Intelligent vulnerability mining system and method for real-time operating system

Abstract

The present invention relates to the technical field of system vulnerability detection, and specifically discloses an intelligent vulnerability mining system and method for a real-time operating system. The system includes a firmware simulation analysis module, a semantic recognition test module, a similarity theory test module, and an intelligent fuzzy test module. The firmware simulation analysis module includes a user interface layer, a core data analysis layer, an intelligent virtual resource allocation layer, and a simulation system resource support layer. The present invention optimizes performance to improve detection efficiency and accuracy by dividing the firmware simulation target into multiple parts such as startup item detection and dynamic behavior monitoring. It uses the syntax tree and clustering method of source code and binary code to make accurate similarity judgments, and uses a tree matching algorithm to discover structural vulnerabilities. At the same time, through the obfuscation elimination technology and intelligent fuzzy testing to generate efficient variant samples, the processing ability of obfuscated codes is enhanced, and the coverage and accuracy of vulnerability discovery are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of system vulnerability detection, and in particular to an intelligent vulnerability mining system and method for a real-time operating system. Background Art

[0002] A real-time operating system is an operating system specifically designed to handle real-time data processing and control tasks. They have strict time constraints and need to respond quickly to events within a predetermined time. They are used in fields that require highly precise time control and response, including but not limited to: aerospace, medical equipment, industrial automation and control, communication equipment, and automotive electronics. Therefore, system security is critical to real-time operating systems. System vulnerabilities refer to defects or weaknesses in software or system design, implementation, or configuration. These defects may be exploited by attackers to perform malicious operations such as illegal access, data tampering, and service interruption. The impact of system vulnerabilities on real-time operating systems includes not only performance and security issues, but may also affect system stability, maintenance costs, and compliance. Therefore, timely discovery and repair of vulnerabilities is critical to ensuring the reliability of RTOS in critical applications.

[0003] However, there are still some problems in real-time operating system vulnerability mining, such as:

[0004] There are often unpatched vulnerabilities in firmware that can be easily exploited by attackers to perform malicious operations. Network configuration errors or insufficient dynamic behavior monitoring may cause security vulnerabilities to go unnoticed.

[0005] High concurrency may lead to task scheduling problems, affecting the real-time response capability of the system. The system may have deficiencies in resource management and allocation, affecting overall performance. The RTOS may need to support multiple devices and instruction sets, and compatibility issues may affect system stability.

[0006] Startup item detection and soft link problems may cause system startup failure or instability, and obfuscated code makes vulnerability analysis and repair complicated, increasing security risks. Therefore, the present invention proposes an intelligent vulnerability mining system and method for a real-time operating system to solve the problems mentioned in the above background technology. Summary of the invention

[0007] The intelligent vulnerability mining technology of the real-time operating system of the present invention focuses on breakthroughs in key technologies such as firmware simulation analysis, intelligent fuzzy testing, automated protocol testing, code block matching testing, and similarity theory, forming the ability to detect security vulnerabilities in real-time operating systems in key areas. The subsystem is based on a security detection and evaluation environment and can carry out white-box, black-box, and gray-box testing for real-time operating systems in key areas such as FreeRTOS, VxWorks, embedded Linux, Android, WinCE, and UC / OS-II, thereby realizing vulnerability analysis capabilities for open source codes, programs, firmware, protocols, etc.

[0008] Achieve traction indicators: In terms of system-level simulation, the firmware built on mainstream real-time operating system platforms (such as FreeRTOS, VxWorks, etc.) is automatically adapted and run in full-system simulation, and 90% of the functional logic in the firmware can be simulated and reproduced without hardware support. A real-time operating system intelligent vulnerability mining system and method are proposed.

[0009] In order to achieve the above object, the present invention adopts the following technical solutions:

[0010] An intelligent vulnerability mining system and method for a real-time operating system, the system comprising a firmware simulation analysis module, a semantic recognition test module, a similarity theory test module and an intelligent fuzzy test module;

[0011] The firmware simulation analysis module includes a user interface layer, a core data analysis layer, an intelligent virtual resource allocation layer and a simulation system resource support layer, wherein the user interface layer includes a user control station, a simulation page, fixed analysis utilities, quick instructions, fixed vulnerabilities and vulnerability feedback; the core data analysis layer includes analysis and repair of the firmware file system, as well as the implantation of hijacked files, dependent files, analysis and tracking scripts, and debugging commands; the intelligent virtual resource allocation layer allocates all computing resources through scheduling to enable the simulation simulator to run correctly, and at the same time enables the process resource monitoring of the simulator; the simulation system resource support layer is used to support the distributed deployment of the entire system. In order to realize the firmware simulation analysis function, the firmware simulation analysis platform is divided into ten technical parts, namely startup item detection, soft link repair, library function identification, library function hijacking, device type support, multiple instruction set support, network configuration detection, dynamic behavior monitoring, startup type support and high concurrency support;

[0012] The semantic recognition module starts from three levels: directory composition features, file structure features, and code semantics code block matching test analysis features, and judges and screens the comparison targets from top to bottom, from external features to internal logic, continuously narrowing the comparison scope and improving the efficiency and accuracy of similarity judgment;

[0013] The similarity theory test module takes the feature similarity vectors of a pair of similar codes as input and their similarity measurement values ​​as expected output, and continuously adjusts the influence weights of each feature on the comparison analysis results through training, thereby realizing a reasonable mapping from the code feature vector to the comparison analysis results, establishing an effective comparison analysis model based on BP neural network, and using BP network to analyze the similarity between code samples;

[0014] The intelligent fuzz testing module includes a binary program patching module, a software component operation simulation module and a fuzz testing module. Through the mutual cooperation of the patching module, the simulation operation module and the fuzz testing module, multi-granularity fuzz testing of basic software, software components and protocols is realized. In the fuzz testing module, in order to traverse more program paths contained in the program and improve the ability to discover vulnerabilities, a feedback mechanism is introduced to significantly improve its security.

[0015] Preferably, the firmware simulation analysis module first conducts firmware basic analysis research, realizes firmware unpacking, ELF file analysis, operating system identification, instruction set identification, file system format identification, and manufacturer model identification, and realizes the construction of firmware dynamic analysis environment through coarse-grained matching library function identification function, which provides a basis for subsequent analysis technology. Based on firmware unpacking and instruction set identification in firmware basic analysis, firmware simulation analysis can be further realized. Firmware simulation analysis will study library function identification, startup item detection, soft link repair, library function hijacking, network configuration detection, hardware parameter filling and other technologies.

[0016] Preferably, the semantic recognition module distinguishes between source code and binary code at the file structure level, makes similarity judgments on source code from the perspective of syntax tree and clustering method, judges similarity of binary code by comparing program structure, and adopts similarity judgment based on forward deduction and similarity judgment based on dependency features for binary code. For more special obfuscated codes, this part of the research will also implement partial obfuscation elimination technology to eliminate obfuscation interference and improve the code semantic comparison capability based on dependency features.

[0017] Preferably, the similarity theory test module is implemented by the following two steps:

[0018] Step 1: construct a training set based on the feature similarity vector of a pair of codes, and use the BP algorithm to train to obtain the connection weights and thresholds of each node in the hidden layer and output layer of the neural network;

[0019] Step 2: Use the trained neural network to compare and analyze the code samples, and convert the similarity of the two samples about n features into n-tuples X=(X 1 ,X 2 ,...,X n) is used as the input vector of the neural network and is input into the neural network to obtain an output value y∈(0,1). The larger the y value is, the greater the possibility that the two input samples are similar.

[0020] Preferably, the intelligent fuzzy testing module modifies the file structure of the software components through the static probe method, inserts the code for recording the program running path, thereby monitoring the program running status, and uses the model constraints and swarm intelligence algorithm to extract the execution path results to perform targeted mutations, so as to make the test samples more penetrating and improve the efficiency of vulnerability mining.

[0021] A mining method for an intelligent vulnerability mining system of a real-time operating system, wherein the similarity theory module further comprises a code feature similarity calculation method, a code comparison method based on a BP neural network, and a threshold selection and similarity calculation method;

[0022] The method for calculating the similarity of code features is to extract the features of each code sample and represent it as a fixed-length feature vector. Then, an appropriate distance metric is used to calculate the similarity between two feature vectors, and finally a non-negative scalar is obtained to measure the similarity of the two input samples in this feature space.

[0023] Preferably, the selection of the threshold in this paper first performs multiple similarity modifications on the source program, and then compares the programs for similarity. Each similarity detection result is represented by the similarity Si. A single similarity value has no reference value. The selection of the threshold adopts the adaptive threshold method, and the programs formed by multiple modification methods are compared with the source program for N similarities to calculate the adaptive threshold Sim. The calculation formula is as follows:

[0024]

[0025] Where Smax is the maximum similarity value obtained in N detections, and Smin is the minimum similarity value obtained in N detections. According to a large number of experiments, the adaptive threshold is 83%.

[0026] Preferably, the similarity calculation is performed for nodes in the following format:

[0027] INFO k ∈{INFO N |N∈{TN},CC N =i}

[0028] The node hash value is Hk, and the corresponding code start line of the node is StN x , Code End Behavior EdN x .

[0029] If Hx = Hy, then the source code segments corresponding to node X and node Y are considered to be similar source code, and (INFO x ,INFO y ) is included into a set, according to StN x EdN x The repeated stored elements are removed from StNy to avoid repeated calculation of similarity, forming a similar node information set SMINFO. The similarity SD of the target source code relative to the sample source code is calculated using the following formula:

[0030]

[0031] Where X is the target syntax tree node, and (INFO x , StN y )∈SMINFO, LC is the total number of valid lines in the target source code (excluding comments and blanks outside code blocks, etc.);

[0032] For all (INFO x , StN y )∈SMINFO, according to INFO x NdT x Count the types of various similar data structures, such as functions, structures, unions, etc.

[0033] Compared with the prior art, the present invention has the following beneficial effects:

[0034] 1. The present invention divides the firmware simulation target into multiple parts (such as startup item detection and dynamic behavior monitoring). The system can fully cover various vulnerability detection requirements. The system is optimized according to performance requirements such as concurrency capability and startup type, thereby improving detection efficiency and accuracy.

[0035] 2. The present invention improves the accuracy of vulnerability detection by determining the similarity of the syntax tree and clustering method of the source code and binary code, and uses the tree matching algorithm to detect similar parts in the software structure, which helps to discover deep structural vulnerabilities;

[0036] 3. Through the obfuscation elimination technology, the present invention enables the system to process and analyze obfuscated codes, reducing the interference of obfuscation on vulnerability detection. The intelligent fuzzy testing technology generates efficient variant samples, which can effectively discover new vulnerabilities and improve testing efficiency. It includes sample generation, control modules and virtual platforms, etc., supports in-depth testing of different software components, and improves the coverage and accuracy of vulnerability discovery. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A technical architecture diagram of an intelligent vulnerability mining system for a real-time operating system proposed by the present invention;

[0038] Figure 2 This is a functional architecture diagram of a firmware simulation module of an intelligent vulnerability mining system for a real-time operating system proposed by the present invention;

[0039] Figure 3 A parallel identification and matching flow chart of an intelligent vulnerability mining method for a real-time operating system proposed by the present invention;

[0040] Figure 4 A schematic diagram of a fuzzy testing technology framework for an intelligent vulnerability mining method for a real-time operating system proposed by the present invention. DETAILED DESCRIPTION

[0041] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0042] Reference Figure 1-4 , a mining method for an intelligent vulnerability mining system of a real-time operating system, in which the firmware simulation analysis module adopts the method of theoretical research to drive technological breakthroughs, and takes the firmware simulation goal as the driving force. The research objects in the project requirements are organically divided into five parts: startup item detection, soft link repair, library function identification and hijacking, network configuration detection, and dynamic behavior monitoring. According to the performance requirements, requirements are made for four parts: concurrency capability, startup type, device and instruction set support type. The studied system architecture, core technology, and platform fully match the guideline direction, which can play a comprehensive supporting role in the guideline goals, achieve full coverage of project-related content and assessment indicators, and provide technical support for the realization of automatic firmware simulation analysis.

[0043] Furthermore, referring to Figure 2 The semantic recognition test module performs preliminary screening from the perspective of directory composition, quickly determines the similarity of the target in a coarse-grained manner, and narrows the comparison scope to the file structure level. At the file structure level, it begins to distinguish between source code and binary code. For source code, similarity is determined from the perspective of syntax tree and clustering methods. For binary code, similarity is determined by comparing program structures. When the file structure matching is completed, the remaining comparison process converges to the semantic similarity determination. At this stage, we implement text-based code and linear sequence-based code recognition processing technology for source code, and use forward deduction-based similarity determination and dependency feature-based similarity determination for binary code. For more special obfuscated codes, this part of the study will also implement partial obfuscation elimination technology to eliminate obfuscation interference and improve the similarity comparison capability based on dependency features.

[0044] Furthermore, referring to Figure 3,Since the software structure information is stored in the form of a tree in the eigenvalue database, finding the ,same part of two software is equivalent to finding the maximum matching ,subtree of two trees, and a simple tree matching algorithm is used to ,search it;

[0045] The maximum matching between two trees is defined as follows:

[0046] Suppose A and B are two trees, and i and j are two nodes in A and B respectively. A matching between two trees is defined as a mapping M, such that for every node pair (i, j) belonging to M (where neither i nor j is a root node), there is (parent(i), parent(j)) belonging to M. The matching with the most node pairs is called the maximum matching between A and B. Note that there may be more than one maximum matching.

[0047] Let W(A, B) represent the number of node pairs in a simple tree matching between tree A and tree B. Its formal definition is as follows:

[0048]

[0049] Among them, RA and RB are the root nodes of tree A and tree B respectively, Ak is the kth node of the first-level subtree of tree A, Bn is the nth node of the first-level subtree of tree B, m(<A1,...,Ak> ,<B1,...,Bn> ) refers to the number of node pairs in the maximum match of the first-level subtree of tree A and the first-level subtree of tree B. The formal definition of W(A, B) is that when the root nodes of tree A and tree B are different, W(A, B) is equal to 0; when the root nodes of tree A and tree B are the same, W(A, B) is equal to the number of node pairs in the maximum match of the first-level subtree of tree A and the first-level subtree of tree B plus 1. It is also necessary to add 1 to m(<A1,...,Ak> ,<B1,...,Bn> ) is further defined;

[0050] First look at m(<A1,...,Ak> ,<B1,...,Bn> ) is formally defined as:

[0051] m(<>,<>)=0 / / <> represents an empty subtree list

[0052] m(s, <>) = m(<>, s) = 0 / / s matches any non-empty subtree list

[0053] m(<A1,...,Ak> ,<B1,...,Bn> )=max(

[0054] m(<A1,...,Ak-1> ,<B1,...,Bn-1> )+W(Ak,Bn),

[0055] m(<A1,...,Ak> ,<B1,...,Bn-1> ),

[0056] m(<A1,...,Ak-1> ,<B1,...,Bn> ))

[0057] The specific meaning of this formal definition is:

[0058] First, when either of the two subtree lists is empty, the number of matches is 0;

[0059] Second, the maximum match of two subtree lists can be regarded as the maximum match of the subtree list composed of the first k subtrees of the first subtree list and the subtree list composed of the first n subtrees of the second subtree list; at this time, there are three choices:

[0060] a. Match Ak and Bn, then m(<A1,...,Ak> ,<B1,...,Bn> ) becomes m(<A1,...,Ak-1> ,<B1,...,Bn-1> )+W(Ak,Bn);

[0061] b. Does not match Bn, then m(<A1,...,Ak> ,<B1,...,Bn> ) becomes m(<A1,...,Ak> ,<B1,...,Bn-1> );

[0062] c. Does not match Ak, then m(<A1,...,Ak> ,<B1,...,Bn> ) becomes m(<A1,...,Ak-1> ,<B1,...,Bn> );

[0063] Then, choose the largest one among these three to get the largest m(<A1,...,Ak> ,<B1,...,Bn> ), we can see that, to find m(<A1,...,Ak> ,<B1,...,Bn> ) is very similar to the process of finding the string edit distance. In fact, m(<A1,...,Ak> ,<B1,...,Bn> ), and the two subtree lists can also be aligned by obtaining a two-dimensional array (here is m), however, find m (<A1,...,Ak> ,<B1,...,Bn> ) also has its own unique feature, that is, it will recursively calculate W(Ak, Bn).

[0064] Furthermore, the similarity theory testing module uses similarity theory vulnerability detection technology to achieve robust malware detection based on hierarchical graph neural networks and precise vulnerability prediction based on tree graph neural networks. It supports building a hierarchical graph using the function call graph and the control flow graph of the executable software, and then using the hierarchical graph neural network model to predict hijackable software. It supports processing the tree semantic structure in the joint intermediate representation through the tree neural network to calculate the vector representation of the statement granularity, and supports processing the graphical semantic structure in the joint intermediate representation through the graph neural network to calculate the vector representation of the code segment granularity to achieve vulnerability prediction in the code.

[0065] Furthermore, referring to Figure 4 The main idea of ​​fuzz testing is to provide unexpected input data to the target (including file formats, network protocols, APIs, etc.) and monitor abnormal results to discover software faults or vulnerabilities. Fuzz testing technology is similar to boundary value analysis (Boundary Value Analysis, BVA) in software testing, but in implementation, fuzz testing not only focuses on boundary values, but also uses any data that may cause target vulnerabilities. Similarly, Fuzzer is different from traditional vulnerability scanning tools. In intelligent fuzz testing, the most important thing is to generate efficient mutation samples. The research on intelligent fuzz testing technology also mainly revolves around how to generate efficient samples. The system includes intelligent fuzz testing technology based on model constraints, intelligent fuzz testing technology based on symbolic execution, intelligent fuzz testing technology based on path feedback, etc. This module project consists of four modules: software component code probe module, sample generation module, transceiver control module and virtual platform. It refers to conducting different depths and intelligent tests according to the actual conditions of different software components, traversing as many path branches in software components as possible, triggering more new execution paths, improving the penetration ability of samples, improving fuzz testing efficiency and vulnerability triggering rate, and combining software component vulnerability mining technology with software component plug-in technology and software component simulation environment construction technology to efficiently guide software component vulnerability analysis.

[0066] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. An intelligent vulnerability mining system for a real-time operating system, characterized in that: The system includes a firmware simulation analysis module, a semantic recognition test module, a similarity theory test module and an intelligent fuzzy test module; The firmware simulation analysis module includes a user interface layer, a core data analysis layer, an intelligent virtual resource allocation layer and a simulation system resource support layer, wherein the user interface layer includes a user control station, a simulation page, fixed analysis utilities, quick instructions, fixed vulnerabilities and vulnerability feedback; the core data analysis layer includes the analysis and repair of the firmware file system, as well as the implantation of hijacked files, dependent files, analysis and tracking scripts, and debugging commands; the intelligent virtual resource allocation layer allocates all computing resources through scheduling to enable the simulation simulator to run correctly, and at the same time enables the process resource monitoring of the simulator; The simulation system resource support layer is used to support the distributed deployment of the entire system; The semantic recognition module starts from three levels: directory composition features, file structure features, and code semantics code block matching test analysis features, and judges and screens the comparison targets step by step from top to bottom, from external features to internal logic; The similarity theory test module takes the feature similarity vectors of a pair of similar codes as input and their similarity measurement values ​​as expected output, and continuously adjusts the influence weights of each feature comparison analysis result through training, thereby realizing a reasonable mapping from the code feature vector to the comparison analysis result; The intelligent fuzz testing module includes a binary program patching module, a software component operation simulation module and a fuzz testing module. Through the mutual cooperation of the patching module, the simulation operation module and the fuzz testing module, multi-granularity fuzz testing of basic software, software components and protocols is achieved.

2. The intelligent vulnerability mining system for a real-time operating system according to claim 1, characterized in that: The firmware simulation analysis module first conducts basic firmware analysis research to realize firmware unpacking, ELF file analysis, operating system identification, instruction set identification, file system format identification, and manufacturer model identification, and realizes the construction of firmware dynamic analysis environment through coarse-grained matching library function identification function.

3. The intelligent vulnerability mining system for a real-time operating system according to claim 1, characterized in that: The semantic recognition module distinguishes source code and binary code at the file structure level, makes similarity judgments on source code from the perspective of syntax tree and clustering methods, and judges similarity on binary code by comparing program structures. For binary code, similarity judgments based on forward deduction and similarity judgments based on dependency features are used.

4. The intelligent vulnerability mining system for a real-time operating system according to claim 1, characterized in that: The similarity theory test module is implemented by the following two steps: Step 1: construct a training set based on the feature similarity vector of a pair of codes, and use the BP algorithm to train to obtain the connection weights and thresholds of each node in the hidden layer and output layer of the neural network; Step 2: Use the trained neural network to compare and analyze the code samples, and convert the similarity of the two samples about n features into an n-tuple X=(X1,X2,...,X n ) is used as the input vector of the neural network and is input into the neural network to obtain an output value y∈(0,1).

5. The intelligent vulnerability mining system and method for a real-time operating system according to claim 1, characterized in that: The intelligent fuzzy testing module modifies the file structure of the software components through the static probe method, inserts the code for recording the program running path, thereby monitoring the program running status, and uses the model constraints and swarm intelligence algorithm to extract the execution path to perform targeted mutations.

6. A vulnerability mining method of the intelligent vulnerability mining system of the real-time operating system according to any one of claims 1 to 5, characterized in that: The similarity theory module also includes a code feature similarity calculation method, a code comparison method based on BP neural network, and a threshold selection and similarity calculation method; The method for calculating the similarity of code features is to extract the features of each code sample, represent it as a fixed-length feature vector, and then use an appropriate distance metric to calculate the similarity between two feature vectors, and finally obtain a non-negative scalar.

7. The method of the intelligent vulnerability mining system of the real-time operating system according to claim 6, characterized in that: The selection of the threshold adopts the method of adaptive threshold, and the programs formed by various modification methods are compared with the source program N times in similarity to calculate the adaptive threshold Sim, and the calculation formula is as follows: Where Smax is the maximum similarity value obtained in N detections, and Smin is the minimum similarity value obtained in N detections. According to a large number of experiments, the adaptive threshold is 83%.

8. The method of the intelligent vulnerability mining system of the real-time operating system according to claim 6, characterized in that: The similarity calculation for the node definition node format is as follows: INFO k ∈{INFO N |N∈{TN},CC N =i} The node hash value is Hk, and the corresponding code start line of the node is StN x , Code End Behavior EdN x ; If Hx = Hy, then the source code segments corresponding to node X and node Y are considered to be similar source code, and (INFO x ,INFO y ) is included into a set, according to StN x EdN x The repeated stored elements are removed from StNy to avoid repeated calculation of similarity, forming a similar node information set SMINFO. The similarity SD of the target source code relative to the sample source code is calculated using the following formula: Where X is the target syntax tree node, and (INFO x , StN y )∈SMINFO, LC is the total number of valid lines in the target source code; For all (INFO x , StN y )∈SMINFO, according to INFO x NdT x Count the types of various similar data structures.

Images