IoT Web vulnerability static and dynamic collaborative detection method based on large model guidance

Abstract

The invention discloses an IoT Web vulnerability static and dynamic collaborative detection method based on large model guidance, and belongs to the technical field of Internet of Things security. Aiming at the problems that the traditional static analysis is high in false alarm rate and the dynamic fuzz test lacks guidance, the method comprises the following steps: firstly, collecting network request parameter fields of the Web front end of the IoT equipment as keywords in the initial stage of the dynamic fuzz test, determining a back-end processing code block in combination with static analysis, and constructing a taint path set; and then, designing a cue word sequence, carrying out deep analysis on a taint path by utilizing a large model, generating vulnerability vector information, and guiding a dynamic fuzzy test direction. According to the method, the vulnerability detection efficiency and accuracy are effectively improved, and the manual intervention requirement is remarkably reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of Internet of Things security, and relates to a static and dynamic collaborative detection method for IoT Web vulnerabilities based on a large model. Background Art

[0002] With the rapid development of Internet of Things (IoT) technology, the popularity of smart devices in daily life has brought convenience to people, but it has also caused serious security risks. Many manufacturers tend to prioritize functionality and market response during the development process, while ignoring security, making the devices vulnerable to attacks. IoT Web includes communication and management between devices. Malware such as Mirai exploits its vulnerabilities to carry out large-scale network attacks, threatening user privacy and data security. In the era of the Internet of Everything, an efficient and accurate vulnerability detection method is the key to improving the security of IoT devices.

[0003] Faced with the security testing needs of large-scale IoT, traditional static analysis can discover potential problems, but it is often accompanied by a large number of false alarms and requires manual verification; existing dynamic fuzzy testing solutions usually lack accuracy and guidance, and heuristic methods are difficult to efficiently reach vulnerability risk points.

[0004] This paper proposes a large model-guided IoT Web vulnerability static and dynamic collaborative detection framework, which aims to effectively detect the security of IoT device Web services. For the first time, a large language model is introduced into the collaborative process of static analysis and dynamic fuzz testing, specifically for the security analysis of IoT devices. Starting from IoT Web services, the framework designs and implements a set of extensive and flexible fuzz testing schemes, which can effectively discover and locate a variety of potential security vulnerabilities. Summary of the invention

[0005] The purpose of the present invention is to provide a static and dynamic collaborative detection method for IoT Web vulnerabilities based on large model guidance to solve the above-mentioned problem of limitations of vulnerability detection in existing IoT devices.

[0006] In order to achieve the above object, the present invention provides the following scheme:

[0007] The present invention provides a static and dynamic collaborative detection method for IoT Web vulnerabilities based on large model guidance, comprising the following steps:

[0008] S1: Control the headless browser to access the IoT Web front-end page to simulate user interaction to trigger network requests, and collect the field names in the network requests as request keywords;

[0009] S2: Locate the binary file of the IoT Web backend service through the request keyword to build the tainted path;

[0010] S3: Use the prompt word sequence template to drive the large model to perform taint analysis on the taint path to obtain vulnerability vector information;

[0011] S4: Use the vulnerability vector information generated by the large model to guide the fuzz testing direction.

[0012] Furthermore, in S1, the collection request keywords are specifically:

[0013] Access the IoT Web front-end page through a headless browser, inject a series of Hook functions to control the page, simulate user interactions such as filling in form information and clicking buttons to trigger form requests; collect network request path field names and parameter field names as request keywords.

[0014] Furthermore, in S2, the tainted path is constructed as follows:

[0015] The binary file of the IoT Web backend service is located by the request keyword. The request keyword set collected by a front-end page matches a binary file of the IoT Web backend service. The binary file of the backend service can correspond to the request keyword set of multiple front-end pages. The request keyword is used as the taint, and the code where the request keyword value is obtained in the binary file of the backend service is the taint source. The unsafe function is used as the taint aggregation to construct the taint path.

[0016] Furthermore, in S3, the hint word sequence template is used to drive the large model to perform taint analysis on the taint path as follows:

[0017] The prompt sequence template consists of a tainted path non-library function code completion template, a tainted path analysis template, and a vulnerability vector information construction template. The tainted path non-library function code completion template allows the big model to prompt the missing non-library function code on the path that needs to be completed to meet the contextual information required for taint analysis; the tainted path analysis template allows the big model to analyze the input disinfection, filtering, and escape operations involved in the process of data transmission from the tainted source to the sink, and check the integrity and validity of these operations to determine whether there are security risks; the vulnerability vector information construction template allows the big model to summarize the tainted path analysis results and construct vulnerability vector information. The vulnerability vector information includes vulnerability trigger fields, vulnerability types, confidence, vulnerability cause information, and attack payload seeds that may cause security risks.

[0018] Furthermore, in S4, the vulnerability vector information generated by the large model is used to guide the fuzz testing direction. The specific method is as follows:

[0019] The dynamic fuzz testing engine will generate vulnerability trigger fields in the vulnerability vector information based on the large model, match the corresponding fields to launch fuzz testing requests, adjust the fuzz testing strategy according to the vulnerability type, adjust the priority according to the confidence level, provide feedback information after the vulnerability is discovered based on the vulnerability cause information, and mutate based on the attack payload seed as the initial seed.

[0020] Compared with the prior art, the present invention has achieved the following beneficial technical effects:

[0021] 1. The prompt word sequence template provided by the present invention drives the large model to perform taint analysis on the taint path, which can effectively utilize the powerful semantic understanding ability of the large language model to automatically analyze complex code paths, so that it can discover known and unknown security vulnerabilities, and provide a comprehensive security assessment by integrating static and dynamic analysis. In addition, the large model can continuously optimize the analysis strategy according to new data and attack patterns, and has flexible adaptability.

[0022] 2. The IoT Web vulnerability static and dynamic collaborative detection method based on large model guidance provided by the present invention combines static analysis with dynamic fuzz testing, collects information positioning service resource files in the initial stage of dynamic fuzz testing, obtains the taint path through static analysis, uses the large model to perform taint analysis, and obtains vulnerability vector information to guide fuzz testing, which can effectively alleviate the problems of high false alarm rate of static analysis and insufficient directionality of dynamic fuzz testing, and improve the security of IoT devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 An architectural diagram of the IoT Web vulnerability static and dynamic collaborative detection method based on large model guidance provided in an embodiment of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] The core of the present invention is to provide a static and dynamic collaborative detection method for IoT Web vulnerabilities based on large model guidance to solve the problem of limitations of existing IoT device vulnerability detection.

[0026] In order to enable those skilled in the art to better understand the solution of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0027] Figure 1An architectural diagram of a static and dynamic collaborative detection method for IoT Web vulnerabilities based on a large model is provided for an embodiment of the present invention, such as Figure 1 As shown, the following steps are included:

[0028] S1: Control the headless browser to access the IoT Web front-end page to simulate user interaction to trigger network requests, and collect the field names in the network requests as request keywords;

[0029] Traverse and access all IoT Web front-end pages through a headless browser, inject a series of Hook functions to control the pages, simulate user interactions such as form information filling and button clicks to trigger form requests; collect network request path field names and parameter field names as request keywords.

[0030] S2: Locate the binary file of the IoT Web backend service through the request keyword and build the tainted path;

[0031] The binary file of the IoT Web backend service is located by request keywords. The request keyword set collected by a front-end page matches the binary file of an IoT Web backend service. The binary file of the backend service can correspond to the request keyword set of multiple front-end pages. The binary file of the backend service is statically analyzed by decompilation software, and the request keyword is used as the taint. The code where the request keyword value is obtained in the binary file of the backend service is the taint source, and the unsafe function is the data flow where the taint converges, thereby constructing the taint path.

[0032] S3: Use the prompt word sequence template to drive the large model to perform taint analysis on the taint path to obtain vulnerability vector information;

[0033] The prompt sequence template consists of a tainted path non-library function code completion template, a tainted path analysis template, and a vulnerability vector information construction template. The tainted path non-library function code completion template allows the big model to prompt the missing non-library function code on the path that needs to be completed to meet the contextual information required for taint analysis. The tainted path analysis template allows the big model to analyze the input disinfection, filtering, and escape operations involved in the process of data transmission from the tainted source to the sink point, and check the integrity and validity of these operations to determine whether there are security risks. The vulnerability vector information construction template allows the big model to summarize the tainted path analysis results and construct vulnerability vector information. The vulnerability vector information includes vulnerability trigger fields, vulnerability types, confidence, vulnerability cause information, and attack payload seeds that may cause security risks.

[0034] S4: Use the vulnerability vector information generated by the large model to guide the fuzz testing direction.

[0035] The dynamic fuzz testing engine will match the corresponding fields in the vulnerability vector information with the vulnerability trigger field to launch fuzz testing requests, adjust the fuzz testing strategy according to the vulnerability type, adjust the priority according to the confidence level, provide feedback information after the vulnerability is discovered according to the vulnerability cause information, and mutate based on the attack payload seed as the initial seed.

[0036] The above is a detailed introduction to the IoT Web vulnerability static and dynamic collaborative detection method based on large model guidance provided by the present invention. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other.

[0037] The contents not described in detail in the specification of the present invention belong to the prior art known to the professional and technical personnel in this field.

Claims

1. A static and dynamic collaborative detection method for IoT Web vulnerabilities based on large model guidance, characterized in that: The following steps are involved: S1: Control the headless browser to access the IoT Web front-end page to simulate user interaction to trigger network requests, and collect the field names in the network requests as request keywords; S2: Locate the binary file of the IoT Web backend service through the request keyword to build the tainted path; S3: Use the prompt word sequence template to drive the large model to perform taint analysis on the taint path to obtain vulnerability vector information; S4: Use the vulnerability vector information generated by the large model to guide the fuzz testing direction.

2. According to the large model-guided IoT Web vulnerability static and dynamic collaborative detection method according to claim 1, it is characterized in that: In S1: Access the IoT Web front-end page through a headless browser, inject a series of Hook functions to control the page, and simulate user interactions such as filling in form information and clicking buttons to trigger form requests; Collect network request path field names and parameter field names as request keywords.

3. According to the large model-guided IoT Web vulnerability static and dynamic collaborative detection method according to claim 1, it is characterized in that: In S2: The binary file of the IoT Web backend service is located by the request keyword. The request keyword set collected by a front-end page matches a binary file of the IoT Web backend service. The binary file of the backend service can correspond to the request keyword set of multiple front-end pages. The request keyword is used as the taint, and the code where the request keyword value is obtained in the binary file of the backend service is the taint source. The unsafe function is used as the taint aggregation to construct the taint path.

4. According to the large model-guided IoT Web vulnerability static and dynamic collaborative detection method according to claim 1, it is characterized in that: In S3: The prompt sequence template consists of a tainted path non-library function code completion template, a tainted path analysis template, and a vulnerability vector information construction template. The tainted path non-library function code completion template allows the large model to prompt that the missing non-library function code on the tainted path needs to be completed to meet the context information required for taint analysis; The taint path analysis template allows the big model to analyze the input disinfection, filtering and escape operations involved in the process of data being transmitted from the taint source to the sink, and check the integrity and validity of these operations to determine whether there are security risks; the vulnerability vector information construction template allows the big model to summarize the taint path analysis results and construct vulnerability vector information. The vulnerability vector information includes vulnerability trigger fields, vulnerability types, confidence levels, vulnerability cause information, and attack payload seeds that may cause security risks.

5. According to the large model-guided IoT Web vulnerability static and dynamic collaborative detection method according to claim 1, it is characterized in that: In S4: The dynamic fuzz testing engine will match the corresponding fields in the vulnerability vector information with the vulnerability trigger field to launch fuzz testing requests, adjust the fuzz testing strategy according to the vulnerability type, adjust the priority according to the confidence level, provide feedback information after the vulnerability is discovered according to the vulnerability cause information, and mutate based on the attack payload seed as the initial seed.

Images