore the structural rules of the target code;

[0032] Processor type identification module: used to determine the instruction set type used by the target code based on the characteristic information contained in the target code itself;

[0033] Code restoration module: used to convert firmware information into a code file that can be read and further analyzed by distinguishing between firmware information and instruction sets;

[0034] Structural analysis module: used to analyze the process and functional structure in the code file and express the process and functional structure in the form of abstract diagrams to achieve the purpose of understanding the target code behavior and design intent;

[0035] Verification module: used to test and verify the results of reverse analysis with the help of a virtual hardware environment or the hardware environment where the firmware actually works, and to correct the results of reverse analysis in real time;

[0036] File scanning module: used to scan the industrial control software in the robot integrated application system, filter out communication-related operations through positioning protocol analysis; the industrial control software includes configuration software;

[0037] Data preprocessing module: used to read the disassembled assembly code, mark the functions in the DLL, and remove functions related to the communication process;

[0038] Cross-reference analysis module: used to obtain cross-reference information between different protocol functions in the robot integrated application system by calling the IDC function, and store the information by type classification, obtain the protocol functions in the robot integrated application system, and construct the dependency relationship of the protocol functions by statistically inferring the function types of the obtained protocol functions;

[0039] Protocol frame reconstruction module: It is used to judge the function code characteristics based on the function dependency and the inference of the function type, reconstruct and classify the protocol frames in the target protocol, and form a protocol frame set;

[0040] Semantic extraction module: used to judge whether relevant features exist by retrieving the binary codes of the fields of the protocol frame, and extract the semantic information of the protocol frame;

[0041] Formatting processing module: used to achieve redundancy removal by comparing the known semantics of the protocol frames in the protocol frame set, format the protocol frames in the set into protocol information, and output the protocol information to the result file in tabular format;

[0042] Message conversion interface module: used to provide a human-computer interaction interface for the conversion processing of protocol message data packets in different formats. The user converts the protocol message into a target message by searching for message conversion rules, and at the same time provides a judgment on the completion of message conversion.

[0043] The present invention has the following advantages compared with the prior art:

[0044] The method of the present invention can realize the disassembly of the integrated system and the robot body, analyze the security vulnerabilities of each part, construct a vulnerability theory model, form a unique vulnerability mining method for robots, develop a vulnerability mining tool set for industrial robots, monitor system security threats, analyze the situation and perform perception prediction. The software system provided by the present invention supports docking with the industrial robot test bed, and can realize the overall development, debugging, trial operation, acceptance and warranty service of the software system. Description of the drawings

[0045] Figure 1 is the conventional method and development of the existing industrial Internet security detection technology;

[0046] Figure 2 is the module diagram of the security detection system for industrial robots of the present invention. Specific implementation manners

[0047] The present invention provides a security testing method and system for industrial robots. In order to ensure the convenience and maintainability of the overall system, a UI interface for unified scheduling and centralized management of each sub-function is constructed at the overall system level, and the overall framework design and function presentation of the industrial robot security testing system are realized.

[0048] A security detection method for industrial robots, which realizes the mining of security vulnerabilities, includes the following steps:

[0049] Read the firmware information in the memories of the robot and the robot integrated application system, where the firmware information includes the file system, operating system, kernel version, encryption algorithm, and CPU instruction set of the robot and the robot integrated application system;

[0050] Splice multiple target code files horizontally and vertically, perform inversion and / or byte swapping and / or byte reverse operations on specified data bits according to actual conditions, relocate the code according to the physical distribution parameters of the memory, and restore the structural rules of the target code;

[0051] Determine the instruction set type used by the target code based on the characteristic information contained in the target code itself;

[0052] By distinguishing between firmware information and instruction sets, the firmware information is converted into a code file that can be read and further analyzed;

[0053] By analyzing the process and functional structure in the code file, the process and functional structure are expressed in the form of abstract diagrams to achieve the purpose of understanding the target code behavior and design intent;

[0054] By means of a virtual hardware environment or the hardware environment where the firmware actually works, the results of the reverse analysis are tested and verified, and the results of the reverse analysis are corrected in real time;

[0055] Scanning the industrial control software in the robot integrated application system and filtering out communication-related operations through positioning protocol analysis; the industrial control software includes configuration software;

[0056] Read the disassembled assembly code, mark the functions in the DLL, and remove functions related to the communication process;

[0057] By calling the IDC function, the cross-reference information between different protocol functions in the robot integrated application system is obtained, and the information is classified and stored. The protocol functions in the robot integrated application system are obtained, and the function types are statistically inferred from the obtained protocol functions to construct the dependency relationship of the protocol functions.

[0058] Based on the function dependencies and the inference of function types, the function code features are judged, and the protocol frames existing in the target protocol are reconstructed and classified to form a protocol frame set.

[0059] By retrieving and processing the binary codes of the fields of the protocol frame, it is determined whether there are relevant features and the semantic information of the protocol frame is extracted; redundancy is achieved by comparing the known semantics of the protocol frames in the protocol frame set, and the protocol frames in the set are formatted into protocol information, which is then output to a result file in a tabular format;

[0060] Provides a human-computer interaction interface for the conversion and processing of protocol packets in different formats. Users can convert protocol packets into target packets by searching for packet conversion rules, and also provide judgment on the completion of packet conversion.

[0061] Preferably, the firmware information in the memory of the reading robot and the robot integrated application system is specifically obtained by a programmer reading the flash chip storing the firmware code to acquire the binary file in the flash chip; and the file system of the binary file is obtained by analyzing the binary file and the embedded system used by the binary file.

[0062] After reading the flash chip storing the firmware code by the programmer, the machine code of the binary file is further converted into readable object code by using a disassembling tool, and the object code is analyzed to extract the storage rule of the object code, and the storage rule of the object code includes the logical function structure of the object code.

[0063] Preferably, the steps of reading the firmware information in the memory of the reading robot and the robot integrated application system further include obtaining the user operation information in the device, including identifying the operating system type of the device by the extracted device target file.

[0064] Preferably, the specific steps of identifying the operating system type of the device are as follows: stripping and parsing the firmware information, identifying the operating system type and identifying the kernel version. Among them, the stripping and parsing of the firmware information is to read the binary firmware image of the device target file, divide the address range in combination with the module feature database, and transfer different firmware information; the identification of the operating system type is to extract the identification features of the operating system type, screen in combination with the type identification feature library, exclude the operating systems that do not meet the screening features, and obtain the operating system type identification result according to the similarity sorting result between the screened operating system and the operating system to be identified in the firmware module; the identification of the kernel version is to use the function matching of the static library function to match the kernel to be identified with the functions of the standard kernel, and calculate the similarity between the two by using the number of function matches to identify the kernel version.

[0065] Preferably, the transfer of different firmware information is for compressed files, and a decompression software is used for restoration; and for the file system image, the internal data of the file system is released according to the file system storage mechanism.

[0066] Preferably, the process of using the function matching of the static library function specifically includes: loading the kernel function library signature, performing a first match on the kernel function by using the function matching method; then, for the functions that fail to match successfully, performing function structure matching by using the structure matching method; finally, collecting all the functions that match successfully, calculating the similarity between the kernel to be identified and the standard kernel, and selecting the kernel with the highest similarity to the kernel to be identified in the static library function as the identification result.

[0067] Another object of the present invention is to provide a safety detection system for industrial robots, such as Figure 2As shown, it includes a firmware reverse analysis subsystem and a protocol reverse processing subsystem, wherein the firmware reverse analysis subsystem includes a firmware automatic extraction module, a code preprocessing module, a processor category identification module, a code restoration module, a structure analysis module, and a verification module; the protocol reverse processing subsystem includes a file scanning module, a data preprocessing module, a cross-reference analysis module, a protocol frame reconstruction module, a semantic extraction module, a formatting processing module, and a message conversion interface module; wherein,

[0068] Firmware automatic extraction module: used to read the firmware information in the memory of the robot and the robot integrated application system, the firmware information includes the file system, operating system, kernel version, encryption algorithm, and CPU instruction set of the robot and the robot integrated application system;

[0069] Code preprocessing module: used to horizontally and vertically splice multiple target code files, perform operations such as inverting specified data bits and / or byte swapping and / or byte reverse conversion according to actual conditions, relocate the code according to the physical distribution parameters of the memory, and restore the structural rules of the target code;

[0070] Processor type identification module: used to determine the instruction set type used by the target code based on the characteristic information contained in the target code itself;

[0071] Code restoration module: used to convert firmware information into a code file that can be read and further analyzed by distinguishing between firmware information and instruction sets;

[0072] Structural analysis module: used to analyze the process and functional structure in the code file and express the process and functional structure in the form of abstract diagrams to achieve the purpose of understanding the target code behavior and design intent;

[0073] Verification module: used to test and verify the results of reverse analysis with the help of a virtual hardware environment or the hardware environment where the firmware actually works, and to correct the results of reverse analysis in real time;

[0074] File scanning module: used to scan the industrial control software in the robot integrated application system, filter out communication-related operations through positioning protocol analysis; the industrial control software includes configuration software;

[0075] Data preprocessing module: used to read the disassembled assembly code, mark the functions in the DLL, and remove functions related to the communication process;

[0076] Cross-reference analysis module: used to obtain cross-reference information between different protocol functions in the robot integration application system by calling IDC functions, classify and store the information by type, obtain the protocol functions in the robot integration application system, infer the function types by statistically analyzing the obtained protocol functions, and construct the dependency relationships of the protocol functions;

[0077] Protocol frame reconstruction module: used to judge the function code characteristics with reference to the function dependency relationships and the inference of function types, reconstruct and classify the protocol frames existing in the target protocol to form a protocol frame set;

[0078] Semantic extraction module: used to judge whether there are relevant features by retrieving and processing the binary codes of the fields of the protocol frames, and extract the semantic information of the protocol frames;

[0079] Formatting processing module: used to achieve redundancy removal by comparing the known semantics of the protocol frames in the protocol frame set, format the protocol frames in the set into protocol information, and output the protocol information to the result file in tabular format;

[0080] Message conversion interface module: used to provide a human-computer interaction interface for converting and processing protocol message data packets in different formats. The user can convert the protocol message into a target message by searching for message conversion rules, and at the same time provide a judgment on the completion of message conversion.

[0081] The present invention adopts technical means to test and evaluate the security protection objects at all levels of the industrial Internet, understand their security status, and thus enhance the protection ability, mainly including technical means such as vulnerability scanning, vulnerability mining, penetration testing, etc. In the industrial Internet, it is necessary to adopt the thinking of vulnerability mining in the IT and OT integrated environment and apply a variety of deeply integrated vulnerability mining technologies. The penetration testing technology also needs to detect and evaluate the network system security of the industrial Internet by simulating the attack means and methods commonly used by malicious attackers from outside the network according to the security protection requirements and the characteristics of the security protection objects of the industrial Internet.

[0082] In order to ensure its security, the present invention conducts continuous automated / semi-automated industrial control vulnerability mining and verification for aspects such as firmware code, dedicated protocols, and data parsing, captures and analyzes various attack behaviors and characteristics against industrial control networks and robot devices, which is beneficial to formulating more effective defense measures for industrial control systems according to different types of attack traffic.

[0083] The method and its system platform provided by the present invention can support firmware automatic extraction, code preprocessing, processor identification, code restoration, structure analysis, and verification. It can implement tasks such as file scanning, data preprocessing, cross-reference analysis, protocol frame reconstruction, semantic extraction, formatting processing, robot-specific protocol analysis, test case generation, anomaly detection and analysis, data sending, distorted data, logging, data receiving, data parsing, data forwarding, message conversion, test task management, and test result management. The system supports the detection and identification of known vulnerabilities in typical vulnerability libraries such as CVE and CNNVD, and supports vulnerability mining for at least 10 unknown vulnerability types such as stack overflow, heap overflow, and integer overflow.

[0084] The implementation manners of the present invention are not limited thereto. On the premise of the above basic technical idea of the present invention, various other forms of modifications, substitutions, or changes made to the content of the present invention according to the common general knowledge and customary means in the art all fall within the scope of the protection of the rights of the present invention.

Claims

1. A safety detection method for industrial robots, characterized in that The steps include: Reading firmware information from the memory of the robot and the robot integrated application system; Splice multiple target code files horizontally and vertically, perform inversion and / or byte swapping and / or byte reverse operations on specified data bits according to actual conditions, relocate the code according to the physical distribution parameters of the memory, and restore the structural rules of the target code; Determine the instruction set type used by the target code based on the characteristic information contained in the target code itself; By distinguishing between firmware information and instruction sets, the firmware information is converted into a code file that can be read and further analyzed; By analyzing the process and functional structure in the code file, the process and functional structure are expressed in the form of abstract diagrams; By means of a virtual hardware environment or the hardware environment where the firmware actually works, the results of the reverse analysis are tested and verified, and the results of the reverse analysis are corrected in real time; Scan the industrial control software in the robot integrated application system, analyze the positioning protocol, and filter out communication-related operations; Read the disassembled assembly code, mark the functions in the DLL, and remove functions related to the communication process; By calling the IDC function, the cross-reference information between different protocol functions in the robot integrated application system is obtained, and the information is classified and stored. The protocol functions in the robot integrated application system are obtained, and the function types are statistically inferred from the obtained protocol functions to construct the dependency relationship of the protocol functions. Based on the function dependencies and the inference of function types, the function code features are judged, and the protocol frames existing in the target protocol are reconstructed and classified to form a protocol frame set. By retrieving and processing the binary codes of the fields of the protocol frame, it is determined whether there are relevant features and the semantic information of the protocol frame is extracted; redundancy is achieved by comparing the known semantics of the protocol frames in the protocol frame set, and the protocol frames in the set are formatted into protocol information, which is then output to a result file in a tabular format; Provides a human-computer interaction interface for the conversion and processing of protocol packets in different formats. Users can convert protocol packets into target packets by searching for packet conversion rules, and also provide judgment on the completion of packet conversion.

2. The security detection method according to claim 1, wherein: The reading of firmware information in the memory of the robot and the robot integrated application system is specifically performed by reading a flash memory chip storing the firmware code through a programmer to obtain a binary file in the flash memory chip; By analyzing the binary file and the embedded system used by the binary file, the file system of the binary file is obtained.

3. The security detection method according to claim 2, wherein: After the programmer reads the flash memory chip storing the firmware code, a disassembly tool is used to convert the binary file machine code into a readable target code, and the target code is analyzed to extract the target code storage rules, which include the target code logical function structure.

4. The security detection method according to claim 3, wherein: The step of reading the firmware information in the memory of the robot and the robot integrated application system also includes obtaining user operation information in the device, including identifying the type of operating system running the device through the extracted device target file.

5. The safety detection method according to claim 4, wherein: The specific steps for the recognition device to run the operating system type are as follows: strip and parse the firmware information, recognize the operating system type, and recognize the kernel version. Among them, the stripping and parsing of the firmware information is to read the binary firmware image of the device target file, divide the address range in combination with the module feature database, and transfer different firmware information; the recognition of the operating system type is to extract the recognition features of the operating system type, screen them in combination with the type recognition feature library, exclude the operating systems that do not meet the screening features, and obtain the operating system type recognition result according to the similarity sorting result between the screened operating system and the operating system to be recognized in the firmware module; the recognition of the kernel version is to use the function matching of static library functions to match the kernel to be recognized with the functions of the standard kernel, and calculate the similarity between the two by using the number of function matches to recognize the kernel version.

6. The security detection method according to claim 5, wherein: The transfer of different firmware information is to restore the compressed file by using decompression software; and for the file system image, release the internal data of the file system according to the file system storage mechanism.

7. The security detection method according to claim 6, characterized in that: The process of using the function matching of static library functions specifically includes: loading the kernel function library signature, performing a primary match on the kernel function using the function matching method; then, for the functions that fail to match successfully, performing function structure matching through the structure matching method; finally, collecting all the functions that match successfully, calculating the similarity between the kernel to be recognized and the standard kernel, and selecting the kernel with the highest similarity to the kernel to be recognized in the static library functions as the recognition result.

8. The security detection method according to any one of claims 1-7, characterized in that: The firmware information includes the file system, operating system, kernel version, encryption algorithm, and CPU instruction set of the robot and the robot integrated application system.

9. The security detection method according to any one of claims 1-7, characterized in that: The industrial control software includes configuration software.

10. A safety detection system for industrial robots, characterized in that: It includes a firmware reverse analysis subsystem and a protocol reverse processing subsystem. The firmware reverse analysis subsystem includes a firmware automatic extraction module, a code preprocessing module, a processor category recognition module, a code restoration module, a structure analysis module, and a verification module; the protocol reverse processing subsystem includes a file scanning module, a data preprocessing module, a cross-reference analysis module, a protocol frame reconstruction module, a semantic extraction module, a formatting processing module, and a message conversion interface module; among them, Firmware automatic extraction module: used to read the firmware information in the memory of the robot and the robot integrated application system, and the firmware information includes the file system, operating system, kernel version, encryption algorithm, and CPU instruction set of the robot and the robot integrated application system; Code preprocessing module: used to splice multiple target code files horizontally and vertically, perform bitwise inversion and / or byte swapping and / or byte reverse order transformation operations on specified data bits according to the actual situation, perform code relocation according to the physical distribution parameters of the memory, and restore the structural rules of the target code; Processor category recognition module: used to determine the instruction set type used by the target code according to the feature information contained in the target code itself; Code restoration module: used to convert the firmware information into a code file that can be read and further analyzed by distinguishing the firmware information and the instruction set; Structural analysis module: used to analyze the process and functional structure in the code file and express the process and functional structure in the form of abstract diagrams to achieve the purpose of understanding the target code behavior and design intent; Verification module: used to test and verify the results of reverse analysis with the help of a virtual hardware environment or the hardware environment where the firmware actually works, and to correct the results of reverse analysis in real time; File scanning module: used to scan the industrial control software in the robot integrated application system, filter out communication-related operations through positioning protocol analysis; Data preprocessing module: used to read the disassembled assembly code, mark the functions in the DLL, and remove functions related to the communication process; Cross-reference analysis module: used to obtain cross-reference information between different protocol functions in the robot integrated application system by calling the IDC function, and store the information by type classification, obtain the protocol functions in the robot integrated application system, and construct the dependency relationship of the protocol functions by statistically inferring the function types of the obtained protocol functions; Protocol frame reconstruction module: It is used to judge the function code characteristics based on the function dependency and the inference of the function type, reconstruct and classify the protocol frames in the target protocol, and form a protocol frame set; Semantic extraction module: used to retrieve and process the binary codes of the fields of the protocol frame to determine whether there are relevant features and extract the semantic information of the protocol frame; Formatting processing module: used to remove redundancy by comparing known semantics of protocol frames in the protocol frame set, formatting the protocol frames in the set into protocol information, and outputting the protocol information to a result file in a table format; Message conversion interface module: used to provide a human-computer interaction interface for the conversion and processing of protocol message data packets in different formats. Users can convert protocol messages into target messages by searching for message conversion rules, and provide judgment on the completion of message conversion.

Images