Automobile firmware security vulnerability detection method and device, electronic equipment and medium

Abstract

The invention relates to the technical field of intelligent network connection automobiles, in particular to an automobile firmware security vulnerability detection method and device, electronic equipment and a medium, and the method comprises the steps: determining a target vulnerability function set of target firmware of an intelligent network connection automobile based on a function signature corresponding to each vulnerability function in a pre-constructed vulnerability function set; determining component information used by the target firmware, wherein the component information comprises a component name and a component version number; the target vulnerability function set and the component information are searched in a pre-built mapping relation, potential vulnerabilities of the target firmware are obtained, the mapping relation comprises vulnerability information corresponding to the multiple kinds of firmware and the corresponding relation of the potential vulnerability sets of the multiple kinds of firmware, and the vulnerability information comprises the component name, the component version number corresponding to the component name and the vulnerability function set. The problem that vulnerabilities exist in an intelligent connected automobile for a long time due to the fact that suppliers do not obtain vulnerability information in time is solved.

Description

Technical Field

[0001] The present application relates to the technical field of intelligent connected vehicles. Specifically, the present application relates to a method, device, electronic device and medium for detecting security vulnerabilities in automobile firmware. Background Art

[0002] Intelligent connected vehicles are a new generation of multi-vehicle systems that use vehicles as the main body and main node, integrate modern communication and network technologies, and enable vehicles to share information and coordinate control with external nodes to achieve safe, orderly, efficient, and energy-saving driving of vehicles. With the development of intelligent connected vehicles, vehicle safety is also facing unprecedented challenges. Security vulnerabilities in automotive component firmware may lead to attacks, such as attackers obtaining sensitive data of consumers and manufacturers, accessing vehicle control devices, etc., thereby affecting the normal operation of the vehicle and even endangering the lives of passengers. Therefore, security vulnerability detection of automotive component firmware has become a key link in ensuring vehicle safety.

[0003] At present, the security vulnerability detection of automotive parts firmware mainly adopts static binary code analysis, dynamic analysis, vulnerability detection and other technologies. Since smart connected vehicles are often provided with different parts by multiple suppliers, there are known vulnerabilities in a certain part, but the OEM fails to obtain vulnerability information in time, which will cause the vulnerability to exist in the vehicle for a long time, making it difficult for the OEM to effectively manage and control the potential security risks in the supply chain. For example, if the vulnerability library data used is inaccurate, or the firmware may not reference all parts of the third-party components when using them, it may cause significant false positives, missed positives and other phenomena. Summary of the invention

[0004] The present application provides a method, device, electronic device and medium for detecting security vulnerabilities in automobile firmware, which can solve the problem of low vulnerability detection accuracy caused by the high complexity of the intelligent network automobile supply chain. The technical solution is as follows:

[0005] In a first aspect, a method for detecting security vulnerabilities in automobile firmware is provided, the method comprising:

[0006] Determine a target vulnerability function set of a target firmware of an intelligent connected vehicle based on function signatures corresponding to each vulnerability function in a pre-built vulnerability function set;

[0007] Determine the component information used by the target firmware, the component information including the component name and the component version number;

[0008] According to the target vulnerability function set and component information, a search is performed in the pre-built mapping relationship to obtain the potential vulnerabilities of the target firmware. The mapping relationship includes the corresponding relationship between the vulnerability information corresponding to multiple firmwares and their potential vulnerability sets. The vulnerability information includes the component name and its corresponding component version number and the vulnerability function set.

[0009] In a second aspect, a device for detecting security vulnerabilities in automobile firmware is provided, the device comprising:

[0010] A vulnerability function identification module, used to determine a target vulnerability function set of a target firmware of an intelligent connected vehicle based on function signatures corresponding to each vulnerability function in a pre-built vulnerability function set;

[0011] A component information determination module, used to determine the component information used by the firmware, the component information including the component name and the component version number;

[0012] The potential vulnerability detection module is used to search in the pre-built mapping relationship based on the target vulnerability function set and component information to obtain the potential vulnerabilities of the target firmware. The mapping relationship includes the corresponding relationship between the vulnerability information corresponding to multiple firmwares and their potential vulnerability sets. The vulnerability information includes the component name and its corresponding component version number and the vulnerability function set.

[0013] According to a third aspect of an embodiment of the present application, an electronic device is disclosed. The electronic device includes a memory, a processor, and a computer program stored in the memory. The processor executes the computer program to implement the steps of the above method.

[0014] In a fourth aspect of the embodiments of the present application, a computer-readable storage medium is disclosed, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0015] The embodiment of the present application identifies the functions of the target firmware of the intelligent connected vehicle through the function signatures corresponding to each vulnerability function in the pre-built vulnerability function set to obtain the target vulnerability function set, and determines the component information used by the target firmware, the component information including the component name and the component version number, so as to search the target vulnerability function set and the component information in the pre-built mapping relationship to obtain the potential vulnerabilities of the target firmware, the mapping relationship including the corresponding relationship between the vulnerability information corresponding to the multiple firmwares and their potential vulnerability sets, the vulnerability information including the component name and its corresponding component version number and the vulnerability function set. This method of associating the potential vulnerability sets of component firmware of different suppliers with the vulnerability information can analyze the vulnerability functions used by the component firmware, thereby identifying the corresponding potential vulnerabilities, and avoiding the occurrence of long-term vulnerability problems in intelligent connected vehicles due to the supplier's failure to obtain vulnerability information in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in describing the embodiments of the present application are briefly introduced below.

[0017] Figure 1 A schematic diagram of a process for detecting security vulnerabilities in automotive firmware provided by an embodiment of the present application;

[0018] Figure 2 A schematic diagram of the structure of a vehicle firmware security vulnerability detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0019] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0020] The present application embodiment provides a method for detecting security vulnerabilities in automobile firmware, such as Figure 1 As shown, the method includes: step S101, step S102 and step S103.

[0021] Step S101: Determine a target vulnerability function set of a target firmware of an intelligent connected vehicle based on function signatures corresponding to respective vulnerability functions in a pre-built vulnerability function set.

[0022] Specifically, the target firmware may include electronic control unit ECU firmware, vehicle infotainment system, sensor firmware, etc.

[0023] In the embodiment of the present application, the function signature is used to characterize the feature set of each possible vulnerability function in the firmware. Specifically, the function signature can include multiple features. When applied, the function signature can be used to efficiently detect and match potential vulnerability functions in the firmware of the intelligent connected car by using analysis tools.

[0024] Specifically, input information for intelligent connected vehicle component firmware can be obtained through a preset interface (such as a user interface), and the target firmware can be determined based on the input information. When applied, a user interface pre-configured with different component firmware names can be provided, and when a user's selection operation on the user interface is detected, the analysis object pointed to by the selection operation, that is, the target firmware, is determined.

[0025] Step S102: Determine the component information used by the target firmware, where the component information includes the component name and the component version number.

[0026] Specifically, binary software component analysis can be used to comprehensively analyze the firmware of smart connected vehicles. All files to be analyzed in the package can be obtained by decompression. Based on component feature recognition technology and various risk detection rules, the components used by the firmware of smart connected vehicles and the version numbers they affect can be obtained. When applied, the identification and analysis steps of binary software component analysis on firmware are as follows: First, the firmware can be decompressed by tools (such as Binwalk, Firmadyne) to extract the file system or binary files, including executable files, dynamic link libraries, and configuration files. The files obtained by this decompression are classified for subsequent analysis. Then, feature information is extracted from the extracted binary files. For example, the symbol table is parsed by disassembly tools (such as IDA Pro and Ghidra) to extract function names, variable names, and library dependency information; strings are used to extract printable strings in the file, such as component names and version numbers; and the code segment content is parsed by tools (such as radare2) to generate function signatures or calculate file hash values. In addition, for dynamic link files (such as ELF files), their dynamic link dependencies are parsed to identify external libraries and possible version information. Subsequently, the extracted feature information is matched using a pre-built component signature library. Based on function signature matching and string pattern matching, the component names and version numbers contained in the firmware are identified; for unknown components, predictions can be made using feature classification models. At the same time, the specific version of the dynamic link library is further confirmed by analyzing the file header information and library characteristics. After the identification is completed, cross-validation is performed to ensure the accuracy of the results. The consistency of component names and version numbers is verified by comparing the analysis results from multiple sources such as symbol tables, strings, and dynamic link information. For key components, their identities can also be manually verified in combination with public documents or source code. In addition, the identified component information is compared with the vulnerability database to obtain possible vulnerability information of the component.

[0027] Step S103: Search in a pre-built mapping relationship according to the target vulnerability function set and component information to obtain potential vulnerabilities of the target firmware. The mapping relationship includes the corresponding relationship between the vulnerability information corresponding to each of the multiple firmwares and their potential vulnerability sets. The vulnerability information includes the component name and its corresponding component version number and the vulnerability function set.

[0028] The embodiment of the present application identifies the functions of the target firmware of the intelligent connected vehicle through the function signatures corresponding to each vulnerability function in the pre-built vulnerability function set to obtain the target vulnerability function set, and determines the component information used by the target firmware, the component information including the component name and the component version number, so as to search in the pre-built mapping relationship according to the target vulnerability function set and the component information to obtain the potential vulnerabilities of the target firmware, the mapping relationship including the corresponding relationship between the vulnerability information corresponding to the multiple firmwares and their potential vulnerability sets, the vulnerability information including the component name and its corresponding component version number and the vulnerability function set. This method of associating the potential vulnerability sets of component firmware of different suppliers with the vulnerability information can analyze the vulnerability functions used by the component firmware, thereby identifying the corresponding potential vulnerabilities, and avoiding the occurrence of long-term vulnerability problems in intelligent connected vehicles due to the supplier's failure to obtain vulnerability information in a timely manner.

[0029] In some embodiments, step S101 further includes:

[0030] Calculate the similarity between each function of the target firmware and the function signature corresponding to each vulnerability function in the vulnerability function set;

[0031] If the similarity between any function of the target firmware and any vulnerability function in the vulnerability function set is greater than a preset similarity threshold, the any vulnerability function in the vulnerability function set is used as the target vulnerability function of the target firmware to obtain the target vulnerability function set.

[0032] Specifically, the similarity threshold can be set according to business needs. For example, assuming that the similarity threshold is set to 0.9, when the similarity between the vulnerability function of the target firmware and a certain function signature is greater than or equal to 0.9, it indicates that the vulnerability function of the target firmware includes the vulnerability function corresponding to the function signature.

[0033] Take the edit distance similarity based on instruction sequence as an example. Assume that the function signature of the vulnerable function A is {mov eax, ebx; add eax, 5; ret}, and the function B of the target firmware is {mov ecx, edx; add ecx, 5; ret}. In calculating the edit distance, the edit operation is: replace eax->ecx and ebx->edx, so the total edit distance is 2. Similarity = 1-edit distance / longest sequence length, so similarity = 1-2 / 5=0.6. If the similarity threshold is set to 0.5, function B is considered similar to function A and marked as a potential vulnerability function.

[0034] Take the similarity based on the function call graph as an example. The vulnerable function A calls {func1, func2, func3}, and the target firmware's function B calls {func1, func2, func4}. Function A's node set is {func1, func2, func3}, and function B's node set is {func1, func2, func4}. Jaccard similarity = intersection size / union size.

[0035] Among them, Jaccard = |{func1, func2}| / |{func1, func2, func3, func4}|=2 / 4=0.5. If the similarity threshold is set to 0.5, function B is considered similar to function A and marked as a potential vulnerability function.

[0036] Take the cosine similarity based on string features as an example. The feature string of vulnerability function A is: {open_ssl, TLS_v1.2, buffer_overflow}, and the feature string of function B of the target firmware is: {open_ssl, TLS_v1.3, stack_overflow}. Keyword set = {open_ssl, TLS_v1.2, buffer_overflow, TLS_v1.3, stack_overflow}, so vector A is [1,1,1,0,0], and vector B is [1,0,0,1,1]. Cosine similarity = vector dot product / vector modulus product. Dot product = 1*1+0*0+0*0+0*1+0*1=1; Modulus (A) = sqrt{1^2+1^2+1^2}=sqrt{3}; Modulus (B) = sqrt{1^2+0^2+0^2+1^2+1^2}=sqrt{3}. Similarity = frac{1}{sqrt{3}*sqrt{3}}=0.333. If the similarity threshold is 0.3, function B is considered similar to function A and is marked as a potential vulnerability function.

[0037] In some embodiments, before step S101, the method further comprises:

[0038] A plurality of features are extracted for any vulnerability function in the vulnerability function set, and a plurality of function signatures of the any vulnerability function are determined according to the extracted plurality of features.

[0039] Specifically, the firmware files (generally binary files) of automotive parts can be scanned and static detection technology can be used to extract the function features included therein, which include constant strings, some class nouns, function names, etc. When applied, the binary SCA software component analysis method can be used to extract features of each vulnerable function in the vulnerable function set.

[0040] In the above embodiment, the function signature includes at least one of the following: a string reference signature, a stack size signature, a fuzzy hash signature, and an instruction frequency signature.

[0041] In the embodiment of the present application, the string reference signature is used to characterize the set of strings used by the function, including constants or specific text content. These strings can help identify the purpose and function of the function. Taking string extraction as an example, it mainly includes hard-coded identifiers (such as function names, library names), error messages (such as logs or exception prompts), file paths or network resources (such as URLs, file paths), configuration information or version numbers (such as version strings), protocols or format descriptions (such as protocol identifiers or file header information) and debugging or hidden information (such as sensitive commands or keys). During the extraction process, static analysis tools should be combined to locate the target string, and general irrelevant strings should be filtered at the same time (ignoring short strings, such as irrelevant character sequences with a length of less than 3), retaining context information related to the vulnerability (recording the offset address of the instruction where the string is located, marking the type of code segment where the string appears, such as data segment.data, code segment.text), and classifying, recording and optimizing the features to improve the accuracy and comprehensiveness of vulnerability analysis.

[0042] For example, suppose a function is used to handle error messages as follows:

[0043] void logError(){

[0044] printf("Error:Invalid input\n");

[0045] }.

[0046] In this example, the string reference signature might be: {"logError","Error:Invalid input"}.

[0047] In an embodiment of the present application, the stack size signature is used to characterize the size of the stack space required when the function value is executed, usually including the space occupied by function parameters and local variables.

[0048] For example, suppose a function is as follows:

[0049] int add(int a, int b) {

[0050] int result;

[0051] result = a + b;

[0052] return result;

[0053] }.

[0054] The stack size required by this function may be: 2*4 bytes (two int parameters) + 4 bytes (one int local variable) = 12 bytes. Therefore, the stack size signature is 12 bytes.

[0055] In the embodiment of the present application, the fuzzy hash signature is used to characterize the overall characteristics of the function. The disassembled code of the function can be converted into a text sequence, and then the fuzzy hash is calculated to capture the overall characteristics of the function.

[0056] For example, suppose the disassembled instruction sequence is:

[0057] mov eax,a;

[0058] add eax, b;

[0059] mov result, eax.

[0060] After converting these instructions into a text sequence, the calculated fuzzy hash value might be HASH123.

[0061] In an embodiment of the present application, the instruction frequency signature is used to extract the instruction mnemonics that appear most frequently in a function to help identify the implementation of a specific function.

[0062] For example, suppose the disassembled instructions are as follows:

[0063] mov eax,a;

[0064] add eax, b;

[0065] mov result, eax.

[0066] The instruction frequency statistics may be: mov: 2 times, add: 1 time. Therefore, the instruction frequency signature can be expressed as: {mov: 2, add: 1}.

[0067] In some embodiments, before step S103, the method further comprises:

[0068] Step S1031 (not shown): determining vulnerability related information corresponding to each vulnerability in a pre-configured vulnerability database, wherein the vulnerability related information includes a component name, a version number of each component affecting the corresponding vulnerability, and a vulnerability description;

[0069] Step S1032 (not shown): extract natural language NLP keywords from vulnerability descriptions corresponding to the vulnerabilities in the vulnerability database, and determine vulnerability function sets corresponding to the vulnerabilities in the vulnerability database based on the extraction results;

[0070] Step S1033 (not shown): constructing a component association relationship, the component association relationship includes a correspondence relationship between component names corresponding to each vulnerability in the vulnerability database, version numbers of each component affecting the corresponding vulnerability, and vulnerability function sets corresponding to each vulnerability;

[0071] Step S1034 (not shown in the figure): mapping processing is performed according to the component association relationship and the vulnerability function sets corresponding to the respective vulnerabilities in the vulnerability database to obtain a mapping relationship.

[0072] In the embodiments of the present application, the vulnerability description refers to a detailed description of a specific security vulnerability, including information such as the impact, cause, possible attack methods, and mitigation measures of the vulnerability.

[0073] Specifically, the vulnerability database may include public vulnerability databases such as CVE (Common Vulnerabilities and Exposures) and CNVD (China National Vulnerability Database).

[0074] Specifically, all vulnerabilities of a component in the public vulnerability database and the corresponding set of affected version numbers are extracted. For example, for the component Apache HTTP Server, the vulnerabilities that can be extracted include CVE-2021-22946, which affects versions 2.4.48 and earlier, and is described as a security issue that may cause denial of service (DoS); for database components such as MySQL, common vulnerability types include SQL injection and privilege escalation, which are usually caused by complexity, improper configuration, and insufficient development and maintenance.

[0075] Specifically, the vulnerability description can be segmented first, and the vulnerability functions used by each vulnerability can be determined based on the segmentation results. When applied, the vulnerability description can be analyzed by a preconfigured NLP parser to determine the set of vulnerability functions. NLP parsers generally preprocess and extract features from data sources such as code, documents, and logs, such as extracting key elements such as hard-coded strings, error messages, and version numbers, and identify vulnerability types, impact scopes, and triggering conditions from vulnerability reports and source codes through text classification, named entity recognition, and syntax analysis. Furthermore, the vulnerability pattern is learned through the model and the similarity is calculated to detect potential vulnerabilities and generate repair suggestions.

[0076] In some embodiments, step S1032 further includes:

[0077] If the vulnerability description of any vulnerability includes the function where the vulnerability is located, the vulnerability function set of the vulnerability is determined according to the function where the vulnerability is located;

[0078] If the vulnerability description of any vulnerability does not include the function where the vulnerability is located, the vulnerability repair submission record corresponding to the vulnerability identifier of the vulnerability is determined, and the vulnerability function set of the vulnerability is determined according to the vulnerability repair submission record.

[0079] Specifically, if the vulnerability description describes the function where the vulnerability is located, then the set of vulnerable functions of the vulnerability is them. For example, in the description of the vulnerability CVE-2021-34567, it may be mentioned: "In the function calculateTotal, there is an integer overflow vulnerability that allows an attacker to exploit the vulnerability to execute malicious code." In this example, calculateTotal is the function where the vulnerability is located mentioned in the description.

[0080] Specifically, if the vulnerability description does not contain the function where the vulnerability is located, the vulnerability number (i.e., vulnerability identifier) ​​is associated with the vulnerability fix commit in the GIT commit history in the component source code repository, and the set of vulnerability functions of the vulnerability is identified by comparing the functions that are modified after the commit is submitted. In some cases, although a specific vulnerability fix commit is associated, not all related functions may be modified. For example, in a version control system, the commit that fixes the vulnerability may only modify part of the code, while other functions, although related to the vulnerability, are not directly modified. In this case, if the vulnerability description does not provide a specific function name, all functions related to the vulnerability can be found by analyzing the commit record. For example, suppose there is a vulnerability CVE-2021-45678. In a certain commit, the developer fixes the related code but does not clearly identify all affected functions. By analyzing the Git commit history, the developer may find that the updateData function in fileA.c is fixed, but there is also a processData function in the same file. Although it is not directly modified, it may also be affected by this vulnerability due to its calling relationship with updateData. This approach allows us to effectively identify a set of vulnerable functions, even though some of them were not directly modified in the commit.

[0081] In some embodiments, step S1032 further includes: extracting natural language NLP keywords from vulnerability descriptions of each vulnerability based on a preset vulnerability function keyword corpus. When applied, the vulnerability description is segmented according to the vulnerability function keyword corpus, and corresponding keywords are obtained based on the segmentation results. The purpose of natural language NLP analysis of vulnerability descriptions is achieved through the setting of the keyword corpus.

[0082] Another embodiment of the present application provides a device for detecting security vulnerabilities in automobile firmware, such as Figure 2As shown, the device 20 includes: a vulnerability function identification module 201, a component information determination module 202 and a potential vulnerability detection module 203.

[0083] A vulnerability function identification module 201 is used to determine a target vulnerability function set of a target firmware of an intelligent network-connected vehicle based on function signatures corresponding to respective vulnerability functions in a pre-built vulnerability function set;

[0084] A component information determination module 202, used to determine component information used by the firmware, the component information including component name and component version number;

[0085] The potential vulnerability detection module 203 is used to search in a pre-built mapping relationship based on the target vulnerability function set and component information to obtain the potential vulnerabilities of the target firmware. The mapping relationship includes the corresponding relationship between the vulnerability information corresponding to each of the multiple firmwares and their potential vulnerability sets. The vulnerability information includes the component name and its corresponding component version number and the vulnerability function set.

[0086] The embodiment of the present application identifies the functions of the target firmware of the intelligent connected vehicle through the function signatures corresponding to each vulnerability function in the pre-built vulnerability function set to obtain the target vulnerability function set, and determines the component information used by the target firmware, the component information including the component name and the component version number, so as to search in the pre-built mapping relationship according to the target vulnerability function set and the component information to obtain the potential vulnerabilities of the target firmware, the mapping relationship including the corresponding relationship between the vulnerability information corresponding to the multiple firmwares and their potential vulnerability sets, the vulnerability information including the component name and its corresponding component version number and the vulnerability function set. This method of associating the potential vulnerability sets of component firmware of different suppliers with the vulnerability information can analyze the vulnerability functions used by the component firmware, thereby identifying the corresponding potential vulnerabilities, and avoiding the occurrence of long-term vulnerability problems in intelligent connected vehicles due to the supplier's failure to obtain vulnerability information in a timely manner.

[0087] Furthermore, the vulnerability function identification module includes:

[0088] The target firmware similarity calculation submodule is used to calculate the similarity between each function of the target firmware and the function signature corresponding to each vulnerability function in the vulnerability function set;

[0089] The target firmware function determination submodule is used to determine any vulnerability function in the vulnerability function set as the target vulnerability function of the target firmware if the similarity between any function of the target firmware and any vulnerability function in the vulnerability function set is greater than a preset similarity threshold, so as to obtain the target vulnerability function set.

[0090] Furthermore, before determining the target vulnerability function set of the target firmware of the intelligent networked vehicle based on the function signatures corresponding to the respective vulnerability functions in the pre-built vulnerability function set, the vulnerability function identification module further includes:

[0091] The vulnerability function feature extraction submodule is used to extract multiple features from any vulnerability function in the vulnerability function set, and determine multiple function signatures of any vulnerability function based on the extracted multiple features.

[0092] Furthermore, the function signature includes at least one of the following:

[0093] String reference signature, stack size signature, fuzzy hash signature, and instruction frequency signature.

[0094] Furthermore, before the potential vulnerability detection module searches the target vulnerability function set and component information in a pre-built mapping relationship to obtain the potential vulnerability of the target firmware, the mapping relationship includes the corresponding relationship between the vulnerability information corresponding to each of the multiple firmwares and their potential vulnerability sets, and the vulnerability information includes the component name and its corresponding component version number and the vulnerability function set, the device also includes:

[0095] A vulnerability related information determination submodule is used to determine the vulnerability related information corresponding to each vulnerability in the pre-configured vulnerability database, and the vulnerability related information includes the component name, the version number of each component affecting the corresponding vulnerability, and the vulnerability description;

[0096] A vulnerability function set sub-determination module is used to extract natural language NLP keywords from vulnerability descriptions corresponding to each vulnerability in the vulnerability database, and determine the vulnerability function set corresponding to each vulnerability in the vulnerability database based on the extraction results;

[0097] The vulnerability association determination submodule is used to construct component associations, which include component names corresponding to each vulnerability in the vulnerability database, component version numbers affecting the corresponding vulnerabilities, and vulnerability function sets corresponding to each vulnerability.

[0098] The mapping relationship determination submodule is used to perform mapping processing according to the component association relationship and the vulnerability function set corresponding to each vulnerability in the vulnerability database to obtain a mapping relationship.

[0099] Furthermore, the vulnerability function set sub-determination module includes:

[0100] A first function determination unit, configured to determine a vulnerability function set of any vulnerability according to the function where the vulnerability is located, if the vulnerability description of any vulnerability includes the function where the vulnerability is located;

[0101] The second function determination unit is used to determine the vulnerability repair submission record corresponding to the vulnerability identifier of any vulnerability if the vulnerability description of any vulnerability does not include the function where the vulnerability is located, and determine the vulnerability function set of any vulnerability based on the vulnerability repair submission record.

[0102] Furthermore, the vulnerability function set sub-determination module includes:

[0103] The keyword extraction submodule is used to extract natural language NLP keywords from the vulnerability descriptions of each vulnerability based on the preset vulnerability function keyword corpus.

[0104] The automobile firmware security vulnerability detection device of this embodiment can execute the automobile firmware security vulnerability detection method provided in the embodiment of the present application. Its implementation principle is similar and will not be repeated here.

[0105] Another embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory, and the processor executes the computer program to implement the above method.

[0106] Specifically, the processor may be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0107] Specifically, the processor is connected to the memory via a bus, and the bus may include a path for transmitting information. The bus may be a PCI bus or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc.

[0108] The memory may be a ROM or other type of static storage device that can store static information and instructions, a RAM or other type of dynamic storage device that can store information and instructions, or an EEPROM, CD-ROM or other optical disk storage, optical disk storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0109] Optionally, the memory is used to store the code of the computer program for executing the solution of the present application, and the execution is controlled by the processor. The processor is used to execute the application program code stored in the memory to implement the actions of the device provided in the above embodiment.

[0110] Another embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the above method when executed by a processor.

[0111] The device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0112] It will be appreciated by those skilled in the art that all or some of the steps and systems in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or transient medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0113] The above is a specific description of the preferred implementation of the present application, but the present application is not limited to the above-mentioned implementation mode. Technical personnel familiar with the field can also make various equivalent deformations or substitutions without violating the spirit of the present application. These equivalent deformations or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. A method for detecting security vulnerabilities in automobile firmware, characterized in that: include: Determine a target vulnerability function set of a target firmware of an intelligent connected vehicle based on function signatures corresponding to each vulnerability function in a pre-built vulnerability function set; Determine component information used by the target firmware, the component information including component name and component version number; A search is performed in a pre-constructed mapping relationship based on the target vulnerability function set and the component information to obtain potential vulnerabilities of the target firmware. The mapping relationship includes the corresponding relationship between the vulnerability information corresponding to each of the multiple firmwares and their potential vulnerability sets. The vulnerability information includes the component name and its corresponding component version number and the vulnerability function set.

2. The method according to claim 1, characterized in that The method of determining a target vulnerability function set of a target firmware of an intelligent networked vehicle based on function signatures corresponding to respective vulnerability functions in a pre-built vulnerability function set includes: Calculate the similarity between each function of the target firmware and the function signature corresponding to each vulnerability function in the vulnerability function set; If the similarity between any function of the target firmware and any vulnerability function in the vulnerability function set is greater than a preset similarity threshold, the any vulnerability function in the vulnerability function set is used as the target vulnerability function of the target firmware to obtain the target vulnerability function set.

3. The method according to claim 2, characterized in that Before determining the target vulnerability function set of the target firmware of the intelligent network-connected vehicle based on the function signatures corresponding to the respective vulnerability functions in the pre-built vulnerability function set, the method further includes: Perform multiple feature extraction on any vulnerability function in the vulnerability function set, and determine multiple function signatures of the any vulnerability function based on the extracted multiple features.

4. The method according to claim 3, characterized in that The function signature includes at least one of the following: String reference signature, stack size signature, fuzzy hash signature, and instruction frequency signature.

5. The method according to claim 1, characterized in that The method further comprises: searching in a pre-built mapping relationship according to the target vulnerability function set and the component information to obtain potential vulnerabilities of the target firmware, wherein the mapping relationship includes the corresponding relationship between vulnerability information corresponding to each of the multiple firmwares and their potential vulnerability sets, and the vulnerability information includes a component name and its corresponding component version number and a vulnerability function set. Determine vulnerability related information corresponding to each vulnerability in a pre-configured vulnerability database, wherein the vulnerability related information includes a component name, a version number of each component affecting the corresponding vulnerability, and a vulnerability description; Performing natural language NLP keyword extraction on the vulnerability descriptions corresponding to the respective vulnerabilities in the vulnerability database, and determining vulnerability function sets corresponding to the respective vulnerabilities in the vulnerability database according to the extraction results; Constructing a component association relationship, wherein the component association relationship includes a correspondence relationship between component names corresponding to the respective vulnerabilities in the vulnerability database, version numbers of the respective components affecting the corresponding vulnerabilities, and vulnerability function sets corresponding to the respective vulnerabilities; Mapping processing is performed according to the component association relationship and the vulnerability function sets corresponding to the respective vulnerabilities in the vulnerability database to obtain the mapping relationship.

6. The method according to claim 5, characterized in that The extracting NLP keywords from the vulnerability descriptions corresponding to the vulnerabilities in the vulnerability database, and determining the set of vulnerability functions corresponding to the vulnerabilities in the vulnerability database according to the extraction results, includes: If the vulnerability description of any vulnerability includes the function where the vulnerability is located, determining the vulnerability function set of the vulnerability according to the function where the vulnerability is located; If the vulnerability description of any vulnerability does not include the function where the vulnerability is located, a vulnerability repair submission record corresponding to the vulnerability identifier of the vulnerability is determined, and a vulnerability function set of the vulnerability is determined based on the vulnerability repair submission record.

7. The method according to claim 5, characterized in that The extracting NLP keywords from the vulnerability descriptions corresponding to the vulnerabilities in the vulnerability database includes: Based on the preset vulnerability function keyword corpus, natural language NLP keyword extraction is performed on the vulnerability description of each vulnerability.

8. A vehicle firmware security vulnerability detection device, characterized in that: include: A vulnerability function identification module, used to determine a target vulnerability function set of a target firmware of an intelligent connected vehicle based on function signatures corresponding to each vulnerability function in a pre-built vulnerability function set; A component information determination module, used to determine the component information used by the target firmware, the component information including the component name and the component version number; A potential vulnerability detection module is used to search in a pre-built mapping relationship based on the target vulnerability function set and the component information to obtain potential vulnerabilities of the target firmware. The mapping relationship includes the corresponding relationship between the vulnerability information corresponding to each of the multiple firmwares and their potential vulnerability sets. The vulnerability information includes the component name and its corresponding component version number and the vulnerability function set.

9. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images