Vulnerability detection method and device for Internet of Things device, and storage medium

Abstract

The embodiment of the invention provides a vulnerability detection method and equipment for Internet of Things equipment and a storage medium, and relates to the technical field of vulnerability detection. The method comprises the following steps: acquiring network traffic of a target Internet of Things system in real time, and performing traffic recombination based on quintuple information of each data packet in the network traffic to obtain a to-be-detected traffic set; identifying a target protocol type of the to-be-detected traffic set, and determining a feature information extraction rule corresponding to the target protocol type; extracting feature information corresponding to the to-be-detected traffic set based on a feature information extraction rule; and matching the feature information with a preset vulnerability information base to obtain a vulnerability detection result corresponding to the to-be-detected traffic set. According to the embodiment of the invention, by adopting a mode of passively acquiring the network flow and extracting the features according to different protocol types for vulnerability matching, the influence on network resources or equipment computing resources of the Internet of Things system is avoided, and thus the reliability of vulnerability detection is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of vulnerability detection technology, and more specifically, to a vulnerability detection method, device, and storage medium for an Internet of Things device. Background Art

[0002] With the rapid development of IoT technology, an increasing number of smart devices are being connected to the internet, and these IoT technologies are being applied in many fields, including smart homes, industrial automation, and healthcare. However, the security issues of IoT devices have also become prominent, as these devices often become targets for hacker attacks. Therefore, to ensure the security and reliability of IoT systems, it is necessary to regularly perform security vulnerability detection and scanning on these devices.

[0003] Existing vulnerability scanning technologies primarily employ proactive scanning methods. These include using vulnerability scanning tools to scan devices for known security vulnerabilities, or simulating hacker attacks to perform penetration tests on IoT devices to discover potential vulnerabilities and attack paths. However, these proactive vulnerability scanning technologies often require sending a large number of probe data packets to the target device, consuming significant network resources and impacting the normal operation of the IoT. This is especially true for low-performance IoT terminals, where vulnerability scanning can consume substantial computing resources, causing devices to run slowly or lag, or even temporarily malfunction.

[0004] In summary, there is an urgent need for a vulnerability scanning solution that can avoid affecting the performance of IoT devices. Summary of the Invention

[0005] The purpose of the embodiments of the present application is to provide a vulnerability detection method, device and storage medium for an IoT device, which can avoid affecting the performance of the IoT device during the vulnerability scanning process.

[0006] In a first aspect, an embodiment of the present application provides a vulnerability detection method for an IoT device, comprising:

[0007] Acquire the network traffic of the target IoT system in real time, and reassemble the traffic based on the five-tuple information of each data packet in the network traffic to obtain a traffic set to be detected;

[0008] Identifying a target protocol type of the traffic set to be detected, and determining a feature information extraction rule corresponding to the target protocol type;

[0009] Extracting characteristic information corresponding to the traffic set to be detected based on the characteristic information extraction rule; wherein the characteristic information includes the Internet of Things service name and version number information;

[0010] The feature information is matched with a preset vulnerability information database to obtain vulnerability detection results corresponding to the traffic set to be detected.

[0011] In the embodiment of the present application, by passively acquiring network traffic and extracting features according to different protocol types for vulnerability matching, the impact on the network resources or device computing resources of the Internet of Things system is avoided, and the reliability of vulnerability detection is effectively improved.

[0012] In some possible embodiments, the real-time acquisition of network traffic of the target IoT system and the traffic reassembly based on the five-tuple information of each data packet in the network traffic to obtain a traffic set to be detected include:

[0013] Based on a preset traffic distribution strategy, the network traffic of the target IoT system is acquired in real time using a multi-threaded path.

[0014] For the network traffic acquired by each thread path, the traffic is reassembled based on the five-tuple information of each data packet in the network traffic to obtain the traffic set to be detected.

[0015] In this embodiment of the application, the efficiency of vulnerability detection is further improved by using a multi-threaded approach for traffic acquisition and vulnerability detection.

[0016] In some possible embodiments, the traffic distribution strategy is used to restrict data packets with the same 5-tuple information from flowing to the same thread path in the multi-threaded path.

[0017] In an embodiment of the present application, by ensuring that the same five-tuple data flows to the same thread path, it is possible to avoid repeated data processing and unnecessary data interaction between different threads, thereby further improving vulnerability detection efficiency.

[0018] In some possible embodiments, identifying the target protocol type of the traffic set to be detected includes:

[0019] The traffic set to be detected is matched with a preset matching rule library, and the target protocol type corresponding to the traffic set to be detected is determined based on the matched protocol matching rule; wherein the matching rule library includes at least one predefined protocol matching rule.

[0020] In this embodiment of the application, by setting the function of custom protocol identification rules, different detected protocol objects can be set according to business needs, thereby effectively improving the scalability of vulnerability detection.

[0021] In some possible embodiments, before identifying the target protocol type of the traffic set to be detected and determining the feature information extraction rules corresponding to the target protocol type, the method further includes:

[0022] The five-tuple information of the traffic set to be detected is matched with the five-tuple cache database; wherein, the five-tuple cache database stores five-tuple information that has been detected for vulnerabilities within a preset first period;

[0023] If the 5-tuple information matches the 5-tuple cache database, the vulnerability detection process for the traffic set to be detected is omitted.

[0024] In this embodiment of the application, by caching the quintuple information, the process of performing vulnerability detection on data with the same quintuple is omitted within a certain period, thereby further improving the overall vulnerability detection efficiency.

[0025] In some possible embodiments, the feature information is matched with a preset vulnerability information database to obtain vulnerability detection results corresponding to the traffic set to be detected, including:

[0026] The feature information is matched with the detection result cache database; wherein, the detection result cache database stores vulnerability detection results and their corresponding feature information obtained within a preset second period;

[0027] If the feature information matches the detection result cache database, the matching result is obtained from the detection result cache database as the vulnerability detection result corresponding to the traffic set to be detected;

[0028] If the feature information does not match the detection result cache database, the feature information is matched with a preset vulnerability information database to obtain the vulnerability detection result corresponding to the traffic set to be detected.

[0029] In this embodiment of the application, by caching the vulnerability detection results and first querying the vulnerability detection results corresponding to the current feature information from the cached data, the amount of computation for vulnerability matching is reduced, thereby further improving the efficiency of vulnerability detection.

[0030] In some possible embodiments, the vulnerability detection method for the IoT device further includes:

[0031] In response to the vulnerability information update command, the vulnerability information database is updated based on the vulnerability information update command, and the data stored in the detection result cache database is cleared.

[0032] In this embodiment of the application, by simultaneously clearing the data in the detection result cache database when updating the vulnerability information database, the efficiency and reliability of vulnerability detection are effectively balanced.

[0033] Secondly, embodiments of this application provide a vulnerability detection device for Internet of Things (IoT) devices, comprising:

[0034] The traffic acquisition module is used to acquire the network traffic of the target IoT system in real time, and to reassemble the traffic based on the five-tuple information of each data packet in the network traffic to obtain the traffic set to be detected.

[0035] The protocol identification module is used to identify the target protocol type of the traffic set to be detected and to determine the feature information extraction rules corresponding to the target protocol type;

[0036] The feature extraction module is used to extract feature information corresponding to the traffic set to be detected based on the feature information extraction rules; wherein, the feature information includes IoT service name and version number information;

[0037] The vulnerability detection module is used to match the characteristic information with a preset vulnerability information library to obtain a vulnerability detection result corresponding to the traffic set to be detected.

[0038] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the method described in any embodiment of the first aspect.

[0039] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0040] Fifthly, embodiments of this application provide a computer program product, the computer program product including a computer program, wherein when the computer program is executed by a processor, it can implement the method described in any embodiment of the first aspect. Attached Figure Description

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0042] Figure 1 A flowchart illustrating a vulnerability detection method for an Internet of Things (IoT) device provided in this application embodiment;

[0043] Figure 2This is a schematic diagram of the structure of a vulnerability detection device for an Internet of Things (IoT) device provided in an embodiment of this application;

[0044] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. DETAILED DESCRIPTION

[0045] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0046] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0047] It should be noted that existing technologies mainly use active detection techniques to detect vulnerabilities in IoT devices. This not only consumes network resources of the IoT system, but also consumes computing resources of the IoT devices themselves, thus affecting the normal operation of IoT devices and networks.

[0048] In response to this, this application provides a vulnerability detection method for IoT devices. By passively acquiring network traffic of the IoT system, vulnerability detection of IoT devices is performed, thereby effectively avoiding impact on the normal operation of the IoT system's network and devices, and effectively improving the reliability of vulnerability detection.

[0049] like Figure 1 As shown in the figure, this application provides a vulnerability detection method for IoT devices, which may include the following steps:

[0050] S1. Obtain the network traffic of the target IoT system in real time, and reassemble the traffic based on the five-tuple information of each data packet in the network traffic to obtain the traffic set to be detected.

[0051] Specifically, a gateway connected to the IoT system, either in a bypass or serial connection, can be used to monitor and capture network traffic for vulnerability detection. When accessing the IoT system via a bypass, a mirror of the IoT traffic must be synchronized to the gateway, allowing access to all communication traffic within the IoT system. Furthermore, the port and / or IP range of the IoT traffic to be monitored can be set, allowing network traffic within a specific range to be captured as needed.

[0052] For example, traffic acquisition can employ the AF-PACKET fan-out group mechanism. AF-PACKET is a network packet capture framework in the Linux operating system kernel that allows applications to directly access data packets at the data link layer (Layer 2 of the OSI model). By using the AF-PACKET fan-out group mechanism, user-space applications can send and receive raw data frames without going through the traditional network protocol stack. This allows developers to implement custom protocol stacks or network tools in user space, such as sniffers and firewalls.

[0053] After acquiring network traffic, traffic reassembly can be performed based on the five-tuple information of each captured data packet, so that packets with the same five-tuple information are combined to form the traffic set to be tested. The time window or traffic set data length based on which traffic reassembly is performed can be set according to business requirements. It should be noted that the five-tuple information refers to the source IP address, source port, destination IP address, destination port, and transport layer protocol of the traffic packet.

[0054] S2. Identify the target protocol type of the traffic set to be detected, and determine the feature information extraction rules corresponding to the target protocol type.

[0055] Specifically, after each reorganization to obtain a traffic set to be detected, it is necessary to first identify the protocol type of the traffic set to be detected and determine the corresponding feature information extraction rules based on the protocol type. It is understandable that feature information extraction rules corresponding to different protocol types can be pre-set according to actual business needs.

[0056] S3. Extract characteristic information corresponding to the traffic set to be detected based on characteristic information extraction rules; wherein the characteristic information includes the IoT service name and version number information.

[0057] Specifically, according to the feature information extraction rules, the traffic set to be detected can be matched with rules, and the corresponding feature information in the traffic set to be detected can be extracted if the matching conditions are met, wherein the information items of the feature information at least include the IoT service name and version number information.

[0058] S4. Match the feature information with the preset vulnerability information database to obtain the vulnerability detection results corresponding to the traffic set to be detected.

[0059] Specifically, based on the extracted feature information, it can be feature matched with the preset vulnerability information library. When the match hits the corresponding feature, the vulnerability detection result of the traffic set to be detected is that there is a vulnerability. In any case, there is no vulnerability in the detection traffic set.

[0060] Based on this, by passively acquiring network traffic and extracting features based on the protocol type of the traffic set, and matching vulnerabilities based on the extracted features, it is possible to effectively avoid affecting the network or device computing resources of the IoT system, thereby improving the reliability of vulnerability detection.

[0061] In some possible embodiments, step S1, obtaining network traffic of the target IoT system in real time and reassembling the traffic based on the five-tuple information of each data packet in the network traffic to obtain a traffic set to be detected, may include:

[0062] S101, based on a preset traffic distribution strategy, using a multi-threaded path to obtain the network traffic of the target IoT system in real time;

[0063] S102 : For the network traffic obtained by each thread path, traffic reorganization is performed based on the five-tuple information of each data packet in the network traffic to obtain a traffic set to be detected.

[0064] It should be noted that since traffic monitoring systems typically use multi-core CPUs, to maximize the performance of multi-core CPUs, multiple threads can be set up to acquire traffic and process the traffic using multiple CPU cores. The number of multi-threaded paths can be set to equal the number of CPU cores, and each threaded path is bound to a CPU core in a one-to-one relationship.

[0065] It should be noted that a traffic distribution strategy can be set at the kernel layer for acquiring traffic. When each data packet (unit of network traffic) is captured at the kernel layer, it is distributed to each path in the multi-threaded path through a pre-set traffic distribution mechanism. For example, a random distribution strategy can be adopted, or a strategy of adaptive distribution based on the busyness of each thread path can be adopted.

[0066] Based on this, we adopt a multi-threaded approach to acquire traffic and use multiple cores of the CPU to process the corresponding data traffic for vulnerability detection, thereby further improving the efficiency of vulnerability detection.

[0067] In some possible embodiments, the traffic distribution policy is used to restrict data packets with the same five-tuple information from flowing to the same thread path in the multi-thread path.

[0068] Understandably, before vulnerability detection, data packets with the same five-tuple information need to be reassembled into a set of traffic to be detected. Therefore, when different thread paths obtain data packets with the same five-tuple information, data communication is required between these threads to reassemble these data packets with the same five-tuple information. This will cause the system to consume additional resources to maintain inter-thread communication.

[0069] Therefore, by setting a traffic distribution strategy to restrict data packets with the same 5-tuple information from flowing to the same thread path, there is no need to consume additional resources to maintain inter-thread communication. Instead, the CPU cores can directly use the data packets obtained based on the corresponding thread paths to reassemble the traffic and perform vulnerability detection, which effectively improves the overall vulnerability detection efficiency.

[0070] For example, the traffic distribution strategy can be configured to, after capturing each packet, calculate the hash value of the packet's five-tuple information, calculate the remainder of the hash value divided by the number of CPU cores, and then distribute the packet to the corresponding thread path based on the remainder.

[0071] In some possible embodiments, in step S2, identifying the target protocol type of the traffic set to be detected includes:

[0072] The traffic set to be detected is matched with a preset matching rule library, and the target protocol type corresponding to the traffic set to be detected is determined based on the matched protocol matching rule; wherein, the matching rule library includes at least one predefined protocol matching rule.

[0073] Specifically, at least one protocol matching rule can be configured according to the actual business requirements for vulnerability detection and added to the preset matching rule library. In the step of identifying the protocol type of the traffic set to be detected, the traffic set to be detected can be matched against each protocol matching rule in the matching rule library in turn. If a match is found, the target protocol type of the traffic set to be detected is determined according to the matched protocol matching rule; if no match is found, a preset default value can be returned, which can indicate that no corresponding protocol type was matched, and the subsequent vulnerability detection process for the traffic set to be detected is abandoned.

[0074] It is understood that a protocol matching rule may include at least one matching item and a corresponding result item, wherein the matching item is used to indicate the conditions or rules that the traffic set to be detected needs to meet, and the result item indicates the protocol type to which the traffic set to be detected belongs when all the matching items of the protocol matching rule are successfully matched.

[0075] For example, the protocol matching rules used to identify the FTP protocol can be shown in the following table:

[0076]

[0077] For example, the protocol matching rules for identifying the SIP protocol may be shown in the following table:

[0078]

[0079] It should be noted that, in addition to the protocol matching rules listed above, protocol matching rules for other protocol types can be configured according to actual business needs, and the matching rule base can be added, deleted, and modified according to vulnerability detection requirements. Furthermore, during the matching process, different matching items of the same protocol matching rule can be matched in any order; this application is not limited to the matching order listed in the table above.

[0080] It is understandable that, compared to existing technologies that develop vulnerability scanning tools only for specific protocols, the embodiments of this application, by setting custom protocol matching rules, can identify different protocol types according to business needs and use the data traffic of the corresponding protocol type as the object of vulnerability detection, effectively improving the flexibility and scalability of vulnerability detection.

[0081] It should be noted that after identifying the protocol type of the traffic set to be detected, corresponding feature extraction rules can be applied to extract features from the traffic set based on that protocol type. Similar to protocol type identification based on a matching rule base, feature extraction rules can also be implemented by importing rules from a rule base. Specifically, corresponding feature extraction rules can be configured for different protocol types to form a feature extraction rule base. Furthermore, feature extraction rules in the rule base can be added, deleted, and customized as needed.

[0082] For example, the feature information extraction rules for the FTP protocol may be shown in the following table:

[0083]

[0084] For example, the feature information extraction rules for the SIP protocol can be shown in the following table:

[0085]

[0086]

[0087] In the table of feature extraction rules, the matching items indicate the conditions or rules that the traffic set to be detected must meet, while the result items and extraction items represent the relevant feature information of the traffic set to be detected when it successfully matches all of the above matching items. It is understood that in practical applications, different matching items of the same feature extraction rule can be matched in any order. This application is not limited to the matching order listed in the table above. Furthermore, the type and quantity of feature information corresponding to the result items and extraction items of the same feature extraction rule can be set according to actual needs, and this application is not limited to the situations listed in the table above.

[0088] In some possible embodiments, before step S2, the following steps may also be included:

[0089] Matching the five-tuple information of the traffic set to be detected with the five-tuple cache database; wherein the five-tuple cache database stores the five-tuple information that has been tested for vulnerabilities within a preset first cycle;

[0090] If the 5-tuple information matches the 5-tuple cache database, the vulnerability detection process for the traffic set to be tested is omitted.

[0091] Specifically, a five-tuple cache database can be configured to cache five-tuple information. Each time a vulnerability detection is performed on a traffic set to be detected, the five-tuple information corresponding to that traffic set is cached in the five-tuple cache database. The caching duration is a preset first cycle (expired cached data is cleared in real time).

[0092] Therefore, before performing vulnerability detection (before identifying the protocol type), the reconstructed traffic set to be detected is filtered according to the five-tuple information. If the five-tuple information of the traffic set to be detected is successfully matched with the five-tuple cache database (indicating that the five-tuple cache database contains the same five-tuple information as the traffic set to be detected), it means that the data traffic with the same five-tuple information has been vulnerabilities detected within a certain period. At this time, the vulnerability detection process of the traffic set to be detected can be omitted, that is, the steps S2 to S4 of the traffic set to be detected are abandoned.

[0093] Based on this, by caching the 5-tuple information and identifying the traffic sets to be detected that have already undergone vulnerability detection within a preset period, unnecessary repeated vulnerability detection processes are avoided for these traffic sets, thereby saving the processing resources of the vulnerability detection system and further improving the overall vulnerability detection efficiency.

[0094] In some possible embodiments, step S4, matching the feature information with a preset vulnerability information database to obtain a vulnerability detection result corresponding to the traffic set to be detected, may include:

[0095] S401. Match the feature information with the detection result cache database; wherein, the detection result cache database stores the vulnerability detection results obtained within a preset second period and their corresponding feature information;

[0096] S402. If the feature information matches the detection result cache database, the matching result is obtained from the detection result cache database as the vulnerability detection result corresponding to the traffic set to be detected.

[0097] S403. If the feature information does not match the detection result cache database, the feature information will be matched with the preset vulnerability information database to obtain the vulnerability detection result corresponding to the traffic set to be detected.

[0098] Specifically, a detection result cache database can be pre-configured for vulnerability detection results. After each vulnerability detection of a traffic set to be detected, the feature information corresponding to the traffic set to be detected and the corresponding vulnerability detection results are bound and stored in the detection result cache database. The cache duration is a preset second cycle (expired cached data is cleared in real time).

[0099] Based on this, when performing vulnerability detection, the feature information of the traffic set to be detected can be matched with the detection result cache database first. If the match is successful (meaning that the same feature information exists in the detection result cache database), the detection result bound to the matched feature information can be directly obtained as the vulnerability detection result of the current traffic set to be detected, without having to match its feature information with the preset vulnerability information database.

[0100] Understandably, when there are many matching entries for feature information in the vulnerability information database, directly obtaining vulnerability detection results based on the detection result cache database with fewer matching entries can reduce the number of feature information matching operations and effectively improve the efficiency of obtaining vulnerability detection results.

[0101] In some embodiments, the following judgment condition can be added before step S4: determine whether the number of feature information matching entries in the vulnerability information database is less than the number of feature information matching entries in the detection result cache database. If yes, then step S4 is executed directly; otherwise, steps S401 to S403 are executed. Based on this, when obtaining vulnerability detection results, it can be ensured that databases with fewer matching entries are always prioritized for matching, thereby effectively improving the efficiency of obtaining vulnerability detection results.

[0102] In some possible embodiments, the vulnerability detection method for IoT devices may further include:

[0103] S5. In response to the vulnerability information update command, update the vulnerability information database based on the vulnerability information update command, and clear the data stored in the detection result cache database.

[0104] It should be noted that the feature information matching items in the vulnerability information database can be customized and updated according to actual needs. After updating the vulnerability information database, it is necessary to promptly clear the data stored in the detection result cache database to avoid mistakenly using outdated detection results as vulnerability detection results in step S402, thereby effectively balancing the efficiency and reliability of vulnerability detection.

[0105] Please refer to Figure 2 , Figure 2 The following is a block diagram showing the components of the vulnerability detection device for an Internet of Things device provided by some embodiments of the present application. Figure 1 Corresponding to the method embodiment, the various steps involved in the above method embodiment can be executed. The specific functions of the vulnerability detection device of the Internet of Things device can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0106] Figure 2 The vulnerability detection device of the Internet of Things device includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the vulnerability detection device of the Internet of Things device, and the vulnerability detection device of the Internet of Things device includes:

[0107] Traffic acquisition module 210 is used to acquire the network traffic of the target IoT system in real time and reassemble the traffic based on the five-tuple information of each data packet in the network traffic to obtain a traffic set to be detected;

[0108] The protocol identification module 220 is used to identify the target protocol type of the traffic set to be detected and determine the feature information extraction rules corresponding to the target protocol type;

[0109] A feature extraction module 230 is configured to extract feature information corresponding to the traffic set to be detected based on feature information extraction rules; wherein the feature information includes the IoT service name and version number information;

[0110] The vulnerability detection module 240 is used to match the feature information with a preset vulnerability information library to obtain a vulnerability detection result corresponding to the traffic set to be detected.

[0111] It can be understood that the above-mentioned device embodiment corresponds to the method embodiment of the present invention. The vulnerability detection device of an Internet of Things device provided by the embodiment of the present invention can implement the vulnerability detection method of an Internet of Things device provided by any method embodiment of the present invention.

[0112] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be elaborated here.

[0113] like Figure 3 As shown, some embodiments of the present application provide an electronic device 300, which includes: a memory 310, a processor 320, and a computer program stored in the memory 310 and executable on the processor 320, wherein the processor 320 reads the program from the memory 310 through the bus 330 and executes the program to implement a method of any embodiment of the vulnerability detection method for an IoT device as described above.

[0114] Processor 320 can process digital signals and may include various computing architectures. For example, it may be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 320 may be a microprocessor.

[0115] The memory 310 can be used to store instructions executed by the processor 320 or data related to the execution of instructions. These instructions and / or data may include code used to implement some or all of the functions of one or more modules described in the embodiments of this application. The processor 320 of this disclosure embodiment can be used to execute the instructions in the memory 310 to implement the methods shown above. The memory 310 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0116] Some embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, describes the method described in the method embodiments.

[0117] Some embodiments of this application also provide a computer program product that, when run on a computer, causes the computer to perform the methods described in the method embodiments.

[0118] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similarities between the various embodiments can be referred to in conjunction with each other. For device embodiments, since they are generally similar to method embodiments, their description is relatively simple, and for relevant details, reference can be made to the description of the method embodiments.

[0119] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of the devices, methods, and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment, or a portion of code, and the module, program segment, or a portion of code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0120] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0121] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0122] The foregoing is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures.

[0123] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0124] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

Claims

1. A vulnerability detection method for an Internet of Things device, characterized in that: include: Acquire the network traffic of the target IoT system in real time, and reorganize the traffic based on the five-tuple information of each data packet in the network traffic to obtain a traffic set to be detected; Identifying the target protocol type of the traffic set to be detected, and determining a feature information extraction rule corresponding to the target protocol type; Extracting characteristic information corresponding to the traffic set to be detected based on the characteristic information extraction rule; wherein the characteristic information includes the name and version number information of the Internet of Things service; The characteristic information is matched with a preset vulnerability information library to obtain a vulnerability detection result corresponding to the traffic set to be detected.

2. The vulnerability detection method for an Internet of Things device according to claim 1, characterized in that: The real-time acquisition of the network traffic of the target IoT system and the traffic reorganization based on the five-tuple information of each data packet in the network traffic to obtain the traffic set to be detected include: Based on the preset traffic distribution strategy, a multi-threaded path is used to obtain the network traffic of the target IoT system in real time; For the network traffic acquired by each thread path, traffic reorganization is performed based on the five-tuple information of each data packet in the network traffic to obtain a traffic set to be detected.

3. The vulnerability detection method for an Internet of Things device according to claim 2, characterized in that: The traffic distribution strategy is used to restrict data packets with the same five-tuple information from flowing to the same thread path in the multi-thread path.

4. The vulnerability detection method for an Internet of Things device according to claim 1, characterized in that: The identifying the target protocol type of the traffic set to be detected includes: The traffic set to be detected is matched with a preset matching rule library, and the target protocol type corresponding to the traffic set to be detected is determined based on the matched protocol matching rule; wherein the matching rule library includes at least one predefined protocol matching rule.

5. The vulnerability detection method for an Internet of Things device according to claim 1, characterized in that: Before identifying the target protocol type of the traffic set to be detected and determining a feature information extraction rule corresponding to the target protocol type, the method further includes: Matching the five-tuple information of the traffic set to be detected with the five-tuple cache database; wherein the five-tuple cache database stores the five-tuple information that has been tested for vulnerabilities within a preset first period; In the case where the five-tuple information successfully matches the five-tuple cache database, the vulnerability detection process for the traffic set to be detected is omitted.

6. The vulnerability detection method for an Internet of Things device according to claim 1, characterized in that: The characteristic information is matched with a preset vulnerability information library to obtain a vulnerability detection result corresponding to the traffic set to be detected, including: Matching the feature information with a detection result cache database; wherein the detection result cache database stores vulnerability detection results obtained within a preset second period and their corresponding feature information; In the case where the characteristic information successfully matches the detection result cache database, a matching hit result is obtained from the detection result cache database as a vulnerability detection result corresponding to the traffic set to be detected; In the case that the feature information and the detection result cache database are not successfully matched, the feature information is matched with a preset vulnerability information database to obtain a vulnerability detection result corresponding to the traffic set to be detected.

7. The vulnerability detection method for an Internet of Things device according to claim 6, characterized in that: Also includes: In response to the vulnerability information update instruction, the vulnerability information library is updated based on the vulnerability information update instruction, and the data stored in the detection result cache database is cleared.

8. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the vulnerability detection method for an Internet of Things device according to any one of claims 1 to 7 can be implemented when the processor executes the program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the vulnerability detection method for an Internet of Things device according to any one of claims 1 to 7 is executed.

10. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the vulnerability detection method for an Internet of Things device described in any one of claims 1 to 7 is implemented.

Images