Firmware vulnerability detection method and device, terminal equipment and computer program product

Abstract

The invention relates to a firmware vulnerability detection method and device, terminal equipment and a computer program product, and the method comprises the steps: carrying out the dynamic stain analysis of an executable program of to-be-detected firmware, and obtaining a plurality of stain propagation paths; performing risk assessment and complexity calculation on each taint propagation path to obtain a risk assessment value and a complexity value of each taint propagation path; the risk assessment value and the complexity value of the taint propagation path are input into a preset path scoring model, a path score is obtained, and the path score is in direct proportion to the risk assessment value and in inverse proportion to the complexity value; and performing symbolic execution on a plurality of target propagation paths in the plurality of taint propagation paths, and determining potential vulnerabilities in the to-be-detected firmware based on the symbolic execution result of each target propagation path, the path score of the target propagation path being greater than or equal to a first preset threshold. Through the method and the device, the problems of relatively high computing resource consumption and relatively low detection efficiency of performing vulnerability detection on the firmware in the power equipment are solved.

Description

Technical Field

[0001] The present application belongs to the field of firmware security technology, and in particular, relates to a firmware vulnerability detection method, apparatus, terminal device and computer program product. Background Art

[0002] With the continuous development of power grid technology, a large number of power equipment are connected to the power grid to provide diverse functions. At the same time, the security of power equipment has become increasingly important. Most power equipment is a resource-constrained embedded system. Firmware, as the core software in these embedded systems, is responsible for controlling power equipment and implementing specific functions. With the popularity of these embedded systems, the security of firmware has received unprecedented attention. Security vulnerabilities in firmware may lead to privacy leaks, service interruptions, and even physical damage to power equipment.

[0003] Normally, firmware vulnerability discovery methods can rely on taint analysis and symbolic execution. However, symbolic execution will encounter the path explosion problem in complex programs with many paths, that is, as the number of paths grows exponentially, the computational overhead will increase exponentially. In the power grid scenario where a large number of power devices are connected, due to the limitation of computing resources, it becomes infeasible to detect vulnerabilities in the firmware of each power device within a certain period of time, which will reduce the overall security of the power grid system.

[0004] Currently, no effective solution has been proposed for the problems of high computing resource consumption and low detection efficiency in vulnerability detection of firmware in power equipment in related technologies. Summary of the invention

[0005] The embodiments of the present application provide a firmware vulnerability detection method, apparatus, terminal device and computer program product to at least solve the problem of high computing resource consumption and low detection efficiency in vulnerability detection of firmware in power equipment in the related art.

[0006] In a first aspect, an embodiment of the present application provides a method for detecting firmware vulnerabilities, which is applied to vulnerability detection of firmware in power equipment, the method comprising: performing dynamic taint analysis on the executable program of the firmware to be detected to obtain multiple taint propagation paths; performing risk assessment and complexity calculation on each taint propagation path to obtain a risk assessment value and a complexity value corresponding to each taint propagation path; inputting the risk assessment value and complexity value of the taint propagation path into a preset path scoring model to obtain a path score output by the path scoring model, wherein the path score is directly proportional to the risk assessment value, and the path score is inversely proportional to the complexity value; performing symbolic execution on multiple target propagation paths among the multiple taint propagation paths, and determining potential vulnerabilities in the firmware to be detected based on the symbolic execution results corresponding to each target propagation path, wherein the path score of the target propagation path is greater than or equal to a first preset threshold.

[0007] In some embodiments, risk assessment and complexity calculation are performed on each taint propagation path to obtain the risk assessment value and complexity value corresponding to each taint propagation path, including: performing threat detection, vulnerability detection and attack simulation on each taint propagation path; calculating the risk assessment value corresponding to the taint propagation path based on the threat detection results, vulnerability detection results and attack simulation results corresponding to the taint propagation path; obtaining function call information, nested depth information and conditional judgment quantity information corresponding to each taint propagation path; calculating the complexity value corresponding to the taint propagation path based on the function call information, nested depth information and conditional judgment quantity information corresponding to the taint propagation path.

[0008] In some embodiments, symbolic execution of multiple target propagation paths among multiple taint propagation paths includes: when the number of target propagation paths that have been symbolically executed is less than a second preset threshold, comparing the path score of the taint propagation path with a first preset threshold, and when the path score is greater than or equal to the first preset threshold, treating the taint propagation path as a target propagation path for symbolic execution; when the number of target propagation paths that have been symbolically executed is greater than or equal to the second preset threshold, determining the average and standard deviation of the path scores of the multiple target propagation paths that have been symbolically executed; based on the average and standard deviation of the path scores, updating the first preset threshold, and using the updated first preset threshold as the first preset threshold; comparing the path score of the taint propagation path with the first preset threshold, and when the path score is greater than or equal to the first preset threshold, treating the taint propagation path as a target propagation path for symbolic execution.

[0009] In some embodiments, symbolically executing multiple target propagation paths among multiple taint propagation paths includes: sorting the multiple target propagation paths from high to low based on the path scores; and symbolically executing the target propagation paths in sequence from high to low from the sorted multiple target propagation paths.

[0010] In some embodiments, determining potential vulnerabilities in the firmware to be detected based on the symbolic execution results corresponding to each target propagation path includes: when the symbolic execution result corresponding to the target propagation path is that the path is unreachable, the target propagation path is eliminated; when the symbolic execution result corresponding to the target propagation path is that the path is reachable, the target propagation path is matched with a preset vulnerability feature library; when a target vulnerability corresponding to the target propagation path is matched in the vulnerability feature library, the target vulnerability is regarded as a potential vulnerability in the firmware to be detected.

[0011] In some embodiments, dynamic taint analysis is performed on the executable program of the firmware to be detected to obtain multiple taint propagation paths, including: collecting input data from each input source in the executable program, and marking each input data as a taint source; during the execution of the executable program, data flow analysis is performed on each taint source to obtain the taint propagation path corresponding to each taint source.

[0012] In some embodiments, the mathematical expression of the path scoring model is: Score(P)=α×Risk(P)-β×Complexity(P) Among them, Score(P) is the path score of the taint propagation path P, Risk(P) is the risk assessment value of the taint propagation path P, Complexity(P) is the complexity value of the taint propagation path P, α is the preset first weight factor, and β is the preset second weight factor.

[0013] In a second aspect, an embodiment of the present application provides a firmware vulnerability detection device, which is used for vulnerability detection of firmware in power equipment, and the device includes: an analysis module, which is used to perform dynamic taint analysis on the executable program of the firmware to be detected to obtain multiple taint propagation paths; a calculation module, which is used to perform risk assessment and complexity calculation on each taint propagation path to obtain a risk assessment value and complexity value corresponding to each taint propagation path; a scoring module, which is used to input the risk assessment value and complexity value of the taint propagation path into a preset path scoring model to obtain a path score output by the path scoring model, wherein the path score is directly proportional to the risk assessment value, and the path score is inversely proportional to the complexity value; a detection module, which is used to perform symbolic execution on multiple target propagation paths among the multiple taint propagation paths, and determine the potential vulnerabilities in the firmware to be detected based on the symbolic execution results corresponding to each target propagation path, wherein the path score of the target propagation path is greater than or equal to a first preset threshold.

[0014] In a third aspect, an embodiment of the present application provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for detecting a firmware vulnerability of any one of the above-mentioned first aspects is implemented.

[0015] In a fourth aspect, an embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed, the firmware vulnerability detection method described in any one of the above-mentioned first aspects is executed.

[0016] Compared with the related art, the firmware vulnerability detection method, device, terminal device and computer program product provided in the embodiment of the present application, by performing risk assessment and complexity calculation on the taint propagation path, and scoring the taint propagation path based on the risk assessment value and complexity value of the taint propagation path, the taint propagation path with a path score less than a preset threshold is eliminated, and only the target propagation path with a path score greater than or equal to the preset threshold is symbolically executed, and the potential vulnerabilities in the firmware to be detected are determined based on the symbolic execution results. In this way, the low-risk and / or high-complexity taint propagation paths can be pruned to reduce the computing resources required for subsequent symbolic execution, effectively improving the detection efficiency of firmware vulnerabilities, and making the automated firmware analysis of large-scale power equipment more feasible and efficient in a complex network environment. Through this application, the problem of high computing resource consumption and low detection efficiency in the firmware of power equipment for vulnerability detection in the related art is solved, and the technical effect of reducing the computing resource consumption of the firmware of the power equipment for vulnerability detection and improving the detection efficiency is achieved.

[0017] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 is a structural diagram of a firmware analysis system according to an embodiment of the present application; Figure 2 is a flow chart of a method for detecting a firmware vulnerability according to an embodiment of the present application; Figure 3 It is a structural schematic diagram of a firmware vulnerability detection device according to an embodiment of the present application; Figure 4 It is a structural diagram of a terminal device according to an embodiment of the present application. DETAILED DESCRIPTION

[0020] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0021] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0022] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0023] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0024] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0025] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0026] With the continuous development of power grid technology, a large number of power equipment (also known as power terminal equipment) are connected to the power grid to provide diverse functions. At the same time, the security of power equipment has become increasingly important. Most power equipment is a resource-constrained embedded system, and its software architecture is often complex and difficult to maintain, resulting in a large number of undiscovered or unfixed security vulnerabilities lurking in the system. Once these vulnerabilities are exploited by attackers, the control of the power equipment may be hijacked, posing a serious threat to the safe and stable operation of the power grid system.

[0027] Power terminal devices generally have a long update cycle, which means that once a security vulnerability appears, it may exist in these devices for a long time. These potential security risks provide attackers with opportunities to exploit vulnerabilities in power terminal devices. By exploiting the vulnerabilities in power terminal devices, attackers can remotely control the power terminal devices and use these power terminal devices as a springboard to launch larger-scale attacks. These attacks may further affect the main station or control center of the power grid system, causing paralysis of the power grid system or serious power supply accidents, seriously threatening the stability and security of the power grid. Therefore, ensuring the security of power terminal devices, especially vulnerability discovery and repair at the firmware level, has become a key task to ensure the safe operation of the power grid.

[0028] Normally, firmware vulnerability discovery methods can rely on taint analysis and symbolic execution. However, symbolic execution will encounter the problem of path explosion in complex programs with many paths, that is, as the number of paths increases exponentially, the computational overhead will increase exponentially. In the scenario of a power grid with a large number of power devices connected, due to the limitation of computing resources, it is not feasible to detect vulnerabilities in the firmware of each power device within a certain period of time. Even if parallel execution or distributed architecture is adopted, it may still be impossible to cover the firmware in all power devices due to the limitation of computing resources, which will reduce the overall security of the power grid system.

[0029] In addition, taint analysis and symbolic execution are prone to false positives on complex and fuzzy paths, especially when dealing with paths that contain uncertain inputs or environments. This generates a large amount of invalid data in firmware analysis in large-scale power equipment, increasing the computational load. In order to avoid path explosion, symbolic execution usually requires path pruning or constraint simplification, but this may also lead to missed reports of certain critical paths, which will reduce the overall security of the power grid system.

[0030] Currently, no effective solution has been proposed for the problems of high computing resource consumption and low detection efficiency in vulnerability detection of firmware in power equipment in related technologies.

[0031] In view of this, an embodiment of the present application provides a method for detecting firmware vulnerabilities, by performing risk assessment and complexity calculation on the taint propagation path, and scoring the taint propagation path based on the risk assessment value and complexity value of the taint propagation path, eliminating the taint propagation path with a path score less than a preset threshold, and only performing symbolic execution on the target propagation path with a path score greater than or equal to the preset threshold, and determining the potential vulnerabilities in the firmware to be detected based on the symbolic execution results. In this way, low-risk and / or high-complexity taint propagation paths can be pruned to reduce the computing resources required for subsequent symbolic execution, effectively improving the efficiency of firmware vulnerability detection, and making automated firmware analysis of large-scale power equipment more feasible and efficient in complex network environments. Through this application, the problem of high computing resource consumption and low detection efficiency in vulnerability detection of firmware in power equipment in the related art is solved, and the technical effect of reducing computing resource consumption and improving detection efficiency for vulnerability detection of firmware in power equipment is achieved.

[0032] The firmware vulnerability detection method provided in an embodiment of the present application can be applied to a firmware analysis system 1. Figure 1 is a schematic diagram of the structure of a firmware analysis system 1 according to an embodiment of the present application. Figure 1As shown, the firmware analysis system 1 may include: a data input module 10, a taint analysis module 11, a symbolic execution module 12, a pruning module 13, and a constraint solving module 14. The data input module 10 may establish a connection with the taint analysis module 11 through a wired network or a wireless network. The taint analysis module 11 may establish a connection with the symbolic execution module 12 and the constraint solving module 14 through a wired network or a wireless network. The symbolic execution module 12 may establish a connection with the pruning module 13 and the constraint solving module 14 through a wired network or a wireless network.

[0033] Among them, the data input module 10 includes a firmware parsing unit and a taint source identification unit. The firmware parsing unit is used to perform firmware parsing on the firmware to be detected of the power equipment to obtain the executable program of the firmware to be detected; the taint source identification unit is used to identify all input sources in the executable program during the execution of the executable program, and input all input sources as taint sources into the taint analysis module 11.

[0034] The taint analysis module 11 is used to perform dynamic taint analysis on each taint source based on data flow analysis technology, determine the taint propagation path generated by each taint source, and input the taint propagation path into the symbolic execution module 12 and the constraint solving module 14.

[0035] The pruning module 13 is used to score each taint propagation path based on the risk assessment value and complexity value of each taint propagation path using a heuristic search and pruning algorithm (HSPA), and decide whether to remove the taint propagation path based on the path score of the taint propagation path. Specifically, the taint propagation path whose path score is lower than the first preset threshold can be removed, so as to perform a pruning operation for multiple taint propagation paths that need to be symbolically executed later.

[0036] The symbolic execution module 12 is used to perform taint-guided symbolic execution (YGSE) on a target propagation path (a target propagation path is a taint propagation path whose path score is greater than or equal to a first preset threshold), and determines whether the target propagation path is reachable by using the path constraints of each target propagation path determined by the constraint solving module 14 based on a search strategy (for example, depth-first search or breadth-first search).

[0037] In some embodiments, the firmware analysis system 1 can be a mobile phone, tablet computer, desktop, laptop, handheld computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, as well as cellular phone, personal digital assistant (PDA), augmented reality (AR) \ virtual reality (VR) equipment and other equipment that can install and use content community applications, and the present application does not limit the specific implementation of the firmware analysis system 1. It can interact with the user through one or more methods such as keyboard, touchpad, touch screen, remote control, voice interaction or handwriting device.

[0038] In specific implementation, the firmware analysis system 1 can be used Figure 4 The composition results shown or include Figure 4 Parts shown. Figure 4 It is a structural diagram of a terminal device according to an embodiment of the present application. When the terminal device 4 has the function of the firmware analysis system 1 described in the embodiment of the present application, the terminal device 4 can be the firmware analysis system 1 or a chip or system on chip in the firmware analysis system 1.

[0039] The following will be combined Figure 2 The firmware vulnerability detection method provided by an embodiment of the present application is described. The firmware vulnerability detection method is applied to perform vulnerability detection on the firmware in the power equipment. Figure 2 , Figure 2 is a flowchart of a method for detecting a firmware vulnerability according to an embodiment of the present application, such as Figure 2 As shown, the method includes: Step S201, performing dynamic taint analysis on the executable program of the firmware to be detected to obtain multiple taint propagation paths.

[0040] In this embodiment, the characteristics of the power equipment can be identified, and the file system of the firmware to be detected can be read using a suitable access protocol, and binary data, executable programs, data structures, symbol information, etc. can be extracted.

[0041] Specifically, first, the firmware type of the firmware to be detected can be automatically identified based on the device characteristics of the power device (for example, communication interface, firmware format, etc.). For example, the structure of the firmware to be detected can be determined by using a feature matching algorithm and pattern recognition technology to identify the specific layout of the file system of the firmware to be detected.

[0042] Secondly, according to the firmware type of the firmware to be detected, select a corresponding debugging protocol (for example, JTAG (Joint Test Action Group), UART (Universal Asynchronous Receiver / Transmitter), etc.), and access the firmware to be detected through a corresponding interface.

[0043] Here, the access protocol is used to read the file system of the firmware to be tested and extract the necessary binary data. Usually, loops and conditional judgment structures are used to traverse the file system.

[0044] Finally, the extracted binary data is converted into assembly code and C language source code through the tool chain to facilitate subsequent analysis and understanding. The converted results are output in a standardized format to obtain the executable program of the firmware to be tested.

[0045] After obtaining the executable code of the firmware to be tested through the above steps, the taint source in the executable code can be dynamically identified based on dynamic taint analysis, providing the necessary data basis for subsequent analysis and displaying the program behavior in a structured manner.

[0046] Specifically, performing dynamic taint analysis on the executable program of the firmware to be detected to obtain multiple taint propagation paths may include: collecting input data from each input source in the executable program, and marking each input data as a taint source; during the execution of the executable program, performing data flow analysis on each taint source to obtain the taint propagation path corresponding to each taint source.

[0047] In this embodiment, all potential input sources (including user input, network input, file reading, etc.) can be monitored during the execution of the executable program. For example, a hook can be inserted at each key input function (e.g., recv, read, scanf) to collect input data. After collecting the input data, each input data can be marked as a taint source, and its source and type can be recorded (e.g., marking a taint source as "user input" or "network input"). Each taint source and its corresponding information can be stored in a taint source list for subsequent analysis.

[0048] Specifically, after collecting an input data, a taint tag (such as Taint(x)) can be assigned to it, which is used to record the type of the taint source. Taint propagation can follow specific rules, which can be expressed in mathematical form. Assuming x is the taint source and y is the variable that receives the tainted data, the propagation rule is expressed as: Taint(y)=Taint(x) Therefore, the taint propagation path can be represented as a path graph, where each node represents a data state and each edge represents data flow. For example, the taint propagation path can be represented as: P = {T1, T2, ⋯, T i} Among them, T i is the data status of the i-th tainted variable.

[0049] After marking each taint source through the above steps, data flow analysis can be performed on each taint source to obtain the taint propagation path corresponding to each taint source. Each taint source can generate multiple taint propagation paths.

[0050] Specifically, during the execution of the executable program, the flow path of the tainted variable can be tracked. Whenever the tainted variable undergoes an operation (e.g., assignment, arithmetic operation, function call, conditional judgment, etc.), its data state can be updated to record the tainted source and propagation path corresponding to the tainted variable. The propagation rules of tainted variables in different operations can be defined. For example, for the assignment operation y=x, if x is a tainted variable, y is also marked as a tainted variable. Therefore, each taint source can generate multiple taint propagation paths to ensure that each data affected by the tainted source and tainted variable is correctly marked.

[0051] In addition, for specific operations (e.g., data output, database query, etc.), if the tainted variables are not fully verified, it may lead to vulnerabilities. By monitoring the use of tainted variables, potential security risks can be identified. For example, when tainted variables are used for function calls, conditional judgments, or database queries, these operations can be analyzed for vulnerabilities and corresponding warning messages can be output.

[0052] Finally, the impact of tainted variables on program behavior can be calculated to assess potential security risks. For each tainted variable, its scope of influence can be recorded, that is, the security risks and vulnerabilities that may be triggered by the taint.

[0053] In this way, the taint source corresponding to the tainted variable can be identified in time and its propagation path in the executable program can be tracked, so as to efficiently locate potential vulnerabilities. By combining taint tracking with the multi-level architecture of the firmware to be tested in the power equipment, it is possible to conduct in-depth analysis of different components in the firmware to be tested (for example, the communication protocol stack, application layer code, etc.). The taint tracking can span multiple levels and identify the data transfer between different layers and its impact.

[0054] Step S202: Perform risk assessment and complexity calculation on each taint propagation path to obtain a risk assessment value and a complexity value corresponding to each taint propagation path.

[0055] In this embodiment, after obtaining multiple taint propagation paths, a heuristic search algorithm can be run to score each taint propagation path, and taint propagation paths with high risk assessment values ​​and low complexity are analyzed first. Therefore, it is necessary to first perform risk assessment and complexity calculation on each taint propagation path to obtain the risk assessment value and complexity value corresponding to each taint propagation path, thereby providing accurate data input for subsequent path scoring.

[0056] Specifically, performing risk assessment and complexity calculation on each taint propagation path to obtain a risk assessment value and a complexity value corresponding to each taint propagation path may include the following steps: Step 1: Perform threat detection, vulnerability detection, and attack simulation on each taint propagation path.

[0057] In this embodiment, threat detection can first be performed on the taint source, data flow and program behavior corresponding to the taint propagation path of the taint, and the threat detection results can be used to evaluate the possibility of potential threats (for example, malicious input, external attacks, etc.) in the taint propagation path.

[0058] In addition, the taint propagation path can be matched with a known vulnerability feature library (for example, the CVE (Common Vulnerabilities & Exposures) vulnerability library), or the program code corresponding to the taint propagation path can be reviewed and statically analyzed to detect vulnerabilities in the taint propagation path. The vulnerability detection results can be used to evaluate the possibility that the taint propagation path may have potential vulnerabilities.

[0059] Finally, based on the impact of the calculated taint propagation path on program behavior, the impact that the leakage or attack of the taint propagation path may have on power equipment can be evaluated, and attack simulation of the taint propagation path can be realized.

[0060] Step 2: Calculate the risk assessment value corresponding to the taint propagation path based on the threat detection results, vulnerability detection results, and attack simulation results corresponding to the taint propagation path.

[0061] In this embodiment, the risk assessment value of the taint propagation path can be calculated based on the following mathematical expression: Risk(P)=ω1×Threat(P)+ω2×Vulnerability(P)+ω3×Impact(P) Among them, Risk(P) is the risk assessment value of the taint propagation path P, Threat(P) is the quantified threat detection result (for example, the threat detection result can take any value from 0 to 1, and the closer the value is to 1, the higher the possibility that the taint propagation path P may have a potential threat), Vulnerability(P) is the quantified vulnerability detection result (for example, the vulnerability detection result can take any value from 0 to 1, and the closer the value is to 1, the greater the number of potential vulnerabilities that may exist in the taint propagation path P), Impact(P) is the quantified attack simulation result (for example, the attack simulation result can take any value from 0 to 1, and the closer the value is to 1, the greater the functional range of the power equipment affected by the taint propagation path P after being attacked), ω1, ω2 and ω3 are preset adjustment factors used to adjust the impact of threat detection results, vulnerability detection results and attack simulation results on the risk assessment value.

[0062] It should be noted that the mathematical expression for calculating the risk assessment value of the taint propagation path and the specific parameters in the mathematical expression can be set according to the specific environment and user needs in which the firmware vulnerability detection method provided in the embodiment of the present application is to be deployed, and the present application does not impose any restrictions on this.

[0063] Step 3: Obtain the function call information, nested depth information, and conditional judgment quantity information corresponding to each taint propagation path.

[0064] Step 4: Calculate the complexity value corresponding to the taint propagation path based on the function call information, nested depth information, and conditional judgment quantity information corresponding to the taint propagation path.

[0065] In this embodiment, the complexity value of the taint propagation path can be calculated based on the following mathematical expression: Complexity(P)=f(Calls, Loops, Branches) Where Complexity(P) is the complexity value of the taint propagation path P, Calls is the number of function calls in the taint propagation path P obtained based on the function call information, Loops is the nesting depth of the loop structure in the taint propagation path P obtained based on the nesting depth information, and Branches is the number of conditional judgments (for example, if statements, switch statements) in the taint propagation path P obtained based on the conditional judgment number information. f(Calls, Loops, Branches) can be expressed in a form similar to the mathematical expression for calculating the risk assessment value of the taint propagation path, for example, it can be expressed as: f(Calls, Loops, Branches)=ω4×Calls(P)+ω5×Loops(P)+ω6×Branches(P) Among them, ω4, ω5 and ω6 are preset adjustment factors, which are used to adjust the influence of function call information, nested depth information and condition judgment quantity information on the complexity value.

[0066] It should be noted that the mathematical expression for calculating the complexity value of the taint propagation path and the specific parameters in the mathematical expression can be set according to the specific environment and user needs in which the firmware vulnerability detection method provided in the embodiment of the present application is to be deployed, and the present application does not impose any restrictions on this.

[0067] Step S203, input the risk assessment value and complexity value of the taint propagation path into a preset path scoring model to obtain a path score output by the path scoring model, wherein the path score is directly proportional to the risk assessment value, and the path score is inversely proportional to the complexity value.

[0068] In this embodiment, a heuristic search and pruning algorithm (HSPA) can be used to score each taint propagation path based on the risk assessment value and complexity value of each taint propagation path, and decide whether to remove the taint propagation path based on the path score of the taint propagation path.

[0069] Specifically, the following mathematical expression can be used as the path scoring model: Score(P)=α×Risk(P)-β×Complexity(P) Among them, Score(P) is the path score of the taint propagation path P, Risk(P) is the risk assessment value of the taint propagation path P, Complexity(P) is the complexity value of the taint propagation path P, α is the preset first weight factor, β is the preset second weight factor, and α and β are used to adjust the influence of the risk assessment value and complexity value on the path score.

[0070] It can be seen from the mathematical expression of the above path scoring model that when the risk assessment value Risk(P) remains unchanged, the path score of the taint propagation path is inversely proportional to its complexity value Complexity(P); and when the complexity value Complexity(P) remains unchanged, the path score of the taint propagation path is directly proportional to its risk assessment value Risk(P).

[0071] The heuristic search algorithm can efficiently screen out the taint propagation paths with higher path scores as target propagation paths, for example, the taint propagation paths with path scores greater than the first preset threshold are used as target propagation paths. In this way, taint propagation paths with high risk (i.e., high risk assessment value) and low complexity (i.e., low complexity value) can be screened out, while taint propagation paths with low risk or high complexity can be eliminated, thereby reducing the waste of computing resources, optimizing the coverage and execution efficiency of subsequent symbolic execution, and thus reducing the computing resource consumption of vulnerability detection for firmware in power equipment and improving detection efficiency.

[0072] Step S204, symbolically executing multiple target propagation paths among the multiple taint propagation paths, and determining potential vulnerabilities in the firmware to be detected based on the symbolic execution results corresponding to each target propagation path, wherein the path score of the target propagation path is greater than or equal to a first preset threshold.

[0073] In this embodiment, a pruning algorithm can be used to perform pruning operations on taint propagation paths whose path scores are less than a first preset threshold, thereby eliminating low-risk, high-complexity taint propagation paths or redundant taint propagation paths, thereby reducing the consumption of computing resources and improving the detection efficiency of firmware vulnerabilities.

[0074] The first preset threshold can be dynamically adjusted according to the specific situation of the current symbolic execution. For example, as the analysis of the taint propagation path deepens, it can be automatically adjusted dynamically according to the path score of the target propagation path that has been symbolically executed and the user's security needs.

[0075] Specifically, symbolic execution of multiple target propagation paths among multiple taint propagation paths may include: when the number of target propagation paths that have been symbolically executed is less than a second preset threshold, comparing the path score of the taint propagation path with a first preset threshold, and when the path score is greater than or equal to the first preset threshold, treating the taint propagation path as a target propagation path for symbolic execution; when the number of target propagation paths that have been symbolically executed is greater than or equal to the second preset threshold, determining the average and standard deviation of the path scores of the multiple target propagation paths that have been symbolically executed; based on the average and standard deviation of the path scores, updating the first preset threshold, and using the updated first preset threshold as the first preset threshold; comparing the path score of the taint propagation path with the first preset threshold, and when the path score is greater than or equal to the first preset threshold, treating the taint propagation path as a target propagation path for symbolic execution.

[0076] In this embodiment, the second preset threshold is used to determine the progress of the taint propagation path analysis, which can be adjusted based on the number of taint propagation paths in the firmware to be detected. For example, the second preset threshold can be determined as 10%, 20%, etc. of the number of all taint propagation paths; and the initial first preset threshold can be set based on the historical analysis data of the firmware to be detected and user expectations, and this application does not impose any restrictions on this.

[0077] When the number of target propagation paths that have been symbolically executed is less than the second preset threshold, the path score of the taint propagation path that currently needs to be pruned can be compared with the initial first preset threshold. If the path score of the taint propagation path is greater than or equal to the initial first preset threshold, it is regarded as the target propagation path for symbolic execution. When the number of target propagation paths that have been symbolically executed is greater than or equal to the second preset threshold, since the number of target propagation paths that have been symbolically executed is already large, the following mathematical expression can be used to update the initial first preset threshold based on the path score of the target propagation path that has been symbolically executed: Threshold=μ current +k×σ current Wherein, Threshold is the first preset threshold after update, μ current The average path score of the paths propagated for the symbolically executed target, σ current is the standard deviation of the path score of the target propagation path that has been symbolically executed, and k is a preset adjustment factor used to adjust the sensitivity of the first preset threshold to the fluctuation of the path score of the target propagation path that has been symbolically executed.

[0078] By dynamically adjusting the first preset threshold based on the progress of the taint propagation path analysis, the pruning algorithm can adapt to the dynamically changing analysis environment, and the probability that the eliminated taint propagation path is called a critical path is greatly reduced, thereby reducing the false alarm rate and missed alarm rate of vulnerability detection of the firmware to be detected.

[0079] It should be noted that the above mathematical expressions and the parameters therein can be set according to the specific environment, user requirements and computing resource conditions in which the firmware vulnerability detection method provided in the embodiment of the present application is to be deployed, and the present application does not impose any restrictions on this.

[0080] In addition, in the above step S204, multiple target propagation paths may be sorted based on the size of the path scores, and a target propagation path with a larger path score may be preferably selected for symbolic execution.

[0081] Specifically, symbolically executing multiple target propagation paths among multiple taint propagation paths may include: sorting the multiple target propagation paths from high to low based on the path scores; and symbolically executing the target propagation paths in sequence from high to low from the sorted multiple target propagation paths.

[0082] In this embodiment, by sorting multiple target propagation paths from high to low based on the path score, a preset number of target propagation paths can be selected from the target propagation path list in order from high to low for symbolic execution. In this way, the symbolic execution priority of the target propagation path can be determined based on the properties, risk assessment value and complexity value of the taint propagation path, and the taint propagation path with a path score lower than the first preset threshold can be removed by using a pruning algorithm, thereby optimizing the coverage and performance of symbolic execution, reducing the consumption of computing resources, and improving the efficiency of firmware vulnerability detection.

[0083] In one embodiment, determining potential vulnerabilities in the firmware to be detected based on the symbolic execution results corresponding to each target propagation path includes: when the symbolic execution result corresponding to the target propagation path is that the path is unreachable, the target propagation path is eliminated; when the symbolic execution result corresponding to the target propagation path is that the path is reachable, the target propagation path is matched with a preset vulnerability feature library; when a target vulnerability corresponding to the target propagation path is matched in the vulnerability feature library, the target vulnerability is regarded as a potential vulnerability in the firmware to be detected.

[0084] In this embodiment, the executable code input (i.e., the taint source and the taint variable) can be converted into symbolic variables x1, x2, ⋯, x n To explore the target propagation path, form a path constraint set C={C1, C2, ⋯, C n}. During the symbolic execution process, whenever a conditional judgment P is encountered, a path constraint condition can be generated according to the current symbolic input. For example, for the conditional statement if(x1>c), the corresponding path constraint can be expressed as C=C∪{x1>c}. Whether the target propagation path is reachable can be determined based on the path constraints of each target propagation path determined by a search strategy (e.g., depth-first search or breadth-first search).

[0085] The reachability of the target propagation path can be verified by the constraint solver S, which can be expressed as: Is S(C i ) satisfiable? If S(Ci) is satisfiable, it means that there is an effective input combination that makes the target propagation path i reachable.

[0086] Subsequently, the path-reachable target propagation path i can be matched with a preset vulnerability feature library (for example, the CVE vulnerability library, the general network product security vulnerability professional library, the national industrial information security vulnerability library, the national information security vulnerability library, etc.) to identify the target vulnerability and provide specific vulnerability information and repair suggestions; by effectively filtering out the target propagation path that is unreachable through path constraints, it can ensure that vulnerability detection focuses on the real, path-reachable target propagation path, improve the detection efficiency of firmware vulnerabilities, and reduce the false alarm rate and false detection rate, thereby improving the detection accuracy of firmware vulnerabilities.

[0087] In addition, for each identified target vulnerability, the impact scope of the target vulnerability can be evaluated and a path coverage report can be generated, indicating the proportion of taint propagation paths covered by the vulnerability: R C =Covered Paths / (Total Paths)×100% Among them, R C Indicates the proportion of taint propagation paths covered by the vulnerability, Covered Paths indicates the number of taint propagation paths affected by the target vulnerability, and Total Paths indicates the number of all taint propagation paths in the firmware to be detected.

[0088] The path exploration strategy can be continuously improved based on the path coverage report to ensure that uncovered taint propagation paths can be identified and analyzed, thereby discovering new vulnerabilities.

[0089] In addition, we can combine path constraints with the control flow graph (CFG) of the program to infer potential vulnerabilities, and use the combination and solution of path constraints to find target propagation paths that do not meet expectations.

[0090] Through the above steps S201 to S204, by performing risk assessment and complexity calculation on the taint propagation path, and scoring the taint propagation path based on the risk assessment value and complexity value of the taint propagation path, the taint propagation path with a path score less than a preset threshold is eliminated, and symbolic execution is performed only on the target propagation path with a path score greater than or equal to the preset threshold, and the potential vulnerabilities in the firmware to be detected are determined based on the symbolic execution results. In this way, the taint propagation path with a path score less than the preset threshold (that is, a lower risk assessment value and / or a higher complexity value) can be pruned to reduce the computing resources required for subsequent symbolic execution, effectively improving the detection efficiency of firmware vulnerabilities, and making the automated firmware analysis of large-scale power equipment more feasible and efficient in a complex network environment. Through this application, the problem of high computing resource consumption and low detection efficiency for vulnerability detection of firmware in power equipment in the related art is solved, and the technical effect of reducing the computing resource consumption for vulnerability detection of firmware in power equipment and improving detection efficiency is achieved.

[0091] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0092] Corresponding to the firmware vulnerability detection method described in the above embodiment, Figure 3 A schematic diagram of the structure of a firmware vulnerability detection device according to an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0093] See also Figure 3 The firmware vulnerability detection device 3 is used to detect vulnerabilities in the firmware of the power equipment. The firmware vulnerability detection device 3 includes: an analysis module 30, which is used to perform dynamic taint analysis on the executable program of the firmware to be detected to obtain multiple taint propagation paths; a calculation module 31, which is used to perform risk assessment and complexity calculation on each taint propagation path to obtain a risk assessment value and complexity value corresponding to each taint propagation path; a scoring module 32, which is used to input the risk assessment value and complexity value of the taint propagation path into a preset path scoring model to obtain a path score output by the path scoring model, wherein the path score is directly proportional to the risk assessment value, and the path score is inversely proportional to the complexity value; a detection module 33, which is used to perform symbolic execution on multiple target propagation paths in the multiple taint propagation paths, and determine the potential vulnerabilities in the firmware to be detected based on the symbolic execution results corresponding to each target propagation path, wherein the path score of the target propagation path is greater than or equal to a first preset threshold.

[0094] In one embodiment, the calculation module 31 is also used to perform threat detection, vulnerability detection and attack simulation on each taint propagation path; based on the threat detection results, vulnerability detection results and attack simulation results corresponding to the taint propagation path, calculate the risk assessment value corresponding to the taint propagation path; obtain the function call information, nested depth information and conditional judgment quantity information corresponding to each taint propagation path; based on the function call information, nested depth information and conditional judgment quantity information corresponding to the taint propagation path, calculate the complexity value corresponding to the taint propagation path.

[0095] In one embodiment, the detection module 33 is also used to compare the path score of the taint propagation path with the first preset threshold when the number of target propagation paths that have been symbolically executed is less than the second preset threshold, and to regard the taint propagation path as the target propagation path for symbolic execution when the path score is greater than or equal to the first preset threshold; to determine the average and standard deviation of the path scores of multiple target propagation paths that have been symbolically executed when the number of target propagation paths that have been symbolically executed is greater than or equal to the second preset threshold; to update the first preset threshold based on the average and standard deviation of the path scores, and to use the updated first preset threshold as the first preset threshold; to compare the path score of the taint propagation path with the first preset threshold, and to regard the taint propagation path as the target propagation path for symbolic execution when the path score is greater than or equal to the first preset threshold.

[0096] In one embodiment, the detection module 33 is further used to sort the multiple target propagation paths from high to low based on the path scores; and perform symbolic execution on the target propagation paths in sequence from high to low from the sorted multiple target propagation paths.

[0097] In one embodiment, the detection module 33 is also used to eliminate the target propagation path when the symbolic execution result corresponding to the target propagation path is that the path is unreachable; match the target propagation path with a preset vulnerability feature library when the symbolic execution result corresponding to the target propagation path is that the path is reachable; and when the target vulnerability corresponding to the target propagation path is matched in the vulnerability feature library, treat the target vulnerability as a potential vulnerability in the firmware to be detected.

[0098] In one embodiment, the analysis module 30 is also used to collect input data from each input source in the executable program and mark each input data as a taint source; during the execution of the executable program, data flow analysis is performed on each taint source to obtain the taint propagation path corresponding to each taint source.

[0099] In one embodiment, the mathematical expression of the path scoring model is: Score(P)=α×Risk(P)-β×Complexity(P) Among them, Score(P) is the path score of the taint propagation path P, Risk(P) is the risk assessment value of the taint propagation path P, Complexity(P) is the complexity value of the taint propagation path P, α is the preset first weight factor, and β is the preset second weight factor.

[0100] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0101] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0102] Figure 4 is a schematic diagram of the structure of a terminal device according to an embodiment of the present application. Figure 4 As shown, the terminal device 4 includes: at least one processor 40 ( Figure 4 Only one is shown in the figure) a processor, a memory 41, and a computer program 42 stored in the memory 41 and executable on at least one processor 40. When the processor 40 executes the computer program 42, the steps in any of the above-mentioned firmware vulnerability detection method embodiments are implemented.

[0103] The terminal device 4 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The terminal device 4 may include but is not limited to a processor 40 and a memory 41. It is understood by those skilled in the art that Figure 4 It is only an example of the terminal device 4 and does not constitute a limitation on the terminal device 4. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, etc.

[0104] The processor 40 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0105] In some embodiments, the memory 41 may be an internal storage unit of the terminal device 4, such as a hard disk or memory of the terminal device 4. In other embodiments, the memory 41 may also be an external storage device of the terminal device 4, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the terminal device 4. In other embodiments, the memory 41 may also include both an internal storage unit and an external storage device of the terminal device 4. The memory 41 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as program codes of a computer program 42. The memory 41 may also be used to temporarily store data that has been output or is to be output.

[0106] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned firmware vulnerability detection method embodiments can be implemented.

[0107] An embodiment of the present application provides a computer program product. When the computer program product is run on a mobile terminal, the mobile terminal implements the steps in the above-mentioned firmware vulnerability detection method embodiments when executing the computer program product.

[0108] The present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of each of the above-mentioned method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the terminal device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a disk or an optical disk.

[0109] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0110] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0111] In the embodiments provided in the present application, it should be understood that the disclosed devices / network equipment and methods can be implemented in other ways. For example, the device / network equipment embodiments described above are only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0112] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0113] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for detecting firmware vulnerabilities, characterized in that: Applied to detecting vulnerabilities in firmware in electric power equipment, the method comprises: Perform dynamic taint analysis on the executable program of the firmware to be detected to obtain multiple taint propagation paths; Perform risk assessment and complexity calculation on each of the taint propagation paths to obtain a risk assessment value and a complexity value corresponding to each of the taint propagation paths; Inputting the risk assessment value and the complexity value of the taint propagation path into a preset path scoring model to obtain a path score output by the path scoring model, wherein the path score is directly proportional to the risk assessment value, and the path score is inversely proportional to the complexity value; Symbolic execution is performed on multiple target propagation paths among the multiple taint propagation paths, and potential vulnerabilities in the firmware to be detected are determined based on the symbolic execution results corresponding to each of the target propagation paths, wherein the path score of the target propagation path is greater than or equal to a first preset threshold.

2. The method according to claim 1, characterized in that Performing risk assessment and complexity calculation on each of the taint propagation paths, and obtaining the risk assessment value and complexity value corresponding to each of the taint propagation paths include: Performing threat detection, vulnerability detection, and attack simulation on each of the taint propagation paths; Calculate the risk assessment value corresponding to the taint propagation path based on the threat detection result, vulnerability detection result and attack simulation result corresponding to the taint propagation path; Obtaining function call information, nested depth information, and conditional judgment quantity information corresponding to each of the taint propagation paths; Based on the function call information, the nesting depth information and the condition judgment quantity information corresponding to the taint propagation path, the complexity value corresponding to the taint propagation path is calculated.

3. The method according to claim 1, characterized in that Performing symbolic execution on multiple target propagation paths in the multiple taint propagation paths includes: When the number of the target propagation paths that have been symbolically executed is less than a second preset threshold, comparing the path score of the taint propagation path with the first preset threshold, and when the path score is greater than or equal to the first preset threshold, treating the taint propagation path as the target propagation path for symbolic execution; When the number of the target propagation paths that have been symbolically executed is greater than or equal to the second preset threshold, determine the average value and standard deviation of the path scores of the multiple target propagation paths that have been symbolically executed; based on the average value and standard deviation of the path scores, update the first preset threshold, and use the updated first preset threshold as the first preset threshold; compare the path score of the taint propagation path with the first preset threshold, and when the path score is greater than or equal to the first preset threshold, treat the taint propagation path as the target propagation path for symbolic execution.

4. The method according to claim 1, characterized in that: Performing symbolic execution on multiple target propagation paths in the multiple taint propagation paths includes: Based on the path scores, sorting the multiple target propagation paths from high to low; The target propagation paths are symbolically executed in sequence from high to low from the sorted multiple target propagation paths.

5. The method according to any one of claims 1 to 4, characterized in that Determining the potential vulnerability in the firmware to be detected based on the symbolic execution result corresponding to each target propagation path includes: When the symbol execution result corresponding to the target propagation path is that the path is unreachable, the target propagation path is eliminated; When the symbolic execution result corresponding to the target propagation path is path-reachable, the target propagation path is matched with a preset vulnerability feature library; when a target vulnerability corresponding to the target propagation path is matched in the vulnerability feature library, the target vulnerability is used as the potential vulnerability in the firmware to be detected.

6. The method according to any one of claims 1 to 4, characterized in that Perform dynamic taint analysis on the executable program of the firmware to be tested, and obtain multiple taint propagation paths including: Collecting input data from each input source in the executable program, and marking each input data as a tainted source; During the execution of the executable program, data flow analysis is performed on each of the taint sources to obtain the taint propagation path corresponding to each of the taint sources.

7. The method according to any one of claims 1 to 4, characterized in that The mathematical expression of the path scoring model is: Score(P)=α×Risk(P)-β×Complexity(P) Among them, Score(P) is the path score of the taint propagation path P, Risk(P) is the risk assessment value of the taint propagation path P, Complexity(P) is the complexity value of the taint propagation path P, α is the preset first weight factor, and β is the preset second weight factor.

8. A firmware vulnerability detection device, characterized in that: Applicable to detecting vulnerabilities in firmware in electric power equipment, the device comprises: An analysis module is used to perform dynamic taint analysis on the executable program of the firmware to be detected to obtain multiple taint propagation paths; A calculation module, used to perform risk assessment and complexity calculation on each of the taint propagation paths, and obtain a risk assessment value and a complexity value corresponding to each of the taint propagation paths; A scoring module, used for inputting the risk assessment value and the complexity value of the taint propagation path into a preset path scoring model to obtain a path score output by the path scoring model, wherein the path score is directly proportional to the risk assessment value, and the path score is inversely proportional to the complexity value; A detection module is used to perform symbolic execution on multiple target propagation paths among the multiple taint propagation paths, and determine potential vulnerabilities in the firmware to be detected based on the symbolic execution results corresponding to each of the target propagation paths, wherein the path score of the target propagation path is greater than or equal to a first preset threshold.

9. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method for detecting a firmware vulnerability according to any one of claims 1 to 7 is implemented.

10. A computer program product, characterized in that It comprises a computer program, and when the computer program is executed, the method for detecting a firmware vulnerability according to any one of claims 1 to 7 is executed.

Images