Method and related device for automatic detection and repair of vulnerabilities of smart home device tap rules

Abstract

The application discloses a method for automatically detecting and repairing vulnerabilities of smart home device TAP rules and related devices, which comprises the following steps: extracting device and TAP rule original information from an Internet of Things platform configuration file, screening devices and rules participating in rule interaction model construction; based on the screened devices and rules participating in rule interaction model construction, a rule interaction model is established; a rule interaction abstract model is established; an updated rule interaction model counterexample is analyzed, the feasibility of a vulnerability repair measure is proved, and the vulnerability repair of the rule interaction model is realized. The application extracts original information from an Internet of Things platform configuration file to establish a formalized model of rule interaction, thereby performing model detection according to detection attributes, and then reasoning out a vulnerability repair space from the rule model based on a detected counterexample. The system utilizes a formalized method to design a counterexample-guided model abstraction and anti-attribute reasoning repair space generation mechanism, thereby realizing automatic generation of rule defect repair measures.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of intelligent home vulnerability automatic detection and repair, and particularly relates to an intelligent home device TAP rule vulnerability automatic detection and repair method and related device. BACKGROUND

[0002] With the development of artificial intelligence, big data, 5G technology and cloud computing, the Internet of Things (IoT) intelligent home industry has gained tremendous development space. The rapid growth of intelligent home user number has driven the rapid growth of the number of intelligent devices connected to the Internet of Things, opening up a new era of intelligent Internet of Things + intelligent home. With the continuous improvement of users' requirements for home life quality, their demand for home device automation is becoming more and more common. Therefore, a TAP (Trigger-Action Programming) user programming framework is widely used in many intelligent home platforms (such as Apple HomeKit, Samsung SmartThings, Xiaomi Mi Home, Midea Meijia and Tiaozao Intelligence), which provides automation services for users through the setting of TAP rules.

[0003] Home device automation based on TAP rules enables users to easily control intelligent devices according to their own wishes and achieve rich interaction between devices, but also makes the interaction between devices and TAP rules more complex, which may cause unexpected security threats to users. Since most users lack security expertise, TAP rule interaction vulnerabilities are common during rule setting. Existing methods mostly focus on the research of vulnerability detection methods, which usually achieve rule interaction vulnerability detection through model detection or symbolic execution, ignoring the importance of rule interaction vulnerability repair. At the same time, due to the existence of complex information such as delay and environment attribute sharing, although TAP rules are simple and easy to understand, the Internet of Things intelligent home system containing TAP rules is very complex, greatly increasing the difficulty of vulnerability detection and repair. SUMMARY

[0004] The present application aims to provide an intelligent home device TAP rule vulnerability automatic detection and repair method and related device to solve the problem of complex Internet of Things intelligent home system containing TAP rules, which greatly increases the difficulty of vulnerability detection and repair.

[0005] To achieve the above-mentioned purpose, the present application adopts the following technical solutions:

[0006] In the first aspect of the present application, an intelligent home device TAP rule vulnerability automatic detection and repair method is provided, comprising:

[0007] Extracting device and TAP rule original information from the Internet of Things platform configuration file, screening devices and rules participating in the rule interaction model construction;

[0008] Based on the screened devices and rules participating in the rule interaction model construction, combined with the time delay, environment attribute sharing, and device state uncertainty characteristics of the Internet of Things smart home system, a rule interaction model is established, and the rule model vulnerability is detected based on rule interaction model detection;

[0009] Based on the physical space constraints of rule interaction model counterexample information and vulnerability repair measures, the state space of the rule model at the configuration and rule semantic level is abstracted, and the model state space is optimized to establish a rule interaction abstract model.

[0010] Analyze the rule interaction model counterexample, construct the LTL logic expression of the target security attribute counter-attribute, execute model abstraction and counter-attribute model detection to generate a vulnerability repair space; analyze the updated rule interaction model counterexample, prove the feasibility of the vulnerability repair measures, and realize the vulnerability repair of the rule interaction model.

[0011] Optionally, the device information includes device ID, device name, device function, and device belonging to home area; the rule information includes trigger condition set, state condition set, and action set, and the form of the rule information set is as follows:

[0012] R=TxCxA, (1)

[0013] Wherein, T represents the trigger condition set; C represents the state condition set; A represents the action set.

[0014] A rule element r in the rule information set R i is composed of rule configuration and rule semantics; the rule configuration refers to the specific configuration value of an event or a device in the rule, and the rule semantics refers to the abstract template of the configuration of an event or a device in the rule, and the rule information set is established in the following form:

[0015] R=R C xR S , (2)

[0016] Wherein, R C represents the rule configuration information set; R S represents the rule semantic information set, according to the composition of a rule, the rule configuration information set is established in the following form:

[0017] R C =T C xC C xA C , (3)

[0018] Wherein, TC represents the rule configuration information set in the trigger condition set; C C represents the rule configuration information set in the state condition set; A C represents the rule configuration information set in the action set; according to the composition of a rule, the rule semantic information set is established in the following form:

[0019] R S = T S × C S × A S , (4)

[0020] wherein, T S represents the rule semantic information set in the trigger condition set; C S represents the rule semantic information set in the state condition set; A S represents the rule semantic information set in the action set; according to the description of the trigger condition, the state condition, and the action, they are respectively established in the following form:

[0021] T = T C × T S , (5)

[0022] C = C C × C S , (6)

[0023] A = A C × A S , (7)

[0024] Based on the above form description, the rule configuration information and the rule semantic information are extracted from the trigger condition, the state condition, and the action set, to obtain the corresponding set.

[0025] Optionally, the devices and rules participating in the rule interaction model construction are screened:

[0026] 1) define a screening device set D, and the initial element is the device related to the security attribute in the device information set; if the initial set is empty, the system is irrelevant to the current security attribute, and the following steps are not needed;

[0027] 2) the influence relationship of the device is defined as follows: for the rule r i , if the trigger condition in r i contains the device d i , and the action contains the device d j , then d i influences d j ; traverse the TAP rule, and iteratively add the devices influencing the elements in the screening device set D until there is no new device influencing the devices in the screening device set D;

[0028] 3) Iterate through the TAP rules again and add the rules related to the device set D to the model.

[0029] Optionally, establish a rule-based interaction model:

[0030] 1) System-related attributes are defined as state machine variables, and the range of variables is the range of values ​​corresponding to the devices in the device information set. The state modeling during the construction of the smart home system model is the initial state set I.

[0031] 2) State transition function From a single TAP rule r k The transformation involves modeling the triggering and state conditions of the TAP rule as state transition conditions t. k ( i )∧c k ( i In the absence of TAP rule triggering, an environment variable with a value that varies randomly within a certain range is defined and modeled as an environment predicate E. k ( i The action modeling of the TAP rule is a k ( i );

[0032] 3) Starting from the initial state, based on Perform state transitions to generate a finite set S of all states in the automaton;

[0033] 4) Delay modeling: Each delay in the rule defines a corresponding timer variable, with the initial value being the delay time. When the state changes from the current state to another state, the timer variable value is decremented by one. When the timer variable is decremented to zero, the delay associated with that timer variable in the rule has been completed.

[0034] 5) Environmental attribute sharing modeling: If two rules r i and r j The associated device and environmental attributes have an intersection, and for each environmental attribute in the intersection of environmental attributes, the rule r in the device intersection is... i The device's execution can affect the environmental attributes, and the rules r in the device intersection set... j If the device can detect the value of this environmental attribute, then rule r i and r j Share this environment attribute;

[0035] 6) Uncertainty modeling of equipment state: If the current state satisfies the triggering conditions and state conditions of multiple rules, then nondeterministic modeling is performed, and the next state is set to be non-unique, with selectable values ​​being all values ​​involved in the corresponding rule.

[0036] Optionally, the vulnerability of the rule interaction model is detected based on the rule interaction model detection:

[0037] The LTL property of the application security attribute is applied to detect the existence of the vulnerability in the rule interaction model, and the rule interaction model counterexample path information is recorded.

[0038] Optionally, the rule interaction abstract model is established:

[0039] 1) Vulnerability positioning: set a step variable step i , where i represents the i-th non-reception state starting from the initial state, a sub-state sequence is constructed, and the initial value is the initial state; through the step variable step i , the attribute values of the first i states of this model are kept the same as the corresponding state attribute values in the sub-state sequence, ensuring that the abstracted state space contains the non-reception state that may be the cause of the vulnerability; each abstraction process starts from the next non-reception state of the sub-state sequence, and the starting state of the current abstraction is added to the sub-state sequence after the abstraction ends; if the current is in the iterative process after the counterexample analysis of the abstract model and the repair measure is included in P X , the generalization method in path abstraction is applied to generalize the normal execution path, and such normal paths are excluded in the subsequent iteration process;

[0040] 2) Rule configuration level abstraction of state space: define symbolic variables, replace the specific values of T C , C C , A C with symbolic values, and add the symbolized T C , C C to all attributes except environmental attributes as the trigger conditions and state conditions of A C ; at the same time, optimize the state space of the configuration abstract model; in the model configuration abstraction process, the value compression is performed and the values near the original configuration value are preferentially selected;

[0041] 3) Rule semantic level abstraction of state space: define a rule semantic abstraction predicate set , where i represents the i-th round of rule semantic abstraction iteration; the initial rule semantic abstraction predicate set is the entity attribute attrib1,...,ttrib n corresponding to the rule semantic of the safety attribute φ(attrib1,...,ttrib n ) appearing in the first round of rule semantic abstraction; Wherein i represents the i-th round of rule semantic abstraction iteration; the more the elements of the model state space constitute, the larger the space range is, and the more abstract the space is, and the state space of the first round of semantic abstraction is the most abstract; if the analysis results of the first round of rule interaction model counterexample and the subsequent iteration of the abstract model counterexample are that the current state space is too abstract, then new rule semantic abstraction predicates are added as follows to increase the abstract space refinement guided by counterexamples: the state conditions corresponding to the attributes and entities in the current system in the rule are combined as new rule semantic abstraction predicates, and the commonly used and uncommon state information and state information-action semantic combinations are obtained by N-Gram statistical analysis method as new rule semantic abstraction predicates; at the same time, the state space of the semantic abstraction model is optimized, and part of the predicates are excluded according to the safety properties; the commonly used and uncommon predicates obtained by the N-Gram statistical analysis method also reduce the number of abstractions; according to the commonality of different rule interaction vulnerability types, corresponding constraint templates are generated and applied to the abstraction process.

[0042] Optionally, the vulnerability repair of the rule interaction model is implemented:

[0043] The anti-property detection rule interaction abstraction model of the safety property is applied to analyze the differences between the rule interaction abstraction model counterexample and the original rule in the rule configuration and rule semantic level, generate possible rule interaction vulnerability repair spaces by using the anti-property reasoning, and verify the feasibility of the repair measures in the repair spaces to generate vulnerability repair measures with feasibility:

[0044] 1) Single state unconditional and entity state must occur class safety property defines the global must satisfy relationship of single entity state, and its LTL expression is G(state); this kind of anti-property finds the case that single entity state exists in each state of the system, and the corresponding LTL logic implementation is the whole negation, and its LTL logic expression is described as:

[0045]

[0046] 2) Multi-state unconditional and entity state must occur class safety property defines the relationship that multiple entity states must satisfy at a time, and its LTL expression is This kind of anti-property finds the case that multiple entity states satisfy the corresponding relationship, and the corresponding LTL logic implementation is the whole negation, and its LTL logic expression is described as:

[0047]

[0048] 3) Multi-state unconditional and entity state never occurs class safety property defines the relationship that multiple entity states never satisfy at a time, and its LTL expression is The corresponding LTL logic implementation is the overall negation, and the LTL logic expression is described as:

[0049] F(state1 ^... ^ state n )→(state

[0050] 4) Multi-state conditional and existing entity state must occur class safety property defines multiple entity states in the current or next time period must satisfy the relationship, the current time period satisfies the relationship LTL expression is G((1 ^... ^ state n )→( )), the next time period satisfies the relationship LTL expression is G((1 ^... ^ state n )→X(state)) ; This kind of anti-property looks for the case when state1,state2,...,tate n satisfy at the same time, state in the current or next state satisfies, the corresponding LTL logic implementation is to negate the state part, the rest remains unchanged; The LTL logic expression of the current state satisfying the relationship is described as:

[0051]

[0052] The LTL logic expression of the next state satisfying the relationship is described as:

[0053]

[0054] 5) Live property class safety property defines the execution integrity of the delay related rule, and its LTL expression is G((1 ^... ^ state n )→F(state)) ; Its anti-property looks for the case when state1,state2,...,tate n trigger the rule, state in the after state satisfies, the corresponding LTL logic implementation is to negate the state part, the rest remains unchanged, and the LTL logic expression is described as:

[0055]

[0056] Based on the above anti-property generation method, the anti-property of the safety property is applied Detection rule interaction abstract model Iteratively extract the counterexample information of the abstract model under the anti-property model detection, and form a solution space for repairing the TAP rule interaction vulnerability. The repair measures in the solution space include three types, which are described as:

[0057] P=P C ∪P I ∪PX , (19)

[0058] wherein, P C represents a set of vulnerability repair measures with accuracy and globality and operability; P I represents a set of vulnerability repair measures without accuracy and globality; P X represents a set of vulnerability repair measures with accuracy and globality but without operability;

[0059] Firstly, the inverse property of the security property is applied The rule interaction abstract model is detected The counterexample information is generated as the basis for the existence of the vulnerability repair measure; if the vulnerability repair measure does not exist, it indicates that the model state space is too abstract, and the abstract refinement guided by the counterexample is returned; if the vulnerability repair measure exists, the repair measure is applied to update the original rule interaction model, and the security property phi is applied to verify the accuracy and globality of the repair measure in the original system If the updated model counterexample exists and the specified number of iterations is not reached, it indicates that the repair fails this time, and the repair measure is classified into P I , and the abstract refinement step is returned for the next round of iteration; if the updated model counterexample exists and the specified number of iterations is reached, it indicates that the repair of the rule interaction vulnerability in the current system cannot be achieved through model abstraction only; if the updated model counterexample does not exist, the operability is judged based on the above solution space description, and the feasible rule interaction vulnerability repair measure is screened: 1) if the repair measure involves properties that the smart home system cannot control or involves normal execution trajectories of devices under the original rules, the repair measure does not have operability, and is classified into P x , and the abstract refinement step is returned for the next round of iteration; 2) if the repair measure passes the above condition judgment, the repair measure has operability, and is classified into P C , which is the final feasible vulnerability repair measure.

[0060] In the second aspect of the present application, an automatic vulnerability detection and repair system for smart home device TAP rules is provided, comprising:

[0061] An information extraction module is configured to extract device and TAP rule original information from an Internet of Things platform configuration file, and screen devices and rules participating in rule interaction model construction;

[0062] A rule interaction model detection module is configured to establish a rule interaction model based on the screened devices and rules participating in rule interaction model construction, in combination with the characteristics of the Internet of Things smart home system such as time delay, environment attribute sharing, and device state uncertainty, and detect the vulnerability of the rule model based on the rule interaction model detection;

[0063] The rule interaction model abstract module is used for abstracting the state space of the rule model at the configuration and rule semantic level based on the rule interaction model counterexample information and the physical space constraint of the vulnerability repair measure, optimizing the model state space, and establishing the rule interaction abstract model.

[0064] The repair generation module of the counterproperty reasoning is used for analyzing the rule interaction model counterexample, constructing the LTL logic expression of the counterproperty of the target security property, performing the model abstraction and the model detection of the counterproperty to generate the vulnerability repair space, analyzing the updated rule interaction model counterexample, proving the feasibility of the vulnerability repair measure, and realizing the vulnerability repair of the rule interaction model.

[0065] In a third aspect, the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the vulnerability automatic detection and repair method of the TAP rule of the smart home device when executing the computer program.

[0066] In a fourth aspect, the present application provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program implements the steps of the vulnerability automatic detection and repair method of the TAP rule of the smart home device when executed by a processor.

[0067] Compared with the prior art, the present application has the following technical effects:

[0068] The present application extracts original information from the configuration file of the Internet of Things platform to establish a formalized model of rule interaction, performs model detection according to the detection attribute, and then reasons out the vulnerability repair space from the rule model based on the detected counterexample. The system uses a formalized method to design a counterexample-guided model abstraction and a repair space generation mechanism of counterproperty reasoning, thereby realizing the automatic generation of rule defect repair measures, integrating a formalized model construction method of various smart home system characteristics of the Internet of Things, realizing the comprehensive characterization of rules in the physical space and the information space, and improving the model construction integrity.

[0069] The present application establishes a rule interaction model in combination with different rule interaction types, realizes the detection of interaction vulnerabilities among various rules, and improves the comprehensiveness of vulnerability detection.

[0070] The present application designs a model defect repair method of counterproperty reasoning, thereby realizing the automatic repair of the automatic TAP rule interaction vulnerability of the smart home device at the rule configuration and rule semantic level, ensuring the accuracy and globality of the repair measures, and providing an accurate and comprehensive vulnerability repair scheme for the smart home user. BRIEF DESCRIPTION OF DRAWINGS

[0071] Figure 1 The present application is a flowchart.

[0072] Figure 2 This is a system structure diagram of the present invention. Detailed Implementation

[0073] The architecture of this invention is as follows Figure 1 As shown, this rule interaction vulnerability detection and remediation system can automatically extract device and rule information from IoT platform configuration files, then construct a rule interaction model to detect rule interaction vulnerabilities. Subsequently, it generates a vulnerability remediation space through rule interaction model abstraction guided by counterexamples and model analysis using reverse attribute reasoning. Finally, it confirms the remediation of rule interaction vulnerabilities by updating the rule interaction model and detecting the updated model. This invention uses the smart home rules of the Home Assistant open-source home automation platform as the implementation object, ensuring that the method of this invention is applicable to single-ecosystem and multi-ecosystem interconnected smart home systems.

[0074] The specific implementation of this invention includes the following steps:

[0075] Step 1: Automatic extraction of original equipment and rule information.

[0076] Since smart home users may not use devices from the same manufacturer, which involves cross-platform control of smart devices, this invention takes Home Assistant, a mainstream IoT open-source platform that currently supports multi-ecosystem interconnection, as an example to establish an automatic extraction method for device and rule original information.

[0077] This step automatically extracts raw information about devices and rules from the IoT platform to further generate modeling information. First, this step integrates and extracts raw information about devices and rules through the IoT platform to generate a set of device information and a set of rule information for the current IoT smart home system. Device information consists of device ID, device name, device function, and the home area to which the device belongs. Rule information consists of a set of trigger conditions, a set of state conditions, and a set of actions. The rule information set is described in the following form:

[0078] R = T × C × A, (1)

[0079] Where T represents the set of triggering conditions; C represents the set of state conditions; and A represents the set of actions. A rule r in the rule information set R. i The rule consists of three parts: triggering conditions (composed of events or state transitions), state conditions (composed of Boolean constraints on one or more states), and the actions to be performed. Based on the above rule description, this step extracts the triggering conditions, state conditions, and action sets from the IoT platform's rule configuration file and establishes a one-to-one relationship between rules and corresponding sets. On the other hand, a rule element r in the rule information set R... iThe rule information set is composed of rule configuration and rule semantics. The rule configuration is the specific configuration value of a certain event or a certain device in the rule, and the rule semantics is the abstract template of the configuration of a certain event or a certain device in the rule. Therefore, the rule information set can be established in the following form:

[0080] R = R C × R S , (2)

[0081] wherein R C represents the rule configuration information set; and R S represents the rule semantics information set. According to the composition of a rule, the rule configuration information set can be established in the following form:

[0082] R C = T C × C C × A C , (3)

[0083] wherein T C represents the rule configuration information set in the trigger condition set; C C represents the rule configuration information set in the state condition set; and A C represents the rule configuration information set in the action set. According to the composition of a rule, the rule semantics information set can be established in the following form:

[0084] R S = T S × C S × A S , (4)

[0085] wherein T S represents the rule semantics information set in the trigger condition set; C S represents the rule semantics information set in the state condition set; and A S represents the rule semantics information set in the action set. According to the description of the trigger condition, the state condition, and the action, they are respectively established in the following form:

[0086] T = T C × T S , (5)

[0087] C = C C × C S , (6)

[0088] A = A C × A S , (7)

[0089] Based on the above form description, the step extracts rule configuration information and rule semantic information from trigger conditions, state conditions, and action sets, to obtain corresponding sets.

[0090] The IoT smart home entity includes devices and the environment in which the devices are located. The system describes the state of the entity through attributes, which are described in the form of attrib i According to the time required to switch the state of the attribute, the attribute is divided into instantaneous attributes and delayed attributes. The state switching of an instantaneous attribute is completed instantaneously. The state switching of a delayed attribute takes a certain period of time to complete and cannot be completed instantaneously. The safety attribute specifies the relationship between the attributes in the IoT smart home system to avoid conflicts and ensure the safety of the smart home system, which is described as φ (attrib1,..., attrib n ). The safety attribute is divided into three categories according to the number of entity states involved and the conditionality: single-state unconditional, multi-state unconditional, and multi-state conditional. Each type of safety attribute is divided into two categories according to the occurrence of the entity state: must occur and never occur. According to the operation rules of LTL logic, the must occur and never occur of the entity state in the single-state unconditional and multi-state conditional safety attributes are equivalent at the LTL logic level, and the corresponding LTL expressions can be converted to each other. Therefore, this step selects four types of safety attributes: single-state unconditional and existence of entity state must occur, multi-state unconditional and existence of entity state must occur, multi-state unconditional and existence of entity state never occur, and multi-state conditional and existence of entity state must occur. In addition, this step selects the live attribute related to the delay as the fifth type of safety attribute.

[0091] This step models the selection of devices and rules in units of each safety attribute, and generates modeling information of devices and rules by the following method: 1) define a filtered device set D, whose initial elements are the devices related to the safety attribute in the device information set. If the initial set is empty, the system is not related to the current safety attribute, and the following steps are not needed; 2) the influence relationship of the device is defined as follows: for a rule r i , if the trigger condition of r i contains a device d i , and the action contains a device d j , then d i influences d j . Traverse the TAP rules, and iteratively add devices that affect the elements in the filtered device set D until there are no new devices that affect the devices in the filtered device set D; 3) traverse the TAP rules again, and add the rules related to the filtered device set D to the modeling.

[0092] Step 2: Construction of the rule interaction model.

[0093] This step combines the characteristics of the Internet of Things smart home system, such as time delay, environment attribute sharing, and device state uncertainty, to establish the non-deterministic finite automata (NFA) of the system and construct the rule interaction model.

[0094] In the non-deterministic finite automata, there can be multiple possible next states for each state. The formal description of the non-deterministic finite automata model in the smart home application scenario is as follows:

[0095]

[0096] where S is the finite set of all states in the automata; is the initial state set of the model; ∑ is the state transition function set. The automata state s i ∈ S represents the running status of the Internet of Things smart home system at a certain time, which consists of attributes and attribute configuration values. The state transition function determines the transition of the automata from the current state to other states. Each state of the automata can be converted to one or more states, and its formal description is as follows:

[0097] where s j = k ( i )(9)

[0098] If the current automata state s i can activate the trigger condition and state condition predicate of the rule r k (t k ( i )∧c k ( i ) is true) or the external natural environment changes to activate the environment predicate (E k ( i ) is true), the model will execute the action a k of r k , and transition from the current state s i to the next state s j , i.e., a k ( i ); if the corresponding predicate cannot be activated, the current state remains unchanged, i.e., the next state is still the state s i itself.

[0099] The IoT smart home system is composed of three parts: the perception layer, the network layer, and the application layer, which are interrelated and work cooperatively. In the actual running environment, the interaction between the layers makes the system have the following three representative characteristics: 1) delay. The delay in the smart home system comes from two aspects: platform and delay attribute. Platform delay refers to the rule execution delay defined by the platform and the polling time required for device interaction. The TAP rule related to the delay attribute cannot complete the action execution when the trigger condition and the state condition are met. It takes a certain period of time from the trigger condition and the state condition being met to the completion of the action execution; 2) environment attribute sharing. If a TAP rule in the smart home system acts on an environment attribute, the rule may affect the original execution of the rule when interacting with other rules acting on the same environment attribute; 3) device state uncertainty. The IoT smart home system belongs to a non-deterministic system. A device may receive multiple instructions with action conflicts at the same time, resulting in multiple next states and making it impossible to determine the final state.

[0100] Based on the above automaton and IoT smart home system characteristic description, the safety attributes, device and rule modeling information are input, and the rule interaction model is constructed as follows: 1) the system-related attributes are defined as state machine variables, and the variable range is the value range of the corresponding device in the device information set. The state modeling during the construction of the smart home system model is the initial state set I; 2) the state transition function is defined as k is transformed. The trigger condition and the state condition of the TAP rule are modeled as state transition conditions k ( i )∧c k ( i ). In the absence of TAP rule triggering, the environment variable with random changes in a certain range is defined as the environment predicate k ( i ). The action of the TAP rule is modeled as k ( i ); 3) starting from the initial state, the state is transferred based on to generate a finite set of all states S in the automaton; 4) delay modeling: each delay in the rule defines a corresponding timer variable, and the initial value is the value time of the delay. When the state is transferred from the current state to another state, the timer variable value is decremented by one. When the timer variable is decremented to zero, the delay related to the timer variable in the rule is executed; 5) environment attribute sharing modeling: if the devices and environment attributes associated with two rules i and j have an intersection, and for each environment attribute in the intersection of environment attributes, the device intersection of the rules iThe device's execution can affect the environmental attributes, and the rules r in the device intersection set... j If the device can detect the value of this environmental attribute, then rule r i and r j Share the environmental attribute. Define the relevant environmental attribute of the current system as the corresponding environmental variable. When the environmental attribute sharing rule is triggered, set the value of its next state to the common impact of the action execution on the environmental attribute; 6) Modeling the uncertainty of device state: If the current state meets the triggering conditions and state conditions of multiple rules, perform nondeterministic modeling, set the next state to be non-unique, and the selectable value is all the values ​​involved in the corresponding rule.

[0101] Through the above steps, a rule-based interaction model is constructed that combines the characteristics of IoT smart home systems, such as latency, shared environmental attributes, and uncertain device states.

[0102] Step 3: Detection of rule interaction vulnerabilities.

[0103] This step applies the LTL attribute of the security properties to detect the existence of vulnerabilities in the rule interaction model and records the counterexample path information of the rule interaction model.

[0104] In an IoT smart home system, an execution path under rule-based interaction corresponds to a state sequence in an automaton model. This sequence consists of a series of automaton states and state transition function pairs, and its formal description is as follows:

[0105]

[0106] The state space contains all possible execution states of the current system. Based on the above execution path description, its form is as follows:

[0107]

[0108] Automata-based LTL Model Checking: Constructing the global inverse property of LTL attribute φ Automata The state space of this automaton consists of model execution paths that violate attributes. Analysis and the system model to be detected Does the state space have a common execution path (i.e., determine)? If the value is empty, it indicates that the model violates the LTL property φ, and this common execution path is a counterexample of the model violating the LTL property φ. A counterexample is an execution path that violates the LTL property φ, and its form is described as follows:

[0109]

[0110] Based on the above LTL model detection description, this step first applies the LTL property φ of the safety property to detect whether there is a vulnerability in the rule interaction model If the model counterexample does not exist, the current smart home system satisfies the safety property, and there is no rule interaction vulnerability. If the model counterexample exists, the current smart home system violates the safety property, and there is a rule interaction vulnerability.

[0111] The accepting state is the termination state of the execution path of the automaton, and the execution path is in a state of stagnation in the accepting state node. A execution path can be accepted by the automaton if and only if the path passes through the accepting state infinitely many times, so the counterexample path contains The accepting state. In the Internet of Things smart home system, the counterexample path CEX i contains The accepting state contains the counterexample path CEX i and the Craig interpolation of the LTL property φ it violates, which represents The accepting state is the direct cause of the execution path violating the safety property φ, and is called the defect state. Based on the above defect state description, this step excludes the accepting state of the automaton in the counterexample path, and records the entity state contained in each non-accepting state of the automaton.

[0112] Step 4: Counterexample-guided rule interaction model abstraction.

[0113] This step is based on the rule interaction model and the subsequent iterative abstract model counterexample analysis, iteratively abstracting the rule configuration and rule semantic level state space of the model, while optimizing the model state space, and establishing an abstract model of rule interaction.

[0114] Because the rule interaction of the current smart home system has a vulnerability, the state space of the rule interaction model does not contain the execution after the vulnerability is repaired. At the same time, because the smart devices, environmental attributes of the current smart home system, and the TAP rules involved in the model construction are fixed and unchanged, the state space of the current rule interaction model is unchanged. Therefore, the rule interaction vulnerability repair idea of the present application is to abstract the state space of the current model, and the abstracted state space may contain the execution after the vulnerability is repaired, which may contain information related to repair measures. The vulnerability repair measure generation problem is converted into a counterexample path analysis problem in the abstracted state space that may contain repair measure information.

[0115] The abstraction of a model interaction model is the abstraction of its state space. Based on the description of state space, the abstraction of state space is equivalent to increasing the number of execution paths contained in the state space. Based on the description of execution paths, increasing the execution paths is equivalent to increasing the state s i and state transition function The repair of a rule interaction vulnerability does not increase new devices and the environmental properties in the system are fixed, so the abstraction of state space depends on the abstraction of state transition function The abstracted state set is transformed from the original state set according to the state transition function Based on the description of state transition function and rule interaction model construction, a k ( i ) and t k ( i ) ∧ c k ( i ) are the determinants of state transition function a k ( i ) and t k ( i ) ∧ c k ( i ) depend on the TAP rule trigger condition, state condition, and action configuration T C , C C , A C and trigger condition, state condition, and action semantics T S , C S , A S . Therefore, the abstraction of a model interaction model is equivalent to the abstraction of the TAP rule configuration information and the rule semantic information level.

[0116] Counterexamples show how rule interaction vulnerabilities occur, but do not show the causes of rule interaction vulnerabilities. By analyzing the Craig interpolation of counterexample path CEX i and the LTL property φ it violates, the defect state (Violating State) that causes the vulnerability can be obtained. By calculating the Craig interpolation of the defect state before the last action a k i ​The weakest precondition of the rule can be obtained by the rule interaction vulnerability. However, due to the existence of the delay attribute, each non-receiving state in the counterexample path may be the trigger point of the delay TAP rule, resulting in the rule conflict with other rules in the rule interaction. Therefore, the rule interaction vulnerability obtained by analyzing the weakest precondition is not necessarily the root cause of the vulnerability and the first place to avoid conflicts. At the same time, due to the wide range of variable values, the complex relationship between variables, and the abstraction of the model state space in the Internet of Things smart home system, the rapid growth of the state space leads to the problem of space explosion, which greatly reduces the speed of model detection.

[0117] Based on the above description, the step abstracts the state space as follows:

[0118] 1) Vulnerability positioning: set a step variable step i , where i represents the i-th non-receiving state starting from the initial state. A sub-state sequence is constructed, and the initial value is the initial state. By step variable step i , the attribute values of the first i states of the model are kept the same as the corresponding state attribute values in the sub-state sequence, ensuring that the abstracted state space contains the non-receiving states that may be the cause of the vulnerability. Each abstraction process starts from the next non-receiving state of the sub-state sequence, and the starting state of the current abstraction is added to the sub-state sequence after the abstraction is completed. If the current is in the iteration process after the counterexample analysis of the abstraction model and the repair measure is included in P X , the generalization method in path abstraction is applied to generalize the normal execution path, and such normal paths are excluded in the subsequent iteration process;

[0119] 2) Abstract the rule configuration level of the state space: define symbolic variables and replace the specific values of T C , C C , A C with symbolic values, and add the symbolized T C , C C to all attributes except the environment attribute as the trigger condition and state condition of A C . At the same time, optimize the state space of the configuration abstraction model. Since the user's configuration setting has a certain rationality, during the model configuration abstraction process, the value can be compressed and the value near the original configuration value is selected as a priority; for the rule trigger condition that judges the size relationship, if one side relationship configuration abstraction is not feasible, the other side relationship is selected for abstraction; due to the certain change range of the environment attribute, control the configuration abstraction within the change range each time;

[0120] 3) Abstract the rule semantic level of the state space: define the rule semantic abstraction predicate set Where i represents the i-th iteration of the rule semantic abstraction iteration. The initial set of rule semantic abstraction predicates is the entity attributes attrib1,...,ttrib n that the safety property φ(attrib1,...,ttrib n corresponds to in the first iteration of rule semantic abstraction The semantic abstraction model is defined as Where i represents the i-th iteration of the rule semantic abstraction iteration. The more elements the model state space consists of, the larger the space range is, and the more abstract the space is. The state space of the first iteration of semantic abstraction is the most abstract. If the analysis results of the first iteration of rule interaction model counterexample and the subsequent iterations of abstract model counterexample are that the current state space is too abstract, new rule semantic abstraction predicates are added as follows to refine the abstract space guided by counterexamples: Since the actual impact of the operation rule trigger condition is large, only the state conditions corresponding to the attributes in the rule and the entities in the current system are considered to be combined as new rule semantic abstraction predicates, and the commonly used and uncommon state information and state information-action semantic combinations obtained by the N-Gram statistical analysis method are used as new rule semantic abstraction predicates. At the same time, the state space of the semantic abstraction model is optimized. According to the safety properties, some predicates are excluded; the commonly used and uncommon predicates obtained by the N-Gram statistical analysis method also reduce the number of abstractions; and according to the commonalities of different rule interaction vulnerability types, corresponding constraint templates are generated and applied to the abstraction process.

[0121] Step 5: Generation and optimization of rule interaction vulnerability repair space.

[0122] This step is based on the vulnerability repair mechanism based on counter-property reasoning proposed in the present application, and the rule interaction abstraction model is detected by applying the counter-property of the safety property. The differences between the rule interaction abstraction model counterexample and the original rule in the rule configuration and rule semantic level are analyzed, the possible rule interaction vulnerability repair space is generated by using the counter-property reasoning, the feasibility of the repair measures in the repair space is verified, and the vulnerability repair measures with feasibility are generated.

[0123] The counter-property is a model detection property obtained by reversing the safety property as a whole or in part, and generates information that may contain repair measures. The whole reversal takes the negation of the safety property predicate as a whole to generate the whole counter-property, which is described as (All-negated Property). The partial reversal takes the negation of part of the individual words of the safety property predicate to generate the partial counter-property, which is described as (Partial-negated Property). Based on the above counter-property description, the safety property is converted into a counter-property LTL logical expression as follows to generate the abstract model detection property in this step:

[0124] 1) Single-state unconditional and existing entity state must occur class safety property defines the global must satisfy the relationship of a single entity state, its LTL expression is G(state). This kind of anti property looks for the case that a single entity state exists in each state of the system, and the corresponding LTL logic implementation is the overall negation, and its LTL logic expression is described as:

[0125]

[0126] 2) Multi-state unconditional and existing entity state must occur class safety property defines the relationship that multiple entity states must satisfy at a certain time, and its LTL expression is This kind of anti property looks for the case that multiple entity states satisfy the corresponding relationship, and the corresponding LTL logic implementation is the overall negation, and its LTL logic expression is described as:

[0127]

[0128] 3) Multi-state unconditional and existing entity state never occurs class safety property defines the relationship that multiple entity states never satisfy at a certain time, and its LTL expression is This kind of anti property looks for the case that multiple entity states do not satisfy the corresponding relationship, and the corresponding LTL logic implementation is the overall negation, and its LTL logic expression is described as:

[0129] F(state1∧...∧state n ),(15)

[0130] 4) Multi-state conditional and existing entity state must occur class safety property defines the relationship that multiple entity states must satisfy in the current or next time period, and the LTL expression for the current time period to satisfy the relationship is G((1∧...∧state n )→( )), and the LTL expression for the next time period to satisfy the relationship is G((1∧...∧state n )→X(state)). This kind of anti property looks for the case that state1,state2,...,tate n satisfy at the same time, and state satisfies in the current or next state. The corresponding LTL logic implementation is to negate the state part, and the rest remains unchanged. The LTL logic expression for the current state to satisfy the relationship is described as:

[0131]

[0132] The LTL logic expression for the next state to satisfy the relationship is described as:

[0133]

[0134] 5) Live properties class security properties define the execution integrity of delay-related rules, whose LTL expression is G((1 A... A state n )→F(state)). Its anti-property seeks state1,state2,...,tate n After triggering the rule, the state satisfies the case after the state, and the corresponding LTL logic implementation is to negate the state part, and the rest remains unchanged, and its LTL logic expression is described as:

[0135]

[0136] Based on the above anti-property generation method, the anti-property of the security property is applied Detecting rule interaction abstract model Iteratively extract counterexample information of the abstract model under the anti-property model detection, and form a solution space for repairing the TAP rule interaction vulnerability, which is a set of possible vulnerability repair measures. The feasibility of the rule vulnerability repair measure includes the accuracy, globality, and operability of the repair. The accuracy of the repair refers to the vulnerability repair measure that can repair the current vulnerability. The globality of the repair refers to the repair measure that can repair other vulnerabilities in the system with the same vulnerability cause. The operability of the repair refers to the fact that each component of the repair measure can be implemented by the current smart home system. Therefore, the repair measures in the solution space may include three types, which can be described in form as:

[0137] P=P C ∪P I ∪P X , (19)

[0138] Among them, P C represents a set of vulnerability repair measures with accuracy and globality and operability; P I represents a set of vulnerability repair measures without accuracy and globality; P X represents a set of vulnerability repair measures with accuracy and globality but without operability.

[0139] The repair space generation method based on anti-property reasoning first applies the anti-property of the security property Detecting rule interaction abstract model Generate counterexample information as the basis for the existence of vulnerability repair measures. If the vulnerability repair measure does not exist, it indicates that the model state space is too abstract, and step 5 is returned to perform abstract refinement guided by counterexamples. If the vulnerability repair measure exists, the original rule interaction model is updated by applying the repair measure, and the security property φ is applied to verify the accuracy and globality of the repair measure in the original system ). If the updated model counterexample exists and the specified number of iterations is not reached, it means that this repair fails, and the repair measure is classified into P I , and the next round of iteration is returned to step 5. If the updated model counterexample exists and the specified number of iterations is reached, it means that the repair of the rule interaction vulnerability in the current system cannot be achieved only by model abstraction. If the updated model counterexample does not exist, based on the above description of the solution space, the operability of the rule interaction vulnerability repair measure is judged, and the feasible repair measure is screened: 1) if the repair measure involves properties that the smart home system cannot control or involves the normal execution trajectory of the device under the original rule, the repair measure does not have operability, and it is classified into P X , and the next round of iteration is returned to step 5; 2) if the repair measure passes the above condition judgment, the repair measure has operability, and it is classified into P C , which is the final feasible vulnerability repair measure.

[0140] Effect example:

[0141] Consider the following smart home scenario: the user's home has the following smart devices: temperature and humidity sensor, human sensor, smoke sensor, smart light, smart window, smart alarm, smart fan.

[0142] In order to realize smart home automation, the following 5 TAP rules are set:

[0143] 1) IF smoke sensor detects smoke, THEN smart alarm alarms;

[0144] 2) IF smoke sensor detects smoke, THEN open smart window for 15 min and then close;

[0145] 3) IF smoke sensor detects smoke, THEN open smart fan for 15 min and then close;

[0146] 4) IF indoor environment is humid, THEN open smart fan for 10 min and then close;

[0147] 5) IF user comes home, THEN open smart light.

[0148] Consider the safety property φ: the window should be in a closed state when it rains.

[0149] After extracting the original information of the device and the rule, the screening of the modeling device and the rule is performed, and the modeling information is generated. For the safety property φ "the window should be in a closed state when it rains", the screened modeling device is the smart window, and the screened modeling rule is TAP rule 2. After generating the modeling information, the rule interaction model is constructed The LTL logical expression "G((weather.rain=raining)->X(window.switch=close))" of φ is applied to detect the rule interaction vulnerability The rule interaction of the current system is detected to violate the safety property, and the information is as follows:

[0150] "--specification G((weather.rain=raining)->X(window.switch=close)) is false".

[0151] Analyze the counterexample information, and the conflict state is located in the fourth state of the counterexample sequence. Set the step variable to 4 to ensure that the abstracted state space contains the non-receiving state that may be the cause of the vulnerability. Generate the initial predicate set from the safety property The set elements are weather.rain and window.switch. Abstract the rule interaction model Generate the first round of iteration abstract model based on semantic and configuration level information Apply the counter property The LTL logical expression "G((weather.rain=raining)->!X(window.switch=close))" of φ is applied to generate vulnerability repair space information The information is as follows:

[0152] "--specification G((weather.rain=raining)->!X(window.switch=close)) is false".

[0153] Analyze the counterexample information, and execute the generation and optimization of the vulnerability repair space, including excluding the normal execution trajectory of the attribute or device that the smart home system cannot control under the original rule, and unreasonable predicate combination, to generate the repair rule p1: IF the smoke sensor detects smoke WHILE it is not raining, THEN open the smart window for 15 minutes and close it. Apply the repair rule p1 to update the original rule interaction model, and apply φ to verify the accuracy and globality of the repair measure The verification result shows that the repair measure needs to be further abstracted, and the information is as follows:

[0154] "--specification G((weather.rain=raining)->X(window.switch=close)) is false".

[0155] The first round of counter property reasoning is completed, and then the iteration is performed according to the above method to generate the abstract model Generating and optimizing vulnerability fix space Generating vulnerability fix rules p i Verification in the original system Until the third round of iteration, the repair measures make the rule interaction no longer violate the safety property, and the generated information is as follows:

[0156] "-- specification G((weather.rain=raining)->X(window.switch=close)) is true".

[0157] The vulnerability repair for the safety property φ is completed, and the generated vulnerability repair rules are: 1) IF it rains, THEN close the smart window; 2) IF the smoke sensor detects smoke WHILE it is not raining, THEN open the smart window for 15 minutes and then close it. The TAP rules after adding the repair rules are:

[0158] 1) IF the smoke sensor detects smoke, THEN the smart alarm alarm;

[0159] 2) IF the smoke sensor detects smoke WHILE it is not raining, THEN open the smart window for 15 minutes and then close it;

[0160] 3) IF the smoke sensor detects smoke, THEN open the smart fan for 15 minutes and then close it;

[0161] 4) IF the indoor environment is humid, THEN open the smart fan for 10 minutes and then close it;

[0162] 5) IF the user comes home, THEN open the smart light;

[0163] 6) IF it rains, THEN close the smart window.

[0164] In another embodiment of the application, a vulnerability automatic detection and repair system for smart home device TAP rules is provided, which can be used to implement the vulnerability automatic detection and repair method for smart home device TAP rules as described above. Specifically, the system comprises:

[0165] An information extraction module for extracting device and TAP rule original information from an Internet of Things platform configuration file, and screening devices and rules participating in rule interaction model construction;

[0166] A rule interaction model detection module for establishing a rule interaction model based on the screened devices and rules participating in rule interaction model construction, combining the time delay, environment attribute sharing, and device state uncertainty characteristics of the Internet of Things smart home system, and detecting the vulnerabilities of the rule model based on the rule interaction model detection;

[0167] The rule interaction model abstract module is used for abstracting the state space of the rule model at the configuration and rule semantic level based on the rule interaction model counterexample information and the physical space constraint of the vulnerability repair measure, optimizing the model state space, and establishing a rule interaction abstract model.

[0168] The repair generation module of the counter property reasoning is used for analyzing the rule interaction model counterexample, constructing the LTL logic expression of the counter property of the target security property, performing model abstraction and model detection of the counter property to generate a vulnerability repair space, analyzing the updated rule interaction model counterexample, proving the feasibility of the vulnerability repair measure, and realizing the vulnerability repair of the rule interaction model.

[0169] The division of the modules in the embodiments of the present application is illustrative, and is merely a logical function division, and another division mode can be used in actual implementation, and each function module in each embodiment of the present application can be integrated in one processor, or can be physically separated, or two or more modules can be integrated in one module. The integrated module can be realized in the form of hardware or in the form of a software function module.

[0170] In another embodiment of the present application, a computer device is provided, which includes a processor and a memory, the memory is used for storing a computer program, the computer program includes program instructions, and the processor is used for executing the program instructions stored in the computer storage medium. The processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc., which are the computing core and control core of the terminal, and are suitable for implementing one or more instructions, and are specifically suitable for loading and executing one or more instructions in the computer storage medium to implement a corresponding method flow or a corresponding function; the processor in the embodiments of the present application can be used for the operation of the vulnerability automatic detection and repair method of the TAP rule of the smart home device.

[0171] In still another embodiment of the present application, the present application also provides a storage medium, specifically a computer readable storage medium (Memory), which is a memory device in a computer device, used for storing programs and data. It can be understood that the computer readable storage medium herein can include the built-in storage medium in the computer device, and of course can also include the expansion storage medium supported by the computer device. The computer readable storage medium provides a storage space, which stores the operating system of the terminal. Moreover, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer readable storage medium herein can be a high-speed RAM memory, or a non-volatile memory such as at least one disk memory. The one or more instructions stored in the computer readable storage medium can be loaded and executed by the processor to implement the corresponding steps of the method for automatically detecting and repairing the vulnerability of the smart home device TAP rule in the above embodiments.

[0172] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) containing computer-usable program code.

[0173] The present application is described with reference to the flowcharts and / or block diagrams of the method, device (system), and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one or more flows and / or blocks Figure 1 The means for implementing the functions specified in one or more flows and / or blocks.

[0174] These computer program instructions can also be stored in a computer readable storage medium, which can guide the computer or other programmable data processing devices to work in a specific manner, so that the instructions stored in the computer readable storage medium produce a product including instruction means, which implements the functions specified in the flowcharts and / or block diagrams. Figure 1one or more processes and / or blocks Figure 1 the function specified in the one or more blocks.

[0175] These computer program instructions can also be loaded into computer or other programmable data processing devices, so that a series of operation steps are performed on the computer or other programmable data processing devices to generate computer-implemented processes, so that the instructions executed on the computer or other programmable data processing devices provide processes for implementing the flow Figure 1 one or more processes and / or blocks Figure 1 the function specified in the one or more blocks.

[0176] Finally, it should be noted that: the above examples are only used to illustrate the technical solutions of the present application, but not to limit it, although the above embodiments of the present application have been described in detail, those skilled in the art should understand: the specific embodiments of the present application can be modified or replaced by the same, without departing from the spirit and scope of the present application, any modification or equivalent replacement, which should be covered within the scope of protection of the claims of the present application.

Claims

1. A method for automatic detection and repair of vulnerabilities in TAP rules for smart home devices, characterized in that, include: Extract the original information of devices and TAP rules from the IoT platform configuration file, and filter the devices and rules that participate in the construction of the rule interaction model; Based on the selected devices and rules participating in the construction of the rule interaction model, and taking into account the characteristics of IoT smart home systems such as latency, shared environmental attributes, and uncertain device states, a rule interaction model is established, and vulnerabilities in the rule interaction model are detected based on the rule interaction model detection. Based on the physical space constraints of counterexample information and vulnerability remediation measures in the rule interaction model, the state space of the rule interaction model at the configuration and rule semantic levels is abstracted, and the model state space is optimized to establish an abstract rule interaction model. Analyze counterexamples of the rule interaction model, construct the LTL logical expression of the counter-attribute of the target security attribute, apply the counter-attribute of the security attribute to detect the rule interaction abstract model, analyze the differences between the counterexamples of the rule interaction abstract model and the original rule at the rule configuration and rule semantic level, and use counter-attribute reasoning to generate possible rule interaction vulnerability repair space. Analyze counterexamples of the updated rule interaction model to prove the feasibility of the vulnerability remediation measures and realize the vulnerability remediation of the rule interaction model; Vulnerabilities in rule-based interaction models are detected using rule-based interaction model detection as follows: The LTL attribute of the application security attribute is used to detect the existence of vulnerabilities in the rule interaction model, and the counterexample path information of the rule interaction model is recorded.

2. The method for automatic detection and repair of vulnerabilities in TAP rules for smart home devices according to claim 1, characterized in that, Device information includes device ID, device name, device function, and the home area to which the device belongs; rule information includes a set of trigger conditions, a set of status conditions, and a set of actions. The rule information set is described in the following format: in, Represents the set of triggering conditions; Represents the set of state conditions; Represents a set of actions; rule information set A rule element in It consists of two parts: rule configuration and rule semantics. Rule configuration refers to the specific configuration value of a certain event or device in a rule, while rule semantics refers to the abstract template of the configuration of a certain event or device in a rule. The rule information set is established in the following form: in, This represents a set of rule configuration information; Representing the set of semantic information for a rule, based on the composition of a rule, the rule configuration information set is established in the following form: in, This represents the set of rule configuration information in the trigger condition set; This represents the set of rule configuration information within the set of state conditions. This represents the set of rule configuration information within the action set; based on the composition of a rule, the rule semantic information set is established in the following form: in, This represents the set of rule semantic information in the triggering condition set; This represents the set of rule semantic information within the set of state conditions. This represents the set of rule semantic information within the action set; based on the triggering condition, state condition, and action description, it is established in the following forms: Based on the above formal description, rule configuration information and rule semantic information are extracted from triggering conditions, state conditions, and action sets to obtain the corresponding set.

3. The method for automatic detection and repair of vulnerabilities in the TAP rules of smart home devices according to claim 1, characterized in that, Filtering devices and rules to participate in the construction of the rule interaction model: 1) Define a set of screening devices The initial elements are the devices related to the security attribute in the device information set; if the initial set is empty, the system is not related to the current security attribute and no further steps are required. 2) The influence relationship of the equipment is defined as follows: For rules ,if The trigger conditions include the device Actions include equipment ,but Influence Iterate through the TAP rules and add them to the set of devices that affect the screening. The set of devices containing elements is filtered until no new devices affect the selection of devices. The equipment in; 3) Iterate through the TAP rules again to filter the device set. The relevant rules are incorporated into the modeling.

4. The method for automatic detection and repair of vulnerabilities in the TAP rules of smart home devices according to claim 1, characterized in that, Establish a rule-based interaction model: 1) System-related attributes are defined as state machine variables, and the range of these variables is the range of values ​​corresponding to the devices in the device information set. The state modeling during the construction of the smart home system model is based on the initial state set. ; 2) State transition function From a single TAP rule The transformation involves modeling the triggering and state conditions of TAP rules as state transition conditions. In the absence of TAP rule triggering, an environment variable with a value that varies randomly within a certain range is defined and modeled as an environment predicate. Action modeling for TAP rules is as follows: ; 3) Starting from the initial state, based on Perform state transitions to generate a finite set of all states in the automaton. ; 4) Delay modeling: Each delay in the rule defines a corresponding timer variable, with the initial value being the delay time. When the state transitions from the current state to another state, the timer variable value is decremented by one. When the timer variable is decremented to zero, the delay associated with that timer variable in the rule has been completed. 5) Environmental attribute sharing modeling: If two rules and The associated device and environmental attributes overlap, and for each environmental attribute in the environmental attribute intersection, the device intersection rules... The device's execution can affect the environmental attributes, and the rules in the device intersection are also affected. If the device can detect the value of this environmental attribute, then the rule and Share this environment attribute; 6) Uncertainty modeling of equipment state: If the current state satisfies the triggering conditions and state conditions of multiple rules, then nondeterministic modeling is performed, and the next state is set to be non-unique, with selectable values ​​being all values ​​involved in the corresponding rule.

5. The method for automatic detection and repair of vulnerabilities in the TAP rules of smart home devices according to claim 2, characterized in that, Establish a rule-based interaction abstract model: 1) Vulnerability location: Set a step size variable Where i represents the i-th non-receiving state starting from the initial state, a sub-state sequence is constructed, with its initial value being the initial state; through the step size variable... Keep the attribute values ​​of the first i states of this model the same as the corresponding state attribute values ​​in the sub-state sequence, and ensure that the abstracted state space contains the non-receiving states that may have been the cause of the vulnerability. Each abstraction process begins with the next non-receiving state in the sub-state sequence, and the starting state of this abstraction is added to the sub-state sequence after the abstraction is completed. If we are currently in the iterative process following the abstract model's counterexample analysis and the remedial measures have been included Then, the generalization method in path abstraction is applied to generalize the normal execution path, and such normal paths are excluded in subsequent iterations. 2) Abstract the state space at the rule configuration level: Define symbolic variables and use symbolic values ​​to represent the TAP rule configuration information. , , The specific value will be symbolized. , Add all attributes except environmental attributes, as The triggering conditions and state conditions; at the same time, optimize the state space of the configuration abstract model; during the model configuration abstraction process, compress the values ​​and prioritize the values ​​near the original configuration values; 3) Abstract the state space at the rule semantic level: Define a set of rule semantic abstract predicates. Where i represents the i-th round of rule semantic abstraction iteration; Initial set of rule semantic abstract predicates It is a security attribute in the first round of rule semantic abstraction Entity attributes appearing Corresponding rule semantics Define a semantic abstract model Where i represents the i-th round of rule semantic abstraction iteration; The more elements that make up the model's state space, the larger the space's scope and the more abstract the space. The state space of the first round of semantic abstraction has the highest degree of abstraction. If the analysis results of counterexamples in the first round of rule interaction model and subsequent iterations of abstract model counterexamples indicate that the current state space is too abstract, then new rule semantic abstract predicates are added to refine the abstract space guided by counterexamples, as follows: The attributes appearing in the rules and the state conditions corresponding to the entities in the current system are mutated and combined to form new rule semantic abstract predicates. Common and uncommon state information, as well as state information-action semantic combinations, are obtained through N-Gram statistical analysis and used as new rule semantic abstract predicates. Simultaneously, the state space of the semantic abstract model is optimized, excluding some predicates based on security attributes. The common and uncommon predicates obtained through N-Gram statistical analysis also reduce the number of abstractions. Based on the commonalities of different rule interaction vulnerability types, corresponding constraint templates are generated and applied to the abstraction process.

6. The method for automatic detection and repair of vulnerabilities in the TAP rules of smart home devices according to claim 1, characterized in that, Bug fixes for the rule-based interaction model: An abstract model of rule interaction for applying security attributes is used. This model analyzes the differences between counterexamples and original rules at the rule configuration and semantic levels. Anti-attribute reasoning is used to generate a potential rule interaction vulnerability remediation space. The feasibility of remediation measures within this space is then verified, resulting in feasible vulnerability remediation measures. 1) The single-state unconditional and existential entity state must occur class safety attribute defines a globally satisfyable relation for a single entity state, and its LTL expression is: This type of inverse attribute seeks situations where a single entity's state exists in all states of the system. The corresponding LTL logic implementation is a global inversion, and its LTL logic expression is described as follows: 2) The multi-state unconditional and existential entity state must occur class safety attribute defines the relationship that multiple entity states must satisfy at a certain time, and its LTL expression is: This type of inverse attribute seeks a situation where multiple entity states correspond to the same condition. The corresponding LTL logic implementation is a complete negation, and its LTL logic expression is described as follows: 3) The multi-state unconditional and existential entity state never occurs class safety attribute defines a relationship that multiple entity states never satisfy at any given time. Its LTL expression is: This type of inverse attribute search fails to satisfy the condition when multiple entity states correspond to each other. The corresponding LTL logic implementation is a global inversion, and its LTL logic expression is described as follows: 4) The multi-state conditional and entity state must occur class safety attribute defines the relationship that multiple entity states must satisfy in the current or next time period. The LTL expression for satisfying the relationship in the current time period is: The LTL expression for the relationship in the next time period is: Searching for this type of inverse attribute While satisfying, Given that the current or next state is satisfied, the corresponding LTL logic implementation is to... Partially inverted, the rest unchanged; the LTL logical expression describing the current state satisfying the relation is: The LTL logical expression for the next state satisfaction relation is described as follows: 5) Live attribute class security attributes define the execution integrity of delay-related rules, and their LTL expression is: ; Searching for its inverse properties After the rule is triggered, In the case where the state is satisfied later, the corresponding LTL logic implementation is to... Inverting some parts while keeping the rest unchanged, its LTL logical expression is described as follows: Based on the above method for generating inverse attributes, the inverse attributes of security attributes are applied. Detection rule interaction abstract model ( Iteratively extracting counterexample information from the abstract model under the inverse attribute model detection, a solution space is formed for fixing TAP rule interaction vulnerabilities. The remediation measures in the solution space include three types, formally described as follows: in, This refers to a set of vulnerability remediation measures that are accurate, comprehensive, and actionable. This refers to a set of vulnerability remediation measures that lack accuracy and comprehensiveness. This refers to a set of vulnerability remediation measures that are accurate and comprehensive but lack practical application. First, apply the inverse of the security attribute. Detection rule interaction abstract model ( If no vulnerability remediation measures exist, it indicates that the model state space is too abstract, and the abstraction refinement guided by the counterexample is returned. If a vulnerability remediation measure exists, the remediation measure is applied to update the original rule interaction model, and the security attributes are applied. Verify the accuracy and overall effectiveness of the remediation measures in the original system. If a counterexample exists in the updated model and the specified number of iterations has not been reached, the fix is ​​considered to have failed and the fix measure is classified as... The process returns to the abstraction and refinement step for the next iteration. If a counterexample to the updated model exists and the specified number of iterations has been reached, it indicates that the rule interaction vulnerability in the current system cannot be fixed solely through model abstraction. If no counterexample to the updated model exists, an operability judgment is performed based on the above solution space description to select feasible rule interaction vulnerability remediation measures. 1) If the remediation measures involve attributes that the smart home system cannot control or involve the normal execution trajectory of devices under the original rules, then the remediation measures are not feasible and should be classified as... Return to the abstract refinement step for the next iteration; 2) If the remediation measures meet the above conditions, then the remediation measures are feasible and should be classified as... This measure is the final feasible vulnerability remediation measure.

7. An automatic vulnerability detection and repair system for TAP rules of smart home devices, characterized in that, include: The information extraction module is used to extract the original information of devices and TAP rules from the IoT platform configuration file and to filter the devices and rules that participate in the construction of the rule interaction model. The rule interaction model detection module is used to establish a rule interaction model based on the selected devices and rules participating in the construction of the rule interaction model, combined with the characteristics of IoT smart home systems such as latency, shared environmental attributes, and uncertainty of device status. Based on the rule interaction model detection, vulnerabilities in the rule interaction model are detected. The rule interaction model abstraction module is used to abstract the state space of the rule interaction model at the configuration and rule semantic levels based on the physical space constraints of the rule interaction model's counterexample information and vulnerability remediation measures, while optimizing the model's state space and establishing a rule interaction abstract model. The anti-attribute reasoning repair generation module is used to analyze counterexamples of the rule interaction model, construct the LTL logical expression of the anti-attribute of the target security attribute, apply the anti-attribute of the security attribute to detect the rule interaction abstract model, analyze the differences between the counterexamples of the rule interaction abstract model and the original rules at the rule configuration and rule semantic level, and use anti-attribute reasoning to generate possible rule interaction vulnerability repair space. Analyze counterexamples of the updated rule interaction model to prove the feasibility of the vulnerability remediation measures and realize the vulnerability remediation of the rule interaction model; Vulnerabilities in rule-based interaction models are detected using rule-based interaction model detection as follows: The LTL attribute of the application security attribute is used to detect the existence of vulnerabilities in the rule interaction model, and the counterexample path information of the rule interaction model is recorded.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the automatic vulnerability detection and repair method for the smart home device TAP rules as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the automatic vulnerability detection and repair method for the smart home device TAP rules as described in any one of claims 1 to 6.

Images