Control flow anomaly detection method and device, electronic equipment and storage medium
By distinguishing the critical path and the secondary path in the industrial control system and inserting anomaly detection assertions into the corresponding basic group, the problem of low performance of traditional control flow analysis methods is solved, and the efficiency and coverage of abnormal detection are improved.
Patent Information
- Application Number
- CN202411232781.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-04
- Publication Date
- 2025-01-17
AI Technical Summary
The traditional label-based control flow analysis method has problems such as heavy performance burden, high resource consumption, detection confusion and high error rate in industrial control systems, making it difficult to effectively detect control flow abnormalities.
By obtaining the control flow diagram of the target industrial control system, distinguishing the critical path and the secondary path, establishing the first, second and third basic groups, and inserting exception detection assertions at the entrance and exit of these groups, reducing the number of assertions and reducing performance overhead , improve detection coverage.
The number of research units and insertion assertions is significantly reduced, performance overhead is reduced, coverage and efficiency of abnormal detection is improved, and normal operation state detection of control flow is ensured.
Smart Images
Figure CN119323030A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of control flow detection, and in particular to a control flow anomaly detection method, device, electronic equipment and storage medium. Background Art
[0002] As the impact of information security issues becomes more and more serious, various binary program analysis techniques are gaining more and more attention in the field of information security. Control flow analysis has been widely used in various binary program analysis techniques due to its important role in program analysis and vulnerability detection.
[0003] Traditional control flow analysis methods based on labeled assertions have gradually shown the problem of heavy performance burden. This method usually requires detailed labeling and assertions for each control flow path in the system, which makes the analysis process time-consuming and resource-intensive. Summary of the invention
[0004] In order to solve the above problems, the inventors have made the present invention, and through specific implementation methods, provide a control flow anomaly detection method, device, electronic device and storage medium.
[0005] In a first aspect, an embodiment of the present invention provides a control flow anomaly detection method, comprising:
[0006] Obtaining a control flow graph of a target industrial control system, and determining an execution path of the target industrial control system based on the control flow graph, wherein the control flow graph is a directed graph, the vertices of the control flow graph represent basic blocks of the target industrial control system, and the directed edges of the control flow graph represent directions of control flows;
[0007] Determining a critical path and a secondary path according to the number of vertices in the execution path;
[0008] Clipping the secondary path to obtain a clipped secondary path, wherein the starting basic block of the clipped secondary path is the entry of the program or the precursor is the key vertex, and the end vertex of the clipped secondary path is the terminal vertex or the precursor is the critical vertex;
[0009] Create the first, second, and third basic groups:
[0010] The first basic group includes vertices on the critical path;
[0011] The second basic group includes consecutive vertices except for the vertices on the critical path and having only one successor vertex;
[0012] The third basic group includes vertices on the clipping secondary path;
[0013] Taking the first basic group, the second basic group and the third basic group as research units, and inserting anomaly detection assertions at the exits and entrances of the research units;
[0014] When the target industrial control system is running, the running state of the current control flow is determined through the abnormal detection assertion.
[0015] In a second aspect, an embodiment of the present invention provides a control flow anomaly detection device, comprising:
[0016] An execution path generation module is used to obtain a control flow graph of a target industrial control system, and determine an execution path of the target industrial control system based on the control flow graph, wherein the control flow graph is a directed graph, the vertices of the control flow graph represent basic blocks of the target industrial control system, and the directed edges of the control flow graph represent directions of control flows;
[0017] A path processing module, configured to determine a critical path and a secondary path according to the number of vertices in the execution path; and to clip the secondary path to obtain a clipped secondary path, wherein the starting point of the clipped secondary path is the entry of the program or its predecessor is a critical vertex, and the end point is a terminal vertex or its predecessor is a critical vertex;
[0018] A grouping module, used to establish a first basic group, a second basic group and a third basic group: the first basic group includes vertices on the critical path; the second basic group includes continuous vertices with only one successor vertex except for the vertices on the critical path; the third basic group includes vertices on the clipping secondary path;
[0019] An assertion insertion module, used to use the first basic group, the second basic group and the third basic group as research units, and insert anomaly detection assertions at the exit and the entrance of the research units;
[0020] The detection module determines the running state of the current control flow through the abnormal detection assertion when the target industrial control system is running.
[0021] The beneficial effects of the above-mentioned technical solution provided by the embodiment of the present invention include at least: by distinguishing the execution path of the target industrial control system into a critical path and a secondary path, grouping them around the key vertices on the critical path, taking the first basic group, the second basic group and the third basic group as research units, and inserting anomaly detection assertions at the entrance and exit of the research unit, the research units are significantly reduced, the number of inserted assertions is reduced, the performance overhead is reduced, and the anomaly detection coverage of the research unit is guaranteed.
[0022] Other features and advantages of the present invention will be described in the following description, or will be understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.
[0023] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:
[0025] Figure 1 is a flow chart of a method in an embodiment of the present invention;
[0026] Figure 2 is a schematic diagram of a directed graph in an embodiment of the present invention;
[0027] Figure 3 A schematic diagram of a principle of jump verification in an embodiment of the present invention;
[0028] Figure 4 A schematic diagram of a program control flow in an embodiment of the present invention;
[0029] Figure 5 A schematic diagram of a principle of path matching in an embodiment of the present invention;
[0030] Figure 6 It is another schematic diagram of the program control flow in the embodiment of the present invention;
[0031] Figure 7 The figure is a schematic diagram of the structure of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION
[0032] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.
[0033] As the impact of information security issues becomes more and more serious, various binary program analysis technologies are gaining more and more attention in the field of information security. Control flow analysis has been widely used in various binary program analysis technologies due to its important role in program analysis and vulnerability detection. However, although various binary program analysis technologies currently have good results in theory, the accuracy and efficiency of these analysis technologies in practical applications need to be improved because the scale of software and its control flow graphs in the real world is often very large.
[0034] The functions of industrial control systems are mainly real-time data collection and monitoring, automatic operation of equipment and management of business processes, and monitoring of computer configurations. The main features of industrial control systems are real-time data transmission, data event-driven, and active data source push. Whether an industrial control system can operate normally directly determines the stability and reliability of its industrial control business. Traditional control flow analysis methods based on labeled assertions include CFCSS and RSCFC, and these two algorithms have their own advantages and disadvantages.
[0035] The CFCSS algorithm is suitable for programs with fewer precursors in basic blocks. It assigns a unique label to each basic module and adds the update and judgment statements at the beginning of each module. However, when multiple source modules enter another target module, CFCSS needs to introduce another adjustment label, and multiple source modules can be reached in multiple target modules. Since the update and judgment statements of CFCSS are located in the module header, the fault coverage of the algorithm is not high, and there are detection confusion and detection errors.
[0036] The RSCFC algorithm effectively avoids the blind spot detection of the CFCSS algorithm and improves the detection rate of control flow anomalies. But its weaknesses are also obvious. In RSCFC, the number of module labels is determined by the number of modules in the program, and the number of labels is limited by the word length of the machine. Therefore, the total number of modules is limited.
[0037] In order to solve the problems existing in the prior art, embodiments of the present invention provide a control flow anomaly detection method, device, electronic device and storage medium.
[0038] The embodiment of the present invention provides a control flow anomaly detection method, the process of which is as follows: Figure 1 As shown, the following steps are included:
[0039] Step S1: Obtain a control flow graph of the target industrial control system, and determine the execution path of the target industrial control system based on the control flow graph, wherein the control flow graph is a directed graph, the vertices of the control flow graph represent the basic blocks of the target industrial control system, and the directed edges of the control flow graph represent the direction of the control flow.
[0040] Among them, the control flow graph is used to show the possible execution paths during program execution.
[0041] For example, Figure 2 The control flow graph shown is a directed graph G = (V, E), V = {v1, v2, ..., vn} represents a finite set of vertices in the directed graph, each vertex represents a basic block; E = {e1, e2, ..., em} represents a finite set of directed edges in the directed graph, each vertex represents a basic block; each directed edge represents a program jump from the starting point to the end point. A multi-exit basic block can be composed of multiple dual-exit basic blocks, so the out-degree of the vertex in V is not greater than 2. There is a unique entry vertex V1 in the directed graph. The vertices in V include three types: vertices with one successor block, vertices with two successor blocks, and vertices without successor blocks; the execution paths of the control flow graph include control flow 1, control flow 2, control flow 3, and control flow 4.
[0042] Step S2: Determine the critical path and the secondary path according to the number of vertices in the execution path.
[0043] Among them, the critical path is the execution path that has the greatest impact on the overall performance or security of the system, and the secondary path is all paths except the critical path.
[0044] Specifically, the number of critical paths is n, where n is a positive integer greater than 1, and the value of n is designed according to the complexity of the target industrial control system.
[0045] Step S3: Clipping the secondary path to obtain a clipped secondary path, wherein the starting point of the clipped secondary path is the entry of the program or its predecessor is a key vertex, and the end point is a terminal vertex or its predecessor is a key vertex.
[0046] Among them, the key vertex is the entry or exit of the program, or the node that needs to be checked during the execution of the program. The terminal vertex is a vertex without a successor block. When the program executes to the terminal vertex, the result is returned or the program is terminated.
[0047] Step S4: Establish a first basic group, a second basic group and a third basic group: the first basic group includes vertices on the critical path; the second basic group includes continuous vertices with only one successor vertex except the vertices on the critical path; the third basic group includes vertices on the clipping secondary path.
[0048] Step S5: Take the first basic group, the second basic group and the third basic group as research units, and insert anomaly detection assertions at the exits and entrances of the research units.
[0049] Step S6: When the target industrial control system is running, the running state of the current control flow is determined through the abnormal detection assertion.
[0050] In the above method of this embodiment, by dividing the execution path of the target industrial control system into a critical path and a secondary path, grouping them around the vertices on the critical path, taking the first basic group, the second basic group and the third basic group as research units, and inserting anomaly detection assertions at the entrance and exit of the research units, the research units are significantly reduced, the number of inserted assertions is reduced, the performance overhead is reduced, and the anomaly detection coverage of the research units is guaranteed.
[0051] In the above method of this embodiment, determining the execution path of the target industrial control system based on the control flow graph includes the following steps:
[0052] Based on the depth-first traversal algorithm, all execution paths in the control flow graph are obtained; according to the graphic mark of the basic block, the execution path is encoded to obtain the corresponding path sequence number.
[0053] Each basic block corresponds to a unique graph tag, and the path sequence number is composed of the graph tag. Depth-First Search (DFS) is a method for traversing a directed graph G. The algorithm traverses the vertices of the directed graph G along V1. When all the edges where the vertex v is located have been explored, the search will backtrack to the starting node of the edge where the node v is found. This process continues until all vertices reachable from the source vertex V1 have been found.
[0054] For example, Figure 2 As shown, after deeply traversing the directed graph, control flow 1 to control flow 4 are obtained. Control flow 1 includes basic blocks (V1, V2, V3, V6, V8, V9), and the path sequence number is 123689.
[0055] In the above method of this embodiment, determining the critical path and the secondary path according to the number of vertices in the execution path includes the following steps:
[0056] A critical path and a secondary path are determined according to the length of the path sequence number of the execution path.
[0057] In a possible implementation, an execution path whose path sequence number length is greater than a length threshold is selected as a critical path, and the remaining execution paths are confirmed as secondary paths.
[0058] In a possible implementation, all execution paths are sorted in ascending and descending order based on the length of the path sequence number, and the execution paths in the front row are determined as critical paths, and the remaining execution paths are determined as secondary paths.
[0059] The above method of this embodiment further includes the following steps:
[0060] According to the execution frequency of the basic blocks, the weight of the jump process between the basic blocks is determined; according to the weight of the jump process between the basic blocks, the total weight of the execution path is obtained; based on the total weight of the execution path and the weight threshold, the critical path and the secondary path are determined in the execution path.
[0061] The above method of this embodiment further includes the following steps:
[0062] Exception detection assertions are inserted at the entry and exit of a basic program group so that when the basic program group jumps, a jump verification is performed on the jump situation; when the jump verification passes, the corresponding jump path is determined as a standard path, and a standard path set is generated; when the target industrial control system is running, the current control flow is obtained; according to the standard path set, the running state of the current control flow is determined; when the running state of the current control flow is abnormal, an alarm message is generated.
[0063] For example, Figure 3 and Figure 4 As shown, the three groups Si, Sj, and Sk are in the same program, Si is the predecessor of Sj, and Sl is a basic group in another program Program2.
[0064] In line ①, the static label recorded in T is the predecessor of Si and K = SLi. Therefore, the assertion if (K! = SLi) error can detect this exception.
[0065] In line ②, the static label K of the current group is equal to SLj, so the assertion if (K!=SL) error can detect this exception.
[0066] In line ③, Si is not the predecessor of Sj, the static label of the current group T = SLi and SL is equal to SLj. Therefore, the assertion if (T! = pre (SL)) error can detect this exception.
[0067] like Figure 5 and Figure 6 As shown, Si, Sj and Sk are three groups in the same program, Si is the predecessor of Sj, and Sl is a basic group in another program Program2.
[0068] In row ①, when n is equal to count, all P_Sub paths that are not the nth node in Si are removed. The P_Sub set does not contain the path count+1th node=Si, because SL=Sj and Sj!=P_sub[count], the anomaly can be detected.
[0069] In row ②, assume that Sp is the predecessor of Sj and Si.
[0070] When Sp does not exist, the assertion if (SL! = P_Sub[count]) error can detect this control flow exception. On the other hand, if Sp exists, it is executed. In this case, K = SLi is skipped because K = SL, and the current static label SL is equal to SLj, so the assertion if (K = SL) error can also detect this exception. The same is true for line ④.
[0071] In line ③, the assertion if(SL!=P_Sub[count])error can detect this control flow exception because there is no path containing Si→Sj in P_Sub.
[0072] In the above method of this embodiment, when the jump verification fails, the corresponding jump path is determined as an abnormal path.
[0073] In the above method of this embodiment, determining the running state of the current control flow according to the standard path set includes the following steps:
[0074] If the current control flow matches the standard path in the standard path set, it is determined that the running state of the current control flow is a normal state; if the current control flow does not match the standard path in the standard path set, it is determined that the running state of the current control flow is an abnormal state.
[0075] Those skilled in the art can change the above sequence without departing from the protection scope of the present disclosure.
[0076] Another embodiment of the present invention provides a control flow anomaly detection device, comprising:
[0077] An execution path generation module is used to obtain a control flow graph of a target industrial control system, and determine an execution path of the target industrial control system based on the control flow graph, wherein the control flow graph is a directed graph, the vertices of the control flow graph represent basic blocks of the target industrial control system, and the directed edges of the control flow graph represent directions of control flows;
[0078] A path processing module, configured to determine a critical path and a secondary path according to the number of vertices in the execution path; and to clip the secondary path to obtain a clipped secondary path, wherein the starting point of the clipped secondary path is the entry of the program or its predecessor is a critical vertex, and the end point is a terminal vertex or its predecessor is a critical vertex;
[0079] A grouping module, used to establish a first basic group, a second basic group and a third basic group: the first basic group includes vertices on the critical path; the second basic group includes continuous vertices with only one successor vertex except for the vertices on the critical path; the third basic group includes vertices on the clipping secondary path;
[0080] An assertion insertion module, used to use the first basic group, the second basic group and the third basic group as research units, and insert anomaly detection assertions at the exit and the entrance of the research units;
[0081] The detection module determines the running state of the current control flow through the abnormal detection assertion when the target industrial control system is running.
[0082] Regarding the system in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.
[0083] Based on the same inventive concept, an embodiment of the present invention further provides an electronic device, whose structure is as follows: Figure 7 As shown, it includes: a memory, a processor, and a computer program stored in the memory and running on the processor, and the processor implements the above-mentioned control flow anomaly detection method when executing the computer program.
[0084] Based on the same inventive concept, an embodiment of the present invention further provides a computer storage medium, in which computer executable instructions are stored. When the computer executable instructions are executed by a processor, the aforementioned control flow anomaly detection method is implemented.
[0085] Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention shall still fall within the patent scope of the present invention.
[0086] Unless otherwise stated, the "connection" mentioned above refers to a logical relationship of current transmission, and does not necessarily mean a direct electrical connection. At the same time, "first", "second", etc. do not indicate a sequence, but are only used to identify related units, devices, etc.
[0087] The present invention is not limited to the above voltage levels, which are merely voltage levels in the embodiments.
Claims
1. A control flow anomaly detection method, characterized in that: The following steps are involved: Obtaining a control flow graph of a target industrial control system, and determining an execution path of the target industrial control system based on the control flow graph, wherein the control flow graph is a directed graph, the vertices of the control flow graph represent basic blocks of the target industrial control system, and the directed edges of the control flow graph represent directions of control flows; Determining a critical path and a secondary path according to the number of vertices in the execution path; Clipping the secondary path to obtain a clipped secondary path, wherein the starting point of the clipped secondary path is the entry of the program or its predecessor is a key vertex, and the end point is a terminal vertex or its predecessor is a key vertex; Create the first, second, and third basic groups: The first basic group includes vertices on the critical path; The second basic group includes consecutive vertices except for the vertices on the critical path and having only one successor vertex; The third basic group includes vertices on the clipping secondary path; Taking the first basic group, the second basic group and the third basic group as research units, and inserting anomaly detection assertions at the exits and entrances of the research units; When the target industrial control system is running, the running state of the current control flow is determined through the abnormal detection assertion.
2. The method according to claim 1, characterized in that Determining the execution path of the target industrial control system based on the control flow graph includes the following steps: Based on the depth-first traversal algorithm, all execution paths in the control flow graph are obtained; The execution path is encoded according to the graphic mark of the basic block to obtain a corresponding path sequence number.
3. The method according to claim 1, characterized in that Determining the critical path and the secondary path according to the number of vertices in the execution path comprises the following steps: A critical path and a secondary path are determined according to the length of the path sequence number of the execution path.
4. The method according to any one of claims 1 to 3, characterized in that: The following steps are also included: Determine the weight of the jump process between basic blocks according to the execution frequency of the basic blocks; According to the weight of the jump process between basic blocks, the total weight of the execution path is obtained; Based on the total weight of the execution path and a weight threshold, a critical path and a secondary path are determined in the execution path.
5. The method according to claim 1, characterized in that The following steps are also included: Inserting an exception detection assertion at the entry and exit of a basic program group, so that when the basic program group jumps, the jump situation is verified; When the jump verification passes, the corresponding jump path is determined as a standard path, and a standard path set is generated; When the target industrial control system is running, obtaining a current control flow; Determining the running state of the current control flow according to the standard path set; When the running state of the current control flow is abnormal, an alarm message is generated.
6. The method according to claim 5, characterized in that The following steps are also included: When the jump verification fails, the corresponding jump path is determined as an abnormal path.
7. The method according to claim 5, characterized in that Determining the running state of the current control flow according to the standard path set comprises the following steps: If the current control flow matches the standard path in the standard path set, determining that the running state of the current control flow is a normal state; If the current control flow does not match the standard path in the standard path set, it is determined that the running state of the current control flow is an abnormal state.
8. A control flow anomaly detection device, characterized in that: include: An execution path generation module is used to obtain a control flow graph of a target industrial control system, and determine an execution path of the target industrial control system based on the control flow graph, wherein the control flow graph is a directed graph, the vertices of the control flow graph represent basic blocks of the target industrial control system, and the directed edges of the control flow graph represent directions of control flows; A path processing module, configured to determine a critical path and a secondary path according to the number of vertices in the execution path; and to clip the secondary path to obtain a clipped secondary path, wherein the starting point of the clipped secondary path is the entry of the program or its predecessor is a critical vertex, and the end point is a terminal vertex or its predecessor is a critical vertex; A grouping module, used to establish a first basic group, a second basic group and a third basic group: the first basic group includes vertices on the critical path; the second basic group includes continuous vertices with only one successor vertex except for the vertices on the critical path; the third basic group includes vertices on the clipping secondary path; An assertion insertion module, used to use the first basic group, the second basic group and the third basic group as research units, and insert anomaly detection assertions at the exit and the entrance of the research units; The detection module determines the running state of the current control flow through the abnormal detection assertion when the target industrial control system is running.
9. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements the control flow anomaly detection method according to any one of claims 1 to 7 when executing the computer program.
10. A computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, which, when executed, implement the control flow anomaly detection method described in any one of claims 1 to 7.