Internet of Things equipment firmware boundary program detection method and system

Abstract

The invention relates to the technical field of firmware security analysis, in particular to an Internet of Things equipment firmware boundary program detection method and system.The Internet of Things equipment firmware is collected, the firmware is analyzed, and a binary executable program in the firmware is extracted; screening out a boundary program and a non-boundary program corresponding to a network protocol of the Internet of Things equipment from the binary executable program, and constructing a boundary program data set and a non-boundary program data set; utilizing the multi-dimensional feature model to extract corresponding boundary program feature vectors and non-boundary program feature vectors in the boundary program data set and the non-boundary program, and constructing a training sample set to train a boundary program prediction model based on ensemble learning by utilizing the training sample set; and using the trained boundary program prediction model to identify the boundary program in the firmware of the to-be-detected Internet of Things equipment. The method can be suitable for automatic and accurate classification and detection of the boundary programs in the equipment firmware, and the missing report rate of the boundary programs is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of firmware security analysis, and in particular to a method and system for detecting firmware boundary programs of an Internet of Things device. Background Art

[0002] IoT device firmware is a core component of the communication between the device and the outside world, especially the firmware of devices based on the Linux operating system, which is particularly important due to its widespread use. Most device firmware consists of many complex and interdependent binary program components, which are not only numerous but also closely related to each other. Boundary programs, also known as border binaries, play a vital role in IoT device firmware; they are responsible for listening, receiving and processing data requests and instructions from the external network. These programs perform necessary operations on the incoming data according to established rules and logic, including verification, filtering and conversion. As the interface for firmware to interact with the outside world, boundary programs are the first line of defense against potential attacks and are the key entry point for attackers to try to manipulate or inject malicious data to penetrate the firmware.

[0003] Since the boundary program was proposed in 2020, researchers have used different heuristic methods to automatically identify boundary programs in order to improve the efficiency and quality of boundary program detection. For example, researchers such as Redini used five features to identify boundary programs, while researchers such as Cheng located boundary programs based only on shared keywords between the front-end and back-end of the web. These methods fail to fully cover the key features of boundary programs in feature selection. So far, there is no clear standard to guide the selection and extraction of features for boundary programs. Given the lack of open source boundary program datasets, it is necessary to build a boundary program dataset suitable for training machine learning methods through a combination of automated tools and manual review. This part of the work is highly dependent on expert experience and requires significant workload. At present, the amount of boundary program data used for training by existing methods is seriously insufficient. Selecting a suitable boundary program detection model can provide higher boundary program location accuracy and reduce response time, thereby improving the efficiency of boundary program detection. Existing methods need further research and improvement in the selection of detection models. Researchers such as Redini mainly target the HTTP protocol, and the method proposed by researchers such as Cheng cannot detect situations where data is not transmitted through shared strings, such as interaction through protocol data. Existing methods usually only detect a specific type of boundary features, but lack an overall grasp of the boundary program type. Therefore, there is an urgent need for an automated boundary program detection method to solve the problem that the existing detection accuracy is affected by insufficient description of boundary program features. Summary of the invention

[0004] To this end, the present invention provides a method and system for detecting boundary programs in firmware of an Internet of Things device, which solve the problems of high false negative rate in the existing automatic detection of boundary programs.

[0005] According to the design scheme provided by the present invention, on the one hand, a method for detecting a firmware boundary program of an IoT device is provided, comprising:

[0006] Collect IoT device firmware, parse the firmware and extract the binary executable program in the firmware;

[0007] Filter out boundary programs and non-boundary programs corresponding to the network protocol of the IoT device from the binary executable program, and construct boundary program data sets and non-boundary program data sets, wherein the boundary program is a binary executable program related to the IoT device firmware interacting with the outside world using the network protocol;

[0008] Extracting boundary program feature vectors and non-boundary program feature vectors corresponding to boundary program data sets and non-boundary programs using a multidimensional feature model, and constructing a training sample set, so as to train a boundary program prediction model based on ensemble learning using the training sample set, wherein the multidimensional feature model is used to characterize program-level features and function-level features of boundary programs, and the boundary program prediction model based on ensemble learning includes a plurality of base learners and a meta-learner;

[0009] The firmware of the IoT device to be detected is unpacked and the executable program in the firmware of the IoT device to be detected is extracted. All feature vectors of the executable program are extracted according to the multidimensional feature model. The feature vectors of the firmware of the IoT device to be detected are input into the trained boundary program prediction model. The boundary program prediction model is used to identify the boundary program in the firmware of the IoT device to be detected.

[0010] As a method for detecting firmware boundary programs of an IoT device of the present invention, further, the firmware is parsed and the binary executable program in the firmware is extracted, including:

[0011] Use the unpacking tool to unpack the firmware and extract the firmware file system;

[0012] Based on the firmware file system attributes, the preset filtering rules are used to exclude redundant data and filter out all binary executable programs in the firmware file system, wherein the redundant data includes script files, configuration files and dynamic link libraries.

[0013] As the IoT device firmware boundary program detection method of the present invention, further, the boundary program corresponding to the IoT device network protocol is screened out from the binary executable program, and a boundary program data set is constructed, including:

[0014] According to the application programming interface that needs to be called during the interaction between the IoT device firmware and the outside world, the binary executable program is disassembled using the disassembly method, and the candidate boundary programs in the binary executable program are screened out based on the disassembly results;

[0015] Using reverse analysis tools to decompile the network parsing functions in the candidate boundary program, so as to filter the candidate boundary program according to the decompilation results;

[0016] A boundary program dataset is constructed based on the remaining candidate boundary programs.

[0017] As the method for detecting the boundary program of the firmware of the Internet of Things device of the present invention, further, the multidimensional feature model M is expressed as M=[V0, V1, V2, ..., V 14 ], where V0 is the number of APIs related to receiving external input in the binary executable program; V1 is the number of strings related to network communication in the binary executable program; V2 is the number of basic blocks in the function; V3 is the number of conditional branch statements in the function; V4 is the number of APIs related to network communication in the function; V5 is the number of APIs related to standard I / O in the function; V6 is the number of APIs related to environment variables in the function; V7 is the number of APIs related to string comparison in the function; V8 is the number of APIs related to string operation in the function; V9 is the number of APIs related to string search in the function; V 10 V is the number of string conversion APIs in the function; 11 is the number of authentication and authorization related strings in the function; V 12 V is the number of HTTP connection request related strings in the function; 13 V is the number of strings related to the MQTT connection request in the function; 14 is the number of strings related to the client and server connection requests in the function, and V0 and V1 are program-level features, V2-V 14 It is a function-level feature.

[0018] As the method for detecting boundary programs of firmware of IoT devices of the present invention, further, a multidimensional feature model is used to extract boundary program feature vectors and non-boundary program feature vectors corresponding to boundary program data sets and non-boundary programs, including:

[0019] Extract the number of application programming interfaces related to receiving external input and the number of strings related to network communication in boundary programs and non-boundary programs;

[0020] Extract the number of basic blocks of network parsing functions in the boundary program, the number of conditional branch statements, the number of related application programming interfaces, the number of authentication and authorization related strings, the number of HTTP connection request related strings, the number of MQTT connection request related strings, and the number of client-server connection request related strings;

[0021] Take any function F in the non-boundary program, extract the number of basic blocks, the number of conditional branch statements, the number of related application programming interfaces, the number of authentication and authorization related strings, the number of HTTP connection request related strings, the number of MQTT connection request related strings, and the number of client-server connection request related strings in function F;

[0022] The data extracted from the boundary program and the non-boundary program are formed into vectors represented by a multi-dimensional feature model;

[0023] Among them, the number of related application programming interfaces includes the number of network communication application programming interfaces, network communication application programming interfaces, standard I / O related application programming interfaces, the number of environment related application programming interfaces, the number of string comparison application programming interfaces, the number of string operation application programming interfaces, the number of string search application programming interfaces and the number of string conversion application programming interfaces.

[0024] As the method for detecting boundary programs of firmware of IoT devices of the present invention, further, a boundary program prediction model based on ensemble learning is trained using a training sample set, comprising:

[0025] Perform normalization preprocessing on the training sample set data, and use the boundary feature vectors in the training sample set after normalization preprocessing as positive sample data and the non-boundary feature vectors as negative sample data;

[0026] Divide the positive and negative sample data into training samples and verification samples according to the preset ratio;

[0027] The training samples are used to train the boundary program prediction model based on ensemble learning, and the validation samples are used to optimize the parameters of the trained boundary program prediction model.

[0028] As a method for detecting boundary programs in firmware of an Internet of Things device of the present invention, further, the several base learners include an XGBoost base learner, a LightGBM base learner and a CatBoost base learner, and the meta-learner is a random forest meta-learner, so that the training sample sets are respectively sent to each base learner for independent training, and the predicted outputs of each base learner are composed of new training data, which are input into the meta-learner for training, and the optimal settings of the boundary program prediction model parameters are obtained through grid search.

[0029] On the other hand, the present invention also provides an IoT device firmware boundary program detection system, comprising: a firmware parsing module, a program screening module, a model training module and a target detection module, wherein:

[0030] The firmware parsing module is used to collect IoT device firmware, parse the firmware and extract the binary executable program in the firmware;

[0031] A program screening module is used to screen out boundary programs and non-boundary programs corresponding to the network protocol of the Internet of Things device from the binary executable program, and to construct boundary program data sets and non-boundary program data sets. The boundary program is a binary executable program related to the interaction between the firmware of the Internet of Things device and the outside world using the network protocol;

[0032] A model training module, used to extract boundary program feature vectors and non-boundary program feature vectors corresponding to boundary program data sets and non-boundary programs using a multidimensional feature model, and to construct a training sample set, so as to train a boundary program prediction model based on ensemble learning using the training sample set, wherein the multidimensional feature model is used to characterize program-level features and function-level features of boundary programs, and the boundary program prediction model based on ensemble learning includes a plurality of base learners and a meta-learner;

[0033] The target detection module is used to unpack the firmware of the IoT device to be detected and extract the executable program in the firmware of the IoT device to be detected, extract all feature vectors of the executable program according to the multidimensional feature model, input the feature vector of the firmware of the IoT device to be detected into the trained boundary program prediction model, and use the boundary program prediction model to identify the boundary program in the firmware of the IoT device to be detected.

[0034] Beneficial effects of the present invention:

[0035] The present invention constructs a multidimensional feature model that characterizes the characteristics of boundary programs in the firmware of Internet of Things devices, which can accurately characterize the characteristics of boundary programs and provide important reference value for the research on boundary program detection; uses the stacking method of ensemble learning to construct and train the boundary program detection model of the firmware of Internet of Things devices to achieve effective detection of boundary programs; uses the boundary program samples of the boundary program data set to cover nearly 11 network protocols from a variety of typical Internet of Things device types, providing an important data basis for boundary program analysis and identification research, and can accurately realize the automatic classification and detection of boundary programs, which can be applicable to the automatic and accurate classification and detection of boundary programs in device firmware, reduce the missed reporting rate of boundary programs, and provide important support for binary program analysis, vulnerability detection and vulnerability detection of Internet of Things device firmware. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1This is a schematic diagram of the IoT device firmware boundary program detection process in the embodiment;

[0037] Figure 2 The figure is a schematic diagram of the principle of the IoT device firmware boundary program detection algorithm in the embodiment. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0039] Boundary programs are a type of binary program in the firmware of an IoT device based on the Linux operating system that is responsible for receiving external input data and processing the data according to preset rules and logic. In view of the limitations and challenges of the current firmware boundary program detection technology, an embodiment of the present invention provides a method for detecting firmware boundary programs of IoT devices, comprising:

[0040] S101. Collect IoT device firmware, parse the firmware and extract binary executable programs from the firmware.

[0041] Specifically, the firmware is parsed and the binary executable program in the firmware is extracted, which can be designed to include:

[0042] Use the unpacking tool to unpack the firmware and extract the firmware file system;

[0043] Based on the firmware file system attributes, the preset filtering rules are used to exclude redundant data and filter out all binary executable programs in the firmware file system, wherein the redundant data includes script files, configuration files and dynamic link libraries.

[0044] A large number of IoT device firmware can be obtained from the official website of the supplier, OTA upgrade and update, and third-party archives; use the unpacking tool to unpack the device firmware and extract the file system of the device firmware; specifically, use the binwalk unpacking tool to unpack, binwalk is the most widely used unpacking tool, but there is an incomplete extraction problem when binwalk extracts JFFS2 and SquashFS file systems. You can use jefferson and sasquatch to replace jffsdump and unsquashfs in binwalk, so as to achieve complete extraction of JFFS2 and SquashFS file systems. Perform file system analysis on the unpacked 8192 firmwares, exclude script files, configuration files, and dynamic link libraries, and identify all executable binary programs.

[0045] S102. Filter out boundary programs and non-boundary programs corresponding to the network protocol of the Internet of Things device from the binary executable program, and construct a boundary program data set and a non-boundary program data set. The boundary program is a related binary executable program for the Internet of Things device firmware to interact with the outside world using the network protocol.

[0046] Specifically, according to the application programming interface that needs to be called during the interaction between the IoT device firmware and the outside world, the binary executable program can be disassembled using a disassembly method, and candidate boundary programs in the binary executable program can be screened out based on the disassembly results; the network parsing functions in the candidate boundary programs can be decompiled using reverse analysis tools, so as to delete the candidate boundary programs that are not network parsing functions based on the decompilation results; and a boundary program dataset can be constructed based on the remaining candidate boundary programs.

[0047] By analyzing the network protocols used by IoT devices to interact with the outside world, such as UPnP, RTMP, SMTP, PPP, SOAP, HNAP, SSDP, CWMP, HTTP, MQTT and DAAP protocols, the network coding strings related to the commonly used network protocols in the interaction process are collected. The commonly used network coding strings collected above are: username, password, UserPwd, Authenticate-Request, Authenticate-Ack, Authenticate-Nak, Challenge, Response, Success, Auth, login, GET, POST, PUT, DELETE, HEAD, CONNECT, REQUEST_METHOD , QUERY_STRING, boundary=, HTTP_, query, Content-Type, CONTENT_TYPE, ACCEPT, socket, user-agent, request, MQTT, QoS, PINGREQ, PINGRESP, CONNACK, publish, topic, SUBSCRIB E,PUBLISH,SUBACK,PUBACK,client_topic,REMOTE_ADDR,RemoteEndPoint,Client_id,server_host,ProtocolVersion,admin.,getserverHost,URL,soap,index.,remote,SSID.

[0048] Analyze the APIs that IoT device firmware often calls when processing external input data, and collect the APIs commonly used for device firmware communication. The collected communication-related APIs are recv, recvfrom, connect, listen, bind, accept, socket, send, sendto, sethostbyname, getaddrinfo, getnamein, gets, getchar, sscanf, scanf, fgets, fget, fgetc, fscanf, getline, open, fopen, fread, fclose, read, readfile, getenv, getenv_s, and setenv.

[0049] The network coding strings related to the commonly used network protocols and the APIs commonly used by firmware to interact with the outside world are introduced into the Karonte method, and the method for calculating the network resolution function score is improved, and finally a large number of candidate boundary programs and candidate network resolution functions are obtained from a large number of firmware. The improvement of the above method for calculating the network resolution function score is expressed as:

[0050] newps j =ps j *(1+0.2*#RECV_API)

[0051] S103. Use a multidimensional feature model to extract the corresponding boundary program feature vectors and non-boundary program feature vectors in the boundary program data set and the non-boundary program, and construct a training sample set to use the training sample set to train an ensemble learning-based boundary program prediction model, wherein the multidimensional feature model is used to characterize the program-level features and function-level features of the boundary program, and the ensemble learning-based boundary program prediction model includes a plurality of base learners and a meta-learner.

[0052] The multidimensional feature model M can be expressed as M = [V0, V1, V2, ..., V 14 ], where V0 is the number of APIs related to receiving external input in the binary executable program; V1 is the number of strings related to network communication in the binary executable program; V2 is the number of basic blocks in the function; V3 is the number of conditional branch statements in the function; V4 is the number of APIs related to network communication in the function; V5 is the number of APIs related to standard I / O in the function; V6 is the number of APIs related to environment variables in the function; V7 is the number of APIs related to string comparison in the function; V8 is the number of APIs related to string operation in the function; V9 is the number of APIs related to string search in the function; V 10V is the number of string conversion APIs in the function; 11 is the number of authentication and authorization related strings in the function; V 12 V is the number of HTTP connection request related strings in the function; 13 V is the number of strings related to the MQTT connection request in the function; 14 is the number of strings related to the client and server connection requests in the function, and V0 and V1 are program-level features, V2-V 14 It is a function-level feature.

[0053] Analyze the characteristics of boundary programs, obtain program-level behavioral characteristics (the number of APIs related to receiving external input in binary programs) and semantic characteristics (the number of strings related to network communication in binary programs), as well as function-level structural characteristics (the number of basic blocks, the number of conditional branch statements), behavioral characteristics (the number of string comparison APIs, the number of string operation APIs, the number of string search APIs, the number of string conversion APIs) and semantic characteristics (the number of strings related to authentication and authorization, the number of strings related to HTTP connection requests, the number of strings related to MQTT connection requests, and the number of strings related to client and server connection requests).

[0054] The program-level features of boundary programs and non-boundary programs (i.e., V0 and V1) are obtained by analyzing the entire binary program, while the function-level features of boundary programs (i.e., V2~V 14 ) is the feature vector of any network parsing function contained in it. Note that since there may be multiple network parsing functions in a boundary program, the feature vector of a boundary program can also correspond to multiple network parsing functions; the function-level features of non-boundary programs are constructed by selecting one of all the functions it contains, and considering the distribution of the eigenvalues ​​of the function, a certain number of feature vectors are selected from all the feature vectors of non-boundary programs.

[0055] A plurality of feature vectors are constructed from several boundary programs as a positive sample set, and a plurality of feature vectors are selected from all non-boundary program feature vectors as a negative sample set.

[0056] Specifically, using the training sample set to train the boundary program prediction model based on ensemble learning may include:

[0057] Perform normalization preprocessing on the training sample set data, and use the boundary feature vectors in the training sample set after normalization preprocessing as positive sample data and the non-boundary feature vectors as negative sample data;

[0058] Divide the positive and negative sample data into training samples and verification samples according to the preset ratio;

[0059] The training samples are used to train the boundary program prediction model based on ensemble learning, and the validation samples are used to optimize the parameters of the trained boundary program prediction model.

[0060] The Yeo-Johnson transformation in PowerTransformer can be used to normalize all feature vectors in the sample set. Figure 1 and 2 As shown in the figure, XGBoost, LightGBM and CatBoost models are used as base learners, and random forest is used as meta learner to form the final stacking method. 80% of the positive and negative samples are selected as training sample sets, and the remaining 20% ​​are used as validation sample sets. The training sample sets are sent to each base learner for independent training. The prediction output of each base learner is used to form new training data, which is input into the meta learner for training. The stacking method is used for training and verification. The optimal setting of the boundary program prediction model parameters is obtained through grid search to obtain the final detection model and end.

[0061] S104, unpacking the firmware of the IoT device to be detected and extracting the executable program in the firmware of the IoT device to be detected, extracting all feature vectors of the executable program according to the multidimensional feature model, inputting the feature vector of the firmware of the IoT device to be detected into the trained boundary program prediction model, and using the boundary program prediction model to identify the boundary program sequence in the firmware of the IoT device to be detected.

[0062] Furthermore, based on the above method, an embodiment of the present invention also provides an IoT device firmware boundary program detection system, comprising: a firmware parsing module, a program screening module, a model training module and a target detection module, wherein:

[0063] The firmware parsing module is used to collect IoT device firmware, parse the firmware and extract the binary executable program in the firmware;

[0064] A program screening module is used to screen out boundary programs and non-boundary programs corresponding to the network protocol of the Internet of Things device from the binary executable program, and to construct boundary program data sets and non-boundary program data sets. The boundary program is a binary executable program related to the interaction between the firmware of the Internet of Things device and the outside world using the network protocol;

[0065] A model training module, used to extract boundary program feature vectors and non-boundary program feature vectors corresponding to boundary program data sets and non-boundary programs using a multidimensional feature model, and to construct a training sample set, so as to train a boundary program prediction model based on ensemble learning using the training sample set, wherein the multidimensional feature model is used to characterize program-level features and function-level features of boundary programs, and the boundary program prediction model based on ensemble learning includes a plurality of base learners and a meta-learner;

[0066] The target detection module is used to unpack the firmware of the IoT device to be detected and extract the executable program in the firmware of the IoT device to be detected, extract all feature vectors of the executable program according to the multidimensional feature model, input the feature vector of the firmware of the IoT device to be detected into the trained boundary program prediction model, and use the boundary program prediction model to identify the boundary program in the firmware of the IoT device to be detected.

[0067] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0068] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0069] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0070] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0071] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for detecting boundary programs of IoT device firmware, characterized in that: Include: Collect IoT device firmware, parse the firmware and extract the binary executable program in the firmware; Filter out boundary programs and non-boundary programs corresponding to the network protocol of the IoT device from the binary executable program, and construct boundary program data sets and non-boundary program data sets, wherein the boundary program is a binary executable program related to the IoT device firmware interacting with the outside world using the network protocol; Extracting boundary program feature vectors and non-boundary program feature vectors corresponding to boundary program data sets and non-boundary programs using a multidimensional feature model, and constructing a training sample set, so as to train a boundary program prediction model based on ensemble learning using the training sample set, wherein the multidimensional feature model is used to characterize program-level features and function-level features of boundary programs, and the boundary program prediction model based on ensemble learning includes a plurality of base learners and a meta-learner; The firmware of the IoT device to be detected is unpacked and the executable program in the firmware of the IoT device to be detected is extracted. All feature vectors of the executable program are extracted according to the multidimensional feature model. The feature vectors of the firmware of the IoT device to be detected are input into the trained boundary program prediction model. The boundary program prediction model is used to identify the boundary program in the firmware of the IoT device to be detected.

2. The method for detecting the boundary program of the IoT device firmware according to claim 1, characterized in that: Parse the firmware and extract the binary executable program in the firmware, including: Use the unpacking tool to unpack the firmware and extract the firmware file system; Based on the firmware file system attributes, the preset filtering rules are used to exclude redundant data and filter out all binary executable programs in the firmware file system, wherein the redundant data includes script files, configuration files and dynamic link libraries.

3. The method for detecting the boundary program of the IoT device firmware according to claim 1, characterized in that: Filter out the boundary programs corresponding to the IoT device network protocol from the binary executable programs and build a boundary program dataset, including: According to the application programming interface that needs to be called during the interaction between the IoT device firmware and the outside world, the binary executable program is disassembled using the disassembly method, and the candidate boundary programs in the binary executable program are screened out based on the disassembly results; Using reverse analysis tools to decompile the network parsing functions in the candidate boundary program, so as to filter the candidate boundary program according to the decompilation results; A boundary program dataset is constructed based on the remaining candidate boundary programs.

4. The method for detecting the boundary program of the IoT device firmware according to claim 1, characterized in that: The multidimensional feature model M is expressed as M=[V0, V1, V2, ..., V 14 ], where V0 is the number of APIs related to receiving external input in the binary executable program; V1 is the number of strings related to network communication in the binary executable program; V2 is the number of basic blocks in the function; V3 is the number of conditional branch statements in the function; V4 is the number of APIs related to network communication in the function; V5 is the number of APIs related to standard I / O in the function; V6 is the number of APIs related to environment variables in the function; V7 is the number of APIs related to string comparison in the function; V8 is the number of APIs related to string operation in the function; V9 is the number of APIs related to string search in the function; V 10 V is the number of string conversion APIs in the function; 11 is the number of authentication and authorization related strings in the function; V 12 V is the number of HTTP connection request related strings in the function; 13 V is the number of strings related to the MQTT connection request in the function; 14 is the number of strings related to the client and server connection requests in the function, and V0 and V1 are program-level features, V2-V 14 It is a function-level feature.

5. The method for detecting the boundary program of the IoT device firmware according to claim 1 or 4, characterized in that: The multidimensional feature model is used to extract the boundary program feature vectors and non-boundary program feature vectors corresponding to the boundary program data set and the non-boundary program, including: Extract the number of application programming interfaces related to receiving external input and the number of strings related to network communication in boundary programs and non-boundary programs; Extract the number of basic blocks of network parsing functions in the boundary program, the number of conditional branch statements, the number of related application programming interfaces, the number of authentication and authorization related strings, the number of HTTP connection request related strings, the number of MQTT connection request related strings, and the number of client-server connection request related strings; Take any function F in the non-boundary program, extract the number of basic blocks, the number of conditional branch statements, the number of related application programming interfaces, the number of authentication and authorization related strings, the number of HTTP connection request related strings, the number of MQTT connection request related strings, and the number of client-server connection request related strings in function F; The data extracted from the boundary program and the non-boundary program are formed into vectors represented by a multi-dimensional feature model; Among them, the number of related application programming interfaces includes the number of network communication application programming interfaces, network communication application programming interfaces, standard I / O related application programming interfaces, the number of environment related application programming interfaces, the number of string comparison application programming interfaces, the number of string operation application programming interfaces, the number of string search application programming interfaces and the number of string conversion application programming interfaces.

6. The method for detecting the boundary program of the IoT device firmware according to claim 1, characterized in that: The training sample set is used to train the boundary program prediction model based on ensemble learning, including: Perform normalization preprocessing on the training sample set data, and use the boundary feature vectors in the training sample set after normalization preprocessing as positive sample data and the non-boundary feature vectors as negative sample data; Divide the positive and negative sample data into training samples and verification samples according to the preset ratio; The training samples are used to train the boundary program prediction model based on ensemble learning, and the validation samples are used to optimize the parameters of the trained boundary program prediction model.

7. The method for detecting the boundary program of the IoT device firmware according to claim 1 or 6, characterized in that: The several base learners include XGBoost base learner, LightGBM base learner and CatBoost base learner, and the meta learner is a random forest meta learner, which sends the training sample set to each base learner for independent training, and the prediction output of each base learner constitutes new training data, which is input into the meta learner for training, and the optimal settings of the boundary program prediction model parameters are obtained through grid search.

8. A firmware boundary program detection system for an Internet of Things device, characterized in that: It includes: firmware parsing module, program screening module, model training module and target detection module, among which, The firmware parsing module is used to collect IoT device firmware, parse the firmware and extract the binary executable program in the firmware; A program screening module is used to screen out boundary programs and non-boundary programs corresponding to the network protocol of the IoT device from the binary executable program, and to construct boundary program data sets and non-boundary program data sets. The boundary program is a binary executable program related to the IoT device firmware interacting with the outside world using the network protocol; A model training module, used to extract boundary program feature vectors and non-boundary program feature vectors corresponding to boundary program data sets and non-boundary programs using a multidimensional feature model, and to construct a training sample set, so as to train a boundary program prediction model based on ensemble learning using the training sample set, wherein the multidimensional feature model is used to characterize program-level features and function-level features of boundary programs, and the boundary program prediction model based on ensemble learning includes a plurality of base learners and a meta-learner; The target detection module is used to unpack the firmware of the IoT device to be detected and extract the executable program in the firmware of the IoT device to be detected, extract all feature vectors of the executable program according to the multidimensional feature model, input the feature vector of the firmware of the IoT device to be detected into the trained boundary program prediction model, and use the boundary program prediction model to identify the boundary program in the firmware of the IoT device to be detected.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images