Method, device, equipment and medium for directional gray box fuzz testing of power equipment firmware

Abstract

The present invention discloses a method for directional gray-box fuzz testing of power equipment firmware, which relates to the field of network and information security technology, and is used to solve the problem that existing tests are not accurate enough. The method includes the following steps: assembling binary programs and known binary vulnerability functions in firmware information to obtain intermediate representations; constructing a control flow graph; extracting semantic features and structural features of functions; performing cosine distance similarity calculation on feature vectors of binary programs and feature vectors of the binary vulnerabilities, and taking the similarity calculation result higher than a preset value as the target function; and performing directional gray-box fuzz testing on the target function through target scheduling. The present invention also discloses a device, equipment and medium for directional gray-box fuzz testing of power equipment firmware. The present invention extracts feature vectors through graph neural networks, and combines target scheduling to obtain accurate fuzzy test results.

Description

Technical Field

[0001] The present invention relates to the field of network and information security technology, and in particular to a method, device, equipment and medium for directional gray box fuzzy testing of power equipment firmware based on a multi-dimensional feature graph autoencoder. Background Art

[0002] There are many specifications and models of power terminal equipment, and various CPU architectures are used, such as ARM, MIPS, etc. Different architectures have different instruction sets, register sets and memory models. For example, the implementation of a library function on different architectures may have different memory allocation methods, resulting in vulnerabilities found on one architecture may have different manifestations on another architecture. Vulnerability mining methods for a single architecture cannot detect the same vulnerability on other architectures. In addition, some vulnerabilities may spread across architectures. For example, the AI ​​botnet in 2016, through flexible code design and support for multiple hardware platforms, enabled the vulnerability to quickly infect a large number of devices with different architectures, realizing cross-CPU architecture attacks. Therefore, the lack of support for multiple architectures is a problem that needs to be solved by today's power equipment firmware vulnerability detection methods. At the same time, when conducting vulnerability mining, the implementation of cross-CPU architectures also faces some challenges. For example, for binary codes of different architectures, static and dynamic analysis techniques need to adapt to the specific formats and encoding rules of each architecture, which increases the complexity of reverse engineering and vulnerability analysis; due to different compilation optimizations of different architectures, the same vulnerability has different manifestations on different architectures, which increases the difficulty of cross-architecture vulnerability mining.

[0003] To this end, the existing technology began to perform vulnerability detection through targeted gray-box fuzz testing. This test method is a very efficient vulnerability detection method and is currently widely used in software vulnerability detection. Traditional gray-box fuzz testing is guided by coverage and discovers more vulnerabilities by improving code coverage. In contrast, targeted gray-box fuzz testing tends to cover key code areas, and by setting basic blocks or functions with potential vulnerabilities as target locations, it gives seeds that can approach the target location more mutation opportunities, which further improves the pertinence and efficiency compared to traditional gray-box fuzz testing. However, the premise of targeted gray-box fuzz testing is to locate the target code. Due to the closed nature of the code of the power equipment firmware, it is difficult to obtain prior knowledge and difficult to locate manually. In order to improve the degree of automation of positioning, existing research considers using binary code similarity analysis to locate potential vulnerabilities in firmware. However, the existing binary code similarity analysis method still has defects, for example: only single-dimensional features are considered during feature extraction, and the features of binary code are not fully utilized, resulting in a lack of comprehensiveness in similarity analysis; due to the limitations of static analysis methods, false positive targets or even unreachable targets will inevitably appear in the positioning results, which will interfere with seed mutation and selection in fuzz testing and affect the efficiency of fuzz testing. Summary of the invention

[0004] In order to overcome the shortcomings of the prior art, one of the objects of the present invention is to provide a directed gray-box fuzz testing method for power equipment firmware, which constructs feature vectors through function extraction and then completes directed gray-box fuzz testing through a target scheduling mechanism.

[0005] One of the purposes of the present invention is achieved by the following technical solution:

[0006] A method for directional gray box fuzz testing of power equipment firmware, comprising the following steps:

[0007] Obtaining firmware information of the power terminal equipment, assembling the binary program and known binary vulnerability functions in the firmware information, and obtaining an intermediate representation;

[0008] Constructing a control flow graph of the functions of the binary program and the known binary vulnerability functions;

[0009] Extracting semantic features and structural features of the functions of the binary program and the known binary vulnerability functions, including: extracting and constructing the semantic feature vector by word embedding technology, extracting and constructing the structural feature vector by graph neural network, and splicing the semantic features and the structural features into a feature vector;

[0010] Performing cosine distance similarity calculation on the feature vector of the binary program and the feature vector of the binary vulnerability, and taking the similarity calculation result higher than a preset value as the target function;

[0011] The target function is subjected to directed grey-box fuzz testing via target scheduling with dynamically updated masking probabilities.

[0012] Furthermore, in order to support multiple CPU architectures, the binary programs and known binary vulnerability functions in the firmware information are assembled to obtain intermediate representations, including:

[0013] Converting the machine code in the binary program into assembly instructions by disassembling;

[0014] Dividing the assembly instructions into basic blocks according to the execution path of the binary program;

[0015] Establishing an intermediate representation mapping of the assembly instruction so that registers and memory accesses in the assembly instruction are converted into abstract variables and memory models in the intermediate representation;

[0016] The function calls and returns in the assembly instructions are mapped to a function call model in the intermediate representation.

[0017] Furthermore, constructing a control flow graph of the function of the binary program and the known binary vulnerability function includes:

[0018] Dividing the binary program of the intermediate representation into function-level granularity, identifying the start and end marks of the function through the intermediate representation, and obtaining a binary function in the intermediate representation as a function to be tested;

[0019] Dividing the known binary vulnerability function and the function to be tested into basic blocks;

[0020] Construct a control flow graph of the known binary vulnerability function and the function to be tested, wherein the nodes of the control flow graph represent basic blocks, and the edges represent the jump relationship between basic blocks.

[0021] Furthermore, the semantic features and structural features of the functions of the binary program and the known binary vulnerability functions are extracted, including: extracting and constructing the semantic feature vector through word embedding technology, extracting and constructing the structural feature vector through graph neural network, and splicing the semantic features and the structural features into a feature vector, including:

[0022] Construct semantic feature vectors through natural language models;

[0023] Constructing structural feature vectors through multi-dimensional feature map autoencoder model;

[0024] The semantic feature vectors and structural feature vectors of the functions of the binary program and the known vulnerability functions are concatenated to obtain a feature vector of each function.

[0025] Furthermore, the input of the multi-dimensional feature graph autoencoder model is a node feature matrix and a normalized adjacency matrix, the output is a low-dimensional representation vector, the encoder is a graph convolutional network, and the calculation of each layer of node representation satisfies:

[0026] ,

[0027] in, For the The node representation of the layer, the initial layer is the input node feature matrix , For the The weight matrix of the layer, is the adjacency matrix, is the degree matrix, the elements on the diagonal are the degree of each node, and the off-diagonal elements are 0. represents the normalization of the adjacency matrix, is the activation function, satisfying .

[0028] Furthermore, in order to measure the reconstruction effect, a loss function is added, including a reconstruction loss and a regularization term. The loss function of the multi-dimensional feature map autoencoder model includes:

[0029] The loss function of the adjacency matrix satisfies: ,in, is the element in the original adjacency matrix, is the element in the reconstructed adjacency matrix, is the positive sample weight, is the negative sample weight;

[0030] The loss function of the node feature matrix satisfies: ,in, is the number of nodes, is the first feature matrix in the original The feature vector of a node, is the first feature matrix after reconstruction The feature vector of each node;

[0031] The calculation of the regularization term satisfies: ,in, is the regularization loss coefficient, is the model parameter matrix, For model parameters The square of the norm;

[0032] Total loss function The calculation satisfies: .

[0033] Further, the target function is subjected to a directed grey-box fuzz test through target scheduling, wherein the target scheduling includes:

[0034] Through a dynamically updated masking probability The target function is shielded: when the target function is covered by the test case more than the threshold, the more times it is covered, the greater the probability of being shielded; the shielding probability The update rule satisfies the function:

[0035] ,

[0036] in, is the parameter that controls the growth rate of the shielding probability, is the number of times the target is covered, is the objective function The similarity of is the threshold, beyond which the shielding probability begins to increase with the increase in the number of coverage times.

[0037] A second object of the present invention is to provide a gray box fuzzy testing device for power equipment firmware.

[0038] The second object of the present invention is achieved by adopting the following technical solution:

[0039] A power equipment firmware directional gray box fuzz testing device, comprising:

[0040] A construction module is used to obtain firmware information of the power terminal device, assemble the binary program and the known binary vulnerability function in the firmware information to obtain an intermediate representation; and construct a control flow graph of the function of the binary program and the known binary vulnerability function;

[0041] An extraction module, used to extract semantic features and structural features of the functions of the binary program and the known binary vulnerability functions, including: extracting and constructing the semantic feature vector through word embedding technology, extracting and constructing the structural feature vector through graph neural network, and splicing the semantic features and the structural features into a feature vector;

[0042] The test module is used to perform cosine distance similarity calculation on the feature vector of the binary program and the feature vector of the binary vulnerability, and take the similarity calculation result higher than a preset value as the target function; and perform a directed gray box fuzzy test on the target function through target scheduling with dynamically updated shielding probability.

[0043] The third object of the present invention is to provide an electronic device for performing one of the objects of the invention, which includes a processor, a storage medium and a computer program, wherein the computer program is stored in the storage medium, and when the computer program is executed by the processor, the above-mentioned power equipment firmware directed gray box fuzz testing method is implemented.

[0044] A fourth object of the present invention is to provide a computer-readable storage medium for storing one of the objects of the invention, on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned power equipment firmware directed gray box fuzz testing method is implemented.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] The present invention performs similarity analysis on binary functions based on graph neural networks, and can perform comprehensive and effective function feature extraction from two dimensions in combination with semantic features and structural features, thereby realizing the positioning of target codes and binary programs in a simple and efficient manner. The test case generation is guided by calculating the cosine distance to the target, and in the fuzzy test, the fuzzer is guided by target scheduling to preferentially perform directional gray box fuzzy testing on non-false positive and non-unreachable targets, thereby improving the pertinence, effectiveness and efficiency of the fuzzy test. On the basis of supporting firmware vulnerability mining of multiple architectures, the automation level of potential vulnerability positioning is improved, and the influence of the high false positive rate of binary function similarity analysis results on the efficiency of fuzzy testing is reduced. The present invention is suitable for efficient vulnerability mining of power equipment firmware, and solves the problem that the prior art cannot support cross-CPU architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a flow chart of the method for directional gray box fuzz testing of power equipment firmware in embodiment 1;

[0048] Figure 2 is a flowchart of a control flow graph construction method of embodiment 1;

[0049] Figure 3 It is a structural block diagram of a directional gray box fuzzy testing device for power equipment firmware according to Embodiment 3;

[0050] Figure 4 It is a structural block diagram of an electronic device of the fourth embodiment. DETAILED DESCRIPTION

[0051] The present invention will be described in more detail below in conjunction with the accompanying drawings. It should be noted that the following description of the present invention with reference to the accompanying drawings is only illustrative and not restrictive. The various embodiments can be combined with each other to form other embodiments not shown in the following description.

[0052] Embodiment 1

[0053] Embodiment 1 provides a directed gray-box fuzz testing method for power equipment firmware, which aims to convert data flow instructions into corresponding word vectors as semantic features by extracting multi-dimensional features including structural features and semantic features, extract graph structure information of functions and feature vectors of nodes in the graph as structural features, and generate an adjacency matrix and a node feature matrix to represent these two features respectively, and use the two matrices as input to construct, train and use a graph autoencoder.

[0054] Please refer to Figure 1 As shown, a method for directional gray box fuzz testing of power equipment firmware is characterized by comprising the following steps:

[0055] S1. Obtain the firmware information of the power terminal device, assemble the binary program and the known binary vulnerability function in the firmware information, and obtain an intermediate representation;

[0056] S1 assembles the binary programs and known binary vulnerability functions in the firmware information to obtain an intermediate representation, including:

[0057] Converting the machine code in the binary program into assembly instructions by disassembling;

[0058] Dividing the assembly instructions into basic blocks according to the execution path of the binary program;

[0059] Establishing an intermediate representation mapping of the assembly instruction so that registers and memory accesses in the assembly instruction are converted into abstract variables and memory models in the intermediate representation;

[0060] The function calls and returns in the assembly instructions are mapped to a function call model in the intermediate representation.

[0061] Specifically, the machine code in the binary file is converted into assembly instructions through disassembly, the assembly instructions are divided into basic block level according to the execution path of the program, and then a mapping from assembly instructions to intermediate representation is established. The registers and memory accesses in the assembly code are converted into abstract variables and memory models in the intermediate representation. Finally, the function calls and returns in the assembly code are mapped to the function call model in the intermediate representation to ensure that parameter passing and return value processing conform to the conventions of the target architecture.

[0062] The intermediate representation described in S1 usually includes: abstract registers, where specific register operations are mapped to abstract variables or temporary values; a memory model, which is used to abstract memory accesses into symbolic variable representations; and a function call model, which is used to abstract calling mechanisms such as passing parameters through the stack into higher-level calling mechanisms, such as CALL func in assembly and call @func() in the intermediate representation.

[0063] The assembly instructions described by S1 include register operations, memory accesses, control flow instructions, function calls, and returns.

[0064] S2, constructing a control flow graph of the function of the binary program and the known binary vulnerability function;

[0065] Please refer to Figure 2 As shown, S2 includes:

[0066] S21, dividing the binary program in the intermediate representation into function-level granularity, identifying the start and end marks of the function through the intermediate representation, and obtaining a binary function in the intermediate representation as a function to be tested;

[0067] Specifically, the binary program is divided into function-level granularity. The function boundary is usually defined by the entry point (function start) and the exit point (function return). The start and end of the function are identified through intermediate representation instructions or markers, and the binary functions of all intermediate representation forms are obtained, that is, the functions to be tested that require similarity analysis.

[0068] In S21, the binary function is converted into an intermediate representation before being divided. In the intermediate representation, the function is defined by an explicit grammatical structure. Therefore, each function is divided into an independent block that can be analyzed or tested separately (i.e., the function to be tested). The method described in this embodiment only focuses on the function to be tested.

[0069] S22, dividing the known binary vulnerability function and the function to be tested into basic blocks;

[0070] The basic block in S22 refers to a continuous sequence of instructions in a program, with only one entry point and one exit point; the entry point and exit point of the basic block are identified by jump instructions and conditional jump instructions. The division of basic blocks belongs to conventional technical means, and the existing intermediate representation tools basically have the function of dividing intermediate blocks. This embodiment divides through the control flow graph, and the methods involved include: entry / exit analysis and sequential scanning method.

[0071] S23, constructing a control flow graph of the known binary vulnerability function and the function to be tested, wherein the nodes of the control flow graph represent basic blocks, and the edges represent the jump relationship between basic blocks.

[0072] S3, extracting semantic features and structural features of the function of the binary program and the known binary vulnerability function, including: extracting and constructing the semantic feature vector by word embedding technology, extracting and constructing the structural feature vector by graph neural network, and splicing the semantic features and the structural features into a feature vector;

[0073] S3 specifically includes:

[0074] Construct semantic feature vectors through natural language models;

[0075] Constructing structural feature vectors through multi-dimensional feature map autoencoder model;

[0076] The semantic feature vectors and structural feature vectors of the functions of the binary program and the known vulnerability functions are concatenated to obtain a feature vector of each function.

[0077] The extraction of the above-mentioned feature vector includes: selecting several functions as training samples, for the sample functions, first traversing the control flow graph of the function to determine the order of execution of instructions in the function; then extracting data flow instructions from the nodes according to the determined control flow order, serializing the several instructions extracted from each sample function into an instruction list, and forming the instruction lists of all sample functions into a training data set to train a general context-aware, pre-trained natural language model; finally, using the trained model to convert each instruction in each tested function and known vulnerability function into a corresponding word vector, and aggregating the word vectors of all instructions in each function through an aggregation method to obtain a semantic feature vector for each function.

[0078] The construction of the above-mentioned feature vector specifically also includes: constructing a node feature matrix and an adjacency matrix according to the control flow graph of the function, respectively representing the structural features of each node and the structure of the graph, and normalizing the adjacency matrix; then using the encoder part of the multidimensional feature graph autoencoder model to take the node feature matrix and the adjacency matrix as input to generate a low-dimensional representation vector for each node, and through training the model, the matrix reconstructed by the decoder part and the original matrix are made close to the same; finally, the encoder part of the trained model is used to construct a feature vector containing structural features for each function.

[0079] The input of the above multi-dimensional feature graph autoencoder model is the node feature matrix and the normalized adjacency matrix, and the output is a low-dimensional representation vector. The encoder is a graph convolutional network, and the calculation of each layer of node representation satisfies:

[0080] ,

[0081] in, For the The node representation of the layer, the initial layer is the input node feature matrix , For the The weight matrix of the layer, is the adjacency matrix, is the degree matrix, the elements on the diagonal are the degree of each node, and the off-diagonal elements are 0. represents the normalization of the adjacency matrix, is the activation function, satisfying .

[0082] In this embodiment, the multi-dimensional feature graph autoencoder model needs to define a loss function to measure the reconstruction effect. The loss function includes reconstruction loss and regularization terms. Since the node feature matrix and the adjacency matrix are both used as inputs of the encoder part, a suitable reconstruction loss function needs to be defined for these two matrices respectively.

[0083] For the adjacency matrix, the reconstruction loss function uses adaptive weighted binary cross entropy to dynamically adjust the weights of positive and negative samples according to the sparsity of the graph to ensure that the reconstruction does not cause insufficient attention to positive samples due to sparse graphs. The loss function of the adjacency matrix satisfies: ,in, is the element in the original adjacency matrix, is the element in the reconstructed adjacency matrix, is the positive sample weight, which is defined as , is the negative sample weight, which is defined as , is the total number of matrix elements.

[0084] For the node feature matrix, the reconstruction loss function uses the mean square error, and the loss function of the node feature matrix satisfies: ,in, is the number of nodes, is the first feature matrix in the original The feature vector of a node, is the first feature matrix after reconstruction The feature vector of a node.

[0085] The calculation of the regularization term satisfies: ,in, is the regularization loss coefficient, is the model parameter matrix, For model parameters The square of the norm;

[0086] Total loss function The calculation satisfies: .

[0087] S4, performing cosine distance similarity calculation on the feature vector of the binary program and the feature vector of the binary vulnerability, and taking the similarity calculation result higher than a preset value as the target function;

[0088] S4 Specifically, for each tested function, its feature vector is compared with the feature vector of each known vulnerability function, and the cosine distance is used to calculate the feature vector similarity. If the similarity between a tested function and a known vulnerability function is higher than a predetermined value, the tested function is marked as the target function, and the comparison with the remaining known vulnerability functions is stopped, and the next similarity between the tested function and the known vulnerability function is started. The preset value can be set according to the actual situation, and this embodiment does not limit this. The calculation of the cosine distance belongs to the conventional calculation method, and this embodiment will not be repeated.

[0089] S5. Performing directed grey-box fuzz testing on the target function through target scheduling with dynamically updated masking probability.

[0090] Target scheduling in S5 includes:

[0091] During the development phase of fuzz testing, a probability of being blocked is maintained for each target function. , initially 0, dynamically updates the probability of each target being shielded before allocating energy to the seed. Specifically, the shielding probability is dynamically updated The target function is shielded: when the target function is covered by the test case more than the threshold, the more times it is covered, the greater the probability of being shielded; the shielding probability The update rule satisfies the function:

[0092] ,

[0093] in, is the parameter that controls the growth rate of the shielding probability, is the number of times the target is covered, is the objective function The similarity of is the threshold, beyond which the shielding probability begins to increase with the increase in the number of coverage times.

[0094] Each function has a state, active state, paused state and stopped state. The mechanism flow of the above target scheduling mainly includes: first, divide the entire fuzz test process into several cycles (based on the update of the test case queue); second, update the state of the target in each cycle; finally, shield the targets in the paused and stopped states in the seed distance calculation. The target state is updated based on the current state and the number of times it is covered. If the number of times it is covered is always 0, the target switches back and forth between pause and activation. If it is not 0 and is in the active state, the shielding probability is calculated according to the formula. If the probability exceeds the random number, it is updated to the stopped state. The above random number refers to a random number generated at each calculation to facilitate comparison with the probability.

[0095] In summary, the method of this embodiment uses graph neural networks to construct structural feature vectors for function extraction, and uses word embedding technology to construct semantic feature vectors; the dimension reduction of the structural feature vectors is achieved by designing a graph autoencoder, as well as an input matrix, an intermediate layer representation, and a loss function to obtain the structural feature vector representation of the function; the feature vectors of the function to be tested are compared with those of functions containing known vulnerabilities to determine whether to mark the function to be tested as a target; the impact of false positive targets and unreachable targets is reduced by designing a target scheduling mechanism, thereby guiding fuzz testing towards more valuable targets.

[0096] Embodiment 2

[0097] Embodiment 2 is carried out on the basis of embodiment 1, and mainly describes the specific operation process of the method corresponding to embodiment 1.

[0098] First, the binary program and known vulnerability functions in the firmware are promoted to the intermediate representation llvm intermediate representation. The machine code in the binary file is converted into assembly instructions through disassembly, and the assembly instructions are divided into basic block levels according to the execution path of the program. Then, a mapping from assembly instructions to intermediate representation is established, and registers and memory accesses in the assembly code are converted into abstract variables and memory models in the intermediate representation. Registers can be mapped to local variables in the llvm intermediate representation, and memory accesses need to be abstracted through memory instructions such as 'load' and 'store' in the llvm intermediate representation. Finally, the function calls and returns in the assembly code are mapped to the function call model in the llvm intermediate representation to ensure that parameter passing and return value processing are in line with the conventions of the target architecture. Since the firmware widely includes OpenSSL and Busybox libraries, OpenSSL and Busybox libraries are selected as vulnerability libraries.

[0099] For functions in binary programs and known binary vulnerability functions, build a control flow graph containing control flow. With the help of the llvm tool chain, the program dependency graph can be automatically built, which includes the following sub-steps:

[0100] Divide the binary program into function-level granularity. The function boundary is usually defined by the entry point (function start) and the exit point (function return). The llvm intermediate representation exists in text form. Each instruction and declaration is on a new line. The define keyword is usually used to define a function, and "{" and "}" are used to define the function boundary. The define keyword and curly braces can be used to identify the start and end of the function, and all binary functions in the llvm intermediate representation form are divided, that is, the functions to be tested that need similarity analysis, and the function header signature information such as the return type, parameter name and parameter list of each function is obtained;

[0101] For the functions to be tested and known vulnerability functions, divide them into basic blocks. A basic block is a continuous sequence of instructions in a program with only one entry point and one exit point. The entry and exit points of the basic block are identified through conditional jump instructions and jump instructions. In the process of generating the intermediate representation of llvm, the basic block is automatically divided and the label is used as the entry point.

[0102] For the functions to be tested and the functions with known vulnerabilities, control flow analysis is performed to build the control flow graph of the function, where each node represents a basic block and each edge represents the jump relationship between basic blocks; the control flow graph CFG can be automatically built using the llvm-cfg command line tool, and the verification tool of llvm is used to ensure the accuracy of the construction.

[0103] For each function to be tested and known vulnerability function, two dimensions of features are extracted, namely semantic features and structural features. In the semantic feature dimension, the data flow instructions in the function are converted into corresponding word vectors in sequence. In the structural feature dimension, the node feature matrix and adjacency matrix are extracted according to the control flow graph of the function, and the two matrices are converted into vectors using a multi-dimensional feature graph autoencoder. Finally, a vector containing the two features is constructed as the feature vector of the function; specifically, the following sub-steps are included:

[0104] Extract the semantic features of each function and use the general natural language model to construct a function-level feature vector containing the semantic features:

[0105] Several functions are selected as training samples. For the sample functions, the control flow graph of the function is first traversed to determine the order in which the instructions in the function are executed; then, data flow instructions are extracted from the nodes according to the determined control flow order, and the several instructions extracted from each sample function are serialized into an instruction list. The instruction lists of all sample functions form a training data set to train a general language model, and word2vec is selected as the training model; finally, the trained word2vec model is used to convert each instruction in each tested function and known vulnerability function into a corresponding word vector, and the word vectors of all instructions in each function are aggregated by an aggregation method to obtain the semantic feature vector of each function;

[0106] Extract the structural features of each function and use the multi-dimensional feature map autoencoder model to construct a function-level feature vector containing the structural features:

[0107] First, the node feature matrix and adjacency matrix are constructed according to the control flow graph of the function, which respectively represent the feature vector of each node and the connection relationship of the nodes in the graph, and the adjacency matrix is ​​normalized; then the encoder part of the multi-dimensional feature graph autoencoder model is used to take the node feature matrix and the adjacency matrix as input to generate a low-dimensional representation vector for each node, and the matrix reconstructed by the decoder part is made consistent with the original matrix through training model; finally, the encoder part of the trained model is used to construct a feature vector containing structural features for each function;

[0108] The semantic feature vectors and structural feature vectors of the function to be tested and the known vulnerability function are concatenated to obtain the feature vector of each function. This feature vector contains the semantic features and structural features of the function.

[0109] Among them: 20% of the functions are selected from all the functions to be tested and the known vulnerability function set as training samples, and the instruction sequence is extracted from the training sample function. The instruction sequence can be regarded as a sentence, and each instruction or operand is a word in the sentence. The Skip-gram model training data is selected. First, the context window is constructed. The size of the window determines the number of context words on the left and right sides of each target word, which directly affects the semantic relationship learned by the model. The window size is set to 5, which can capture both local relationships and certain context information. The prepared instruction sequence is used as the model input. After training, the model will gradually learn the vector representation of each instruction. The trained model is used to construct the feature vector representation of the instructions of each function. The feature vectors of all instructions in the function are aggregated by averaging to obtain the function-level semantic feature vector.

[0110] Among them: taking the basic block as the node, the structural features extracted from each node include: node in-degree, node out-degree, number of basic block instructions, number of calls to other functions, whether it contains conditional judgment, whether it is in a loop, control flow position of the basic block, and data dependency type. Among them, no is 0, yes is 1, the control flow position of the basic block includes three types: 1 is the function entry, 2 is the intermediate node, and 3 is the function exit. The data dependency type represents the operation type of the variable in the basic block, which is divided into three types: 1 is definition, 2 is use, and 4 is modification. If there is more than one operation type of the variable in a basic block, the corresponding type values ​​are added. For example, 5 represents that the basic block contains both definition and modification. The number of rows in the node feature matrix is ​​the number of nodes, and the number of columns is the length of the feature vector. When constructing the adjacency matrix, 0 is used to indicate that there is no control flow or data flow relationship between basic blocks, and 1 is used to indicate that there is a directed control flow or data flow relationship between basic blocks. The adjacency matrix is ​​normalized by symmetric normalization to balance the contribution of different nodes during feature propagation.

[0111] In the training of the multi-dimensional feature map autoencoder model, a loss function is defined to measure the reconstruction effect. For the specific calculation and description of the loss function, please refer to the relevant description of the first embodiment, which will not be repeated in this embodiment.

[0112] For each tested function, its feature vector is compared with the feature vector of each known vulnerability function, and the cosine distance is used to calculate the feature vector similarity. If the similarity between a tested function and a known vulnerability function is higher than 0.6, the tested function is marked as the target function, and its comparison with the remaining known vulnerability functions is stopped, and the next tested function is started to compare the similarity with the known vulnerability function.

[0113] Directed grey-box fuzz testing is performed with marked functions as targets. A target scheduling mechanism is used to shield suspected false positive targets and reduce the frequency of temporarily unreachable targets participating in the distance calculation of seeds, guiding seeds to approach more valuable targets, further improving the efficiency of fuzz testing.

[0114] Please refer to the following table for the specific process code of the targeted fuzz test:

[0115] Table 1 Pseudo code of the specific process of directional fuzz testing based on target scheduling

[0116]

[0117] In this embodiment, on the basis of the aflgo tool fuzz test, a target scheduling mechanism is introduced to reduce the impact of false positives and unreachable targets on seed energy allocation, further improving the test efficiency. The target scheduling mechanism divides all target functions into three states: active, paused, and stopped. Initially, all functions are set to the active state. When the number of times a target function is covered exceeds a certain threshold, it is considered to be a false positive target, and there is a probability that the target is blocked, and the state is converted from active to stopped; when the number of times a target function is covered is 0 for a long time, it is considered that this target may be an unreachable target, and the state of this target is periodically switched between active and paused. In the directional fuzz test, the seed allocates energy according to the distance from the target. Therefore, before the seed calculates the distance from the target, all target functions are traversed, and the target in active is used as the basis for the seed to calculate the distance, and more energy is allocated to the seeds that can approach the active target function (lines 5-8). Since a test case that can trigger a new path will be retained in the seed queue, it also provides a new possibility for reaching the suspected unreachable target while updating the seed queue. Therefore, during the period from the seed queue update to the next seed queue update, the UpdateTargetFunction function is executed to decide whether to change the state of the target according to the number of times the target function is covered (lines 9-12). In the UpdateTargetFunction function, the current set of target functions is used as input, and the set of target functions after the state update is used as output. Each target function is traversed, and the paused target is switched to active (lines 16-17), and the active and uncovered target is switched to paused (lines 19-20), thus realizing the periodic switching of the state of the suspected unreachable target. For the active and covered target, the probability of the target being blocked is calculated according to the similarity and the number of times the target is covered according to formula (6). At the same time, a random number between 0 and 1 is generated each time the UpdateTargetFunction function is called. If the probability of being blocked is higher than this random number, the state of the target is changed from active to stopped, and the target is no longer considered (lines 24-25).

[0118] In summary, the target function location part of this method constructs a program dependency graph containing control flow and data flow information of the function, extracts structural features and semantic features respectively, and uses graph neural network and word embedding technology to jointly construct a feature vector containing the two features, and determines the target function after comparing the similarity with the vulnerability function. In the directed fuzz testing part, before calculating the seeds and targets, the targets that have been covered enough times are permanently shielded and the targets that are not covered are periodically shielded to reduce the impact of false positive targets and unreachable targets on the seed distance calculation and seed energy allocation, further improving the efficiency of fuzz testing.

[0119] Embodiment 3

[0120] Embodiment 1 discloses a device corresponding to the method for directional gray box fuzzy testing of power equipment firmware in the above embodiment, which is a virtual device structure of the above embodiment. Please refer to Figure 3 As shown, including:

[0121] A construction module 310 is used to obtain firmware information of the power terminal device, assemble the binary program and the known binary vulnerability function in the firmware information to obtain an intermediate representation; and construct a control flow graph of the function of the binary program and the known binary vulnerability function;

[0122] An extraction module 320 is used to extract semantic features and structural features of the functions of the binary program and the known binary vulnerability functions, including: extracting and constructing the semantic feature vector through word embedding technology, extracting and constructing the structural feature vector through graph neural network, and splicing the semantic features and the structural features into a feature vector;

[0123] The testing module 330 is used to perform cosine distance similarity calculation on the feature vector of the binary program and the feature vector of the binary vulnerability, and take the similarity calculation result higher than a preset value as the target function; and perform a directed gray box fuzzy test on the target function through target scheduling.

[0124] Preferably, the binary program and the known binary vulnerability function in the firmware information are assembled to obtain an intermediate representation, including:

[0125] Converting the machine code in the binary program into assembly instructions by disassembling;

[0126] Dividing the assembly instructions into basic blocks according to the execution path of the binary program;

[0127] Establishing an intermediate representation mapping of the assembly instruction so that registers and memory accesses in the assembly instruction are converted into abstract variables and memory models in the intermediate representation;

[0128] The function calls and returns in the assembly instructions are mapped to a function call model in the intermediate representation.

[0129] Preferably, constructing a control flow graph of the binary program function and the known binary vulnerability function includes:

[0130] Divide the binary program into function-level granularity, identify the start and end marks of the function through the intermediate representation, and obtain a binary function in the intermediate representation as a function to be tested;

[0131] Dividing the known binary vulnerability function and the function to be tested into basic blocks;

[0132] Construct a control flow graph of the known binary vulnerability function and the function to be tested, wherein the nodes of the control flow graph represent basic blocks, and the edges represent the jump relationship between basic blocks.

[0133] Preferably, extracting the semantic features and structural features of the binary program function and the known binary vulnerability function includes: extracting and constructing the semantic feature vector through word embedding technology, extracting and constructing the structural feature vector through graph neural network, and splicing the semantic features and the structural features into a feature vector, including:

[0134] Construct semantic feature vectors through natural language models;

[0135] Constructing structural feature vectors through multi-dimensional feature map autoencoder model;

[0136] The semantic feature vectors and structural feature vectors of the functions of the binary program and the known vulnerability functions are concatenated to obtain a feature vector of each function.

[0137] Preferably, the input of the multi-dimensional feature graph autoencoder model is a node feature matrix and a normalized adjacency matrix, the output is a low-dimensional representation vector, the encoder is a graph convolutional network, and the calculation of each layer of node representation satisfies:

[0138] ,

[0139] in, For the The node representation of the layer, the initial layer is the input node feature matrix , For the The weight matrix of the layer, is the adjacency matrix, is the degree matrix, the elements on the diagonal are the degree of each node, and the off-diagonal elements are 0. represents the normalization of the adjacency matrix, is the activation function, satisfying .

[0140] Preferably, the loss function of the multi-dimensional feature map autoencoder model includes:

[0141] The loss function of the adjacency matrix satisfies: ,in, is the element in the original adjacency matrix, is the element in the reconstructed adjacency matrix, is the positive sample weight, is the negative sample weight;

[0142] The loss function of the node feature matrix satisfies: ,in, is the number of nodes, is the first feature matrix in the original The feature vector of a node, is the first feature matrix after reconstruction The feature vector of each node;

[0143] The calculation of the regularization term satisfies: ,in, is the regularization loss coefficient, is the model parameter matrix, For model parameters The square of the norm;

[0144] Total loss function The calculation satisfies: .

[0145] Preferably, the target function is subjected to a directed grey-box fuzz test through target scheduling, wherein the target scheduling comprises:

[0146] Through a dynamically updated masking probability The target function is shielded: when the target function is covered by the test case more than the threshold, the more times it is covered, the greater the probability of being shielded; the shielding probability The update rule satisfies the function:

[0147] ,

[0148] in, is the parameter that controls the growth rate of the shielding probability, is the number of times the target is covered, is the objective function The similarity of is the threshold, beyond which the shielding probability begins to increase with the increase in the number of coverage times.

[0149] Embodiment 4

[0150] Figure 4 A schematic diagram of the structure of an electronic device provided in Embodiment 6 of the present invention is shown in FIG. Figure 4 As shown, the electronic device includes a processor 410, a memory 420, an input device 430, and an output device 440; the number of processors 410 in the computer device can be one or more. Figure 4 A processor 410 is taken as an example; the processor 410, the memory 420, the input device 430 and the output device 440 in the electronic device can be connected via a bus or other means. Figure 4 The example of connecting through bus is taken in the following.

[0151] The memory 420, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the gray-box fuzz testing method for power equipment firmware in the embodiment of the present invention. The processor 410 executes various functional applications and data processing of the electronic device by running the software programs, instructions and modules stored in the memory 420, that is, the gray-box fuzz testing method for power equipment firmware in the above-mentioned embodiments 1 to 2 is implemented.

[0152] The memory 420 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 420 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 420 may further include a memory remotely arranged relative to the processor 410, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0153] The input device 430 may be used to receive input user identity information, firmware data, vulnerability data, etc. The output device 440 may include a display device such as a display screen.

[0154] Embodiment 5

[0155] Embodiment 5 of the present invention further provides a storage medium containing computer executable instructions, which can be used for a computer to execute a method for directional gray box fuzz testing of power equipment firmware, the method comprising:

[0156] Obtaining firmware information of the power terminal equipment, assembling the binary program and known binary vulnerability functions in the firmware information, and obtaining an intermediate representation;

[0157] Constructing a control flow graph of the functions of the binary program and the known binary vulnerability functions;

[0158] Extracting semantic features and structural features of the functions of the binary program and the known binary vulnerability functions, including: extracting and constructing the semantic feature vector by word embedding technology, extracting and constructing the structural feature vector by graph neural network, and splicing the semantic features and the structural features into a feature vector;

[0159] Performing cosine distance similarity calculation on the feature vector of the binary program and the feature vector of the binary vulnerability, and taking the similarity calculation result higher than a preset value as the target function;

[0160] Directed grey-box fuzz testing is performed on the target function through target scheduling.

[0161] Of course, the storage medium containing computer executable instructions provided in an embodiment of the present invention is not limited to the method operations described above, and can also execute related operations in the power equipment firmware directed gray box fuzz testing method provided in any embodiment of the present invention.

[0162] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for an electronic device (which can be a mobile phone, a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0163] It is worth noting that in the above-mentioned embodiment of the method and device for directed gray-box fuzz testing of power equipment firmware, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0164] For those skilled in the art, various other corresponding changes and deformations can be made according to the technical solutions and concepts described above, and all of these changes and deformations should fall within the protection scope of the claims of the present invention.

Claims

1. A method for directional gray box fuzz testing of power equipment firmware, characterized in that: The following steps are involved: Obtaining firmware information of the power terminal equipment, assembling the binary program and known binary vulnerability functions in the firmware information, and obtaining an intermediate representation; Constructing a control flow graph of the functions of the binary program and the known binary vulnerability functions; Extracting semantic features and structural features of the binary program function and the known binary vulnerability function, including: extracting and constructing the semantic feature vector through word embedding technology, extracting and constructing the structural feature vector through graph neural network, and splicing the semantic features and the structural features into a feature vector, including: Construct semantic feature vectors through natural language models; Constructing structural feature vectors through multi-dimensional feature map autoencoder model; Concatenate the semantic feature vectors and structural feature vectors of the functions of the binary program and the known vulnerability functions to obtain a feature vector of each function; The input of the multi-dimensional feature graph autoencoder model is the node feature matrix and the normalized adjacency matrix, the output is a low-dimensional representation vector, the encoder is a graph convolutional network, and the calculation of each layer of node representation satisfies: ， in, For the The node representation of the layer, the initial layer is the input node feature matrix , For the The weight matrix of the layer, is the adjacency matrix, is the degree matrix, the elements on the diagonal are the degree of each node, and the off-diagonal elements are 0. represents the normalization of the adjacency matrix, is the activation function, satisfying ; The loss function of the multi-dimensional feature map autoencoder model includes: The loss function of the adjacency matrix satisfies: ,in, is the element in the original adjacency matrix, is the element in the reconstructed adjacency matrix, is the positive sample weight, is the negative sample weight; The loss function of the node feature matrix satisfies: ,in, is the number of nodes, is the first feature matrix in the original The feature vector of a node, is the first feature matrix after reconstruction The feature vector of each node; The calculation of the regularization term satisfies: ,in, is the regularization loss coefficient, is the model parameter matrix, For model parameters The square of the norm; Total loss function The calculation satisfies: ; Performing cosine distance similarity calculation on the feature vector of the binary program and the feature vector of the binary vulnerability, and taking the similarity calculation result higher than a preset value as the target function; The target function is subjected to directed grey-box fuzz testing through target scheduling with dynamically updated masking probability, wherein the target scheduling comprises: Through a dynamically updated masking probability The target function is shielded: when the target function is covered by the test case more than the threshold, the more times it is covered, the greater the probability of being shielded; the shielding probability The update rule satisfies the function: ， in, is the parameter that controls the growth rate of the shielding probability, is the number of times the target is covered, is the objective function The similarity of is the threshold, beyond which the shielding probability begins to increase with the increase in the number of coverage times.

2. The power equipment firmware directed gray box fuzz testing method according to claim 1, characterized in that: The binary programs and known binary vulnerability functions in the firmware information are assembled to obtain intermediate representations, including: Converting the machine code in the binary program into assembly instructions by disassembling; Dividing the assembly instructions into basic blocks according to the execution path of the binary program; Establishing an intermediate representation mapping of the assembly instruction so that registers and memory accesses in the assembly instruction are converted into abstract variables and memory models in the intermediate representation; The function calls and returns in the assembly instructions are mapped to a function call model in the intermediate representation.

3. The power equipment firmware directed gray box fuzz testing method according to claim 1, characterized in that: Constructing a control flow graph of the binary program function and the known binary vulnerability function, including: Dividing the binary program in the intermediate representation into function-level granularity, identifying the start and end marks of the function through the intermediate representation, and obtaining a binary function in the intermediate representation as a function to be tested; Dividing the known binary vulnerability function and the function to be tested into basic blocks; Construct a control flow graph of the known binary vulnerability function and the function to be tested, wherein the nodes of the control flow graph represent basic blocks, and the edges represent the jump relationship between basic blocks.

4. A directional gray box fuzzy testing device for power equipment firmware, characterized in that: It includes: A construction module is used to obtain the firmware information of the power terminal device, assemble the binary program and the known binary vulnerability function in the firmware information, and obtain an intermediate representation; and constructing a control flow graph of the functions of the binary program and the known binary vulnerability functions; An extraction module is used to extract the semantic features and structural features of the functions of the binary program and the known binary vulnerability functions, including: extracting and constructing the semantic feature vector through word embedding technology, extracting and constructing the structural feature vector through graph neural network, and splicing the semantic features and the structural features into a feature vector, including: Construct semantic feature vectors through natural language models; Constructing structural feature vectors through multi-dimensional feature map autoencoder model; Concatenate the semantic feature vectors and structural feature vectors of the functions of the binary program and the known vulnerability functions to obtain a feature vector of each function; The input of the multi-dimensional feature graph autoencoder model is the node feature matrix and the normalized adjacency matrix, the output is a low-dimensional representation vector, the encoder is a graph convolutional network, and the calculation of each layer of node representation satisfies: ， in, For the The node representation of the layer, the initial layer is the input node feature matrix , For the The weight matrix of the layer, is the adjacency matrix, is the degree matrix, the elements on the diagonal are the degree of each node, and the off-diagonal elements are 0. represents the normalization of the adjacency matrix, is the activation function, satisfying ; The loss function of the multi-dimensional feature map autoencoder model includes: The loss function of the adjacency matrix satisfies: ,in, is the element in the original adjacency matrix, is the element in the reconstructed adjacency matrix, is the positive sample weight, is the negative sample weight; The loss function of the node feature matrix satisfies: ,in, is the number of nodes, is the first feature matrix in the original The feature vector of a node, is the first feature matrix after reconstruction The feature vector of each node; The calculation of the regularization term satisfies: ,in, is the regularization loss coefficient, is the model parameter matrix, For model parameters The square of the norm; Total loss function The calculation satisfies: ; The testing module is used to perform cosine distance similarity calculation on the feature vector of the binary program and the feature vector of the binary vulnerability, and use the similarity calculation result higher than a preset value as the target function; and perform a directed gray box fuzzy test on the target function through a target scheduling with a dynamically updated shielding probability, wherein the target scheduling includes: Through a dynamically updated masking probability The target function is shielded: when the target function is covered by the test case more than the threshold, the more times it is covered, the greater the probability of being shielded; the shielding probability The update rule satisfies the function: ， in, is the parameter that controls the growth rate of the shielding probability, is the number of times the target is covered, is the objective function The similarity of is the threshold, beyond which the shielding probability begins to increase with the increase in the number of coverage times.

5. An electronic device comprising a processor, a storage medium and a computer program, wherein the computer program is stored in the storage medium, wherein: When the computer program is executed by a processor, the power equipment firmware directed gray box fuzz testing method according to any one of claims 1 to 3 is implemented.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the power equipment firmware directed gray box fuzz testing method according to any one of claims 1 to 3 is implemented.

Images