Industrial controller vulnerability hot repair method and system based on memory forensics

Abstract

The invention discloses an industrial controller vulnerability hot repair method and system based on memory forensics, and the method comprises the steps: obtaining the memory and firmware information of an industrial controller in real time through a firmware extraction module, providing data support for the subsequent vulnerability analysis, and maintaining the stable operation of the system; vulnerabilities and abnormities in the system are accurately searched through memory analysis and behavior detection by a vulnerability positioning module, and rapid and real-time security response is provided; and the vulnerability repair module performs vulnerability repair on the basis of a vulnerability positioning result by utilizing a hot repair technology under the condition of not interrupting the operation of the control system, so that the security and high availability of the industrial controller are ensured. The firmware extraction module, the vulnerability positioning module and the vulnerability repair module cooperate with one another to form a closed-loop detection, analysis and repair system so as to ensure that the industrial controller can efficiently respond and maintain continuous and stable operation when facing security threats.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial control equipment security, and in particular relates to a method and system for hot repairing industrial controller vulnerabilities based on memory forensics. Background Art

[0002] Currently, industrial controllers face many security challenges, especially considering their widespread use in critical infrastructure and relatively long usage cycles. These challenges mainly include system closedness and lack of source code, outdated software and hardware architecture, poor scalability of communication protocols, limited computing and storage resources, and security risks caused by long maintenance cycles.

[0003] Existing vulnerability repair methods cannot solve the problem of real-time repair in closed-source scenarios in industrial control systems, and still have the following limitations: long downtime, difficult updates, increased security risks, and mismatch with modern industrial needs. It is necessary to develop a technical solution that can repair vulnerabilities in industrial control systems without affecting the normal operation of the controller. Summary of the invention

[0004] In view of this, the purpose of the present invention is to propose a method and system for hot repairing industrial controller vulnerabilities based on memory forensics, so as to solve the current problems of low security, long downtime, high maintenance cost, etc. of industrial controllers, so as to promote the further development and application of industrial controller vulnerability hot repair technology based on memory forensics in the field of industrial Internet, and meet the requirements of modern industry for safe and continuous operation.

[0005] Based on the above objectives, in a first aspect, the present invention provides an industrial controller vulnerability hot repair method based on memory forensics, comprising: Calling a firmware extraction module, identifying the industrial controller architecture, identifying the processor architecture, analyzing the industrial control communication protocol, and extracting firmware memory data through the firmware extraction module; Calling a vulnerability location module, and performing firmware reverse engineering, vulnerability identification processing, vulnerability verification processing, and vulnerability location processing on the firmware memory data extracted by the firmware extraction module through the vulnerability location module; A vulnerability repair module is called, and when the industrial controller is running, the vulnerability repair module generates, verifies and deploys patches for the industrial controller according to the vulnerability locating result of the vulnerability locating module.

[0006] As a preferred solution of the hot repair method for industrial controller vulnerabilities based on memory forensics, in the process of identifying the industrial controller architecture through the firmware extraction module, the hardware structure of the industrial controller is analyzed to obtain the memory structure and peripheral devices of the industrial controller; and the operating system of the industrial controller is identified; In the process of identifying the processor architecture through the firmware extraction module, the processor type used by the industrial controller is identified, and the instruction set architecture of the processor is analyzed to obtain the memory management method of the processor; In the process of analyzing the industrial control communication protocol through the firmware extraction module, the type of communication protocol used by the industrial controller is identified, the protocol data structure is parsed, and the protocol stack vulnerability is analyzed; In the process of extracting the firmware memory data through the firmware extraction module, the memory image acquisition, firmware image acquisition, data verification and storage are performed on the industrial controller.

[0007] As a preferred solution of the industrial controller vulnerability hot repair method based on memory forensics, the firmware reverse engineering performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes firmware disassembly and decompilation, code flow and function analysis, and protocol and interface analysis; The vulnerability identification processing performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes static analysis, dynamic analysis and known vulnerability matching.

[0008] As a preferred solution of the industrial controller vulnerability hot repair method based on memory forensics, the vulnerability verification processing performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes vulnerability reproduction, attack vector assessment and vulnerability impact analysis; The vulnerability location processing performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes vulnerability code location confirmation, memory address mapping, data flow and control flow location.

[0009] As a preferred solution of the industrial controller vulnerability hot repair method based on memory forensics, when the industrial controller is running, the vulnerability repair module generates a patch for the industrial controller according to the vulnerability location result of the vulnerability location module, including vulnerability analysis and repair strategy formulation, patch code writing, and hot repair supported patch generation; Patch verification for industrial controllers includes patch function testing, patch compatibility testing, patch performance and stability testing; Patch deployment for industrial controllers includes online deployment, phased deployment, and post-deployment monitoring and maintenance.

[0010] In a second aspect, the present invention provides an industrial controller vulnerability hot repair system based on memory forensics, comprising: Firmware extraction module, used to identify industrial controller architecture, processor architecture, analyze industrial control communication protocols, and extract firmware memory data; A vulnerability location module, used to perform firmware reverse engineering, vulnerability identification processing, vulnerability verification processing and vulnerability location processing on the firmware memory data extracted by the firmware extraction module; The vulnerability repair module is used to generate, verify and deploy patches for the industrial controller according to the vulnerability location results of the vulnerability location module when the industrial controller is running.

[0011] As a preferred solution for the industrial controller vulnerability hot repair system based on memory forensics, the firmware extraction module is also used to analyze the hardware structure of the industrial controller to obtain the memory structure and peripheral devices of the industrial controller; and identify the operating system of the industrial controller; The firmware extraction module is also used to identify the type of processor used by the industrial controller and analyze the instruction set architecture of the processor to obtain the memory management method of the processor; The firmware extraction module is also used to identify the type of communication protocol used by the industrial controller, parse the protocol data structure, and analyze the protocol stack vulnerabilities; The firmware extraction module is also used to obtain memory images, obtain firmware images, verify and store data on the industrial controller.

[0012] As a preferred solution of the industrial controller vulnerability hot repair system based on memory forensics, the firmware reverse engineering performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes firmware disassembly and decompilation, code flow and function analysis, and protocol and interface analysis; The vulnerability identification processing performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes static analysis, dynamic analysis and known vulnerability matching.

[0013] As a preferred solution for the industrial controller vulnerability hot repair system based on memory forensics, the vulnerability verification processing performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes vulnerability reproduction, attack vector assessment and vulnerability impact analysis; The vulnerability location processing performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes vulnerability code location confirmation, memory address mapping, data flow and control flow location.

[0014] As a preferred solution of the industrial controller vulnerability hot repair system based on memory forensics, the vulnerability repair module generates patches for the industrial controller according to the vulnerability location results of the vulnerability location module when the industrial controller is running, including vulnerability analysis and repair strategy formulation, patch code writing, and hot repair supported patch generation; The patch verification of the industrial controller by the vulnerability repair module includes patch function test, patch compatibility test, patch performance and stability test; The patch deployment performed by the vulnerability repair module on the industrial controller includes online deployment, phased deployment, and post-deployment monitoring and maintenance.

[0015] From the above, it can be seen that the technical solution provided by the present invention obtains the memory and firmware information of the industrial controller in real time through the firmware extraction module to provide data support for subsequent vulnerability analysis while maintaining the stable operation of the system; the vulnerability location module accurately finds vulnerabilities and anomalies in the system through memory analysis and behavior detection, providing fast and real-time security response; the vulnerability repair module uses hot repair technology based on the results of vulnerability location to repair vulnerabilities without interrupting the operation of the control system, ensuring the security and high availability of the industrial controller. The firmware extraction module, the vulnerability location module and the vulnerability repair module cooperate with each other to form a closed-loop detection, analysis and repair system to ensure that the industrial controller can respond efficiently and maintain continuous and stable operation when facing security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A schematic diagram of a process flow of an industrial controller vulnerability hot repair method based on memory forensics provided in an embodiment of the present invention; Figure 2 A schematic diagram of the firmware extraction process in the industrial controller vulnerability hot repair method based on memory forensics provided in an embodiment of the present invention; Figure 3 A schematic diagram of a vulnerability location process in a method for hot-fixing industrial controller vulnerabilities based on memory forensics provided in an embodiment of the present invention; Figure 4 A schematic diagram of a vulnerability repair process in a method for hot repairing an industrial controller vulnerability based on memory forensics provided in an embodiment of the present invention; Figure 5 A schematic diagram of a hot patch generation process in a method for hot repairing industrial controller vulnerabilities based on memory forensics provided in an embodiment of the present invention; Figure 6 An architecture diagram of an industrial controller vulnerability hot repair system based on memory forensics provided in an embodiment of the present invention; Figure 7 Schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0019] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present invention should have the usual meanings understood by people with ordinary skills in the field to which the present invention belongs. The words "include" or "comprise" and the like used in the embodiments of the present invention mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, but do not exclude other elements or objects.

[0020] In the industrial Internet scenario, industrial controllers are core components of modern automated production systems and are widely used in industries such as electricity, smart manufacturing, energy, and transportation. They monitor and control mechanical equipment, processes, and systems through sensing and control functions to ensure efficient and safe production. Unlike personal computer products with a short life cycle, industrial controllers from 20 to 30 years ago (generally referred to as "legacy devices") are often seen in industrial control systems. Especially in critical infrastructure, companies are more inclined to use proven devices. With the rapid iteration of technology, in order to improve system functions and security, users usually upgrade legacy devices by replacing physical devices or software (firmware). However, considering factors such as high upgrade costs, complex system inheritance, and stability and real-time damage, this method of replacing devices is usually difficult in industrial control systems, and sometimes even impossible. In order to avoid the above problems when upgrading legacy industrial controllers, industrial control manufacturers usually maintain the status quo.

[0021] However, there are a lot of security issues with industrial control legacy controllers. The design goal of industrial controllers at the beginning was to replace hard-wired relays and timers, so manufacturers mainly focused on input and output modules that are closely connected to the physical world. In addition, industrial controllers usually work in a highly isolated environment and use physical isolation to cut off communication with external networks or even office intranets. Therefore, designers believe that industrial controllers have natural security without considering security factors. However, practice shows that even highly isolated industrial control systems are still vulnerable to cyber attacks. In 2023, ICS-CERT (Industrial Control System Cyber ​​Emergency Response Team) issued 376 security advisories involving 1,476 CVE vulnerabilities, of which 230 CVEs were rated as "serious" and 746 were rated as "high". At least 75% of the vulnerabilities directly affect industrial controllers. With the development of industrial Internet and intelligent manufacturing technology, more and more industrial control systems are directly or indirectly connected to external networks, and industrial controllers will face more and more external threats.

[0022] The security challenges facing industrial controllers are multifaceted, especially considering their widespread use in critical infrastructure and relatively long lifecycles, including: (1) System closure and lack of source code: Industrial controllers are usually built by manufacturers in a proprietary manner. The source code is not public, making security audits difficult. Users and security researchers cannot obtain the underlying code, making it difficult to conduct in-depth security reviews and vulnerability analysis, which results in potential vulnerabilities remaining undetected for a long time. In addition, users must rely on suppliers to fix vulnerabilities and release patches. If the manufacturer does not respond in a timely manner or support ends, the system will face serious security risks.

[0023] (2) Outdated software and hardware architecture: The software and hardware architecture of many industrial controllers is generally outdated, lacking modern design and update mechanisms, insufficient modular support and compatibility issues. Vulnerability repairs and function updates require downtime, affecting system continuity and stability. The system also faces security risks when interacting with external systems.

[0024] (3) Poor scalability of communication protocols: Industrial controllers from different industrial control manufacturers often use specific industrial control communication protocols (such as Modbus, Ethernet / IP, S7Comm, etc.). These protocols were originally designed for use in isolated environments and lack built-in encryption and authentication functions. Therefore, they are easily vulnerable to network attacks such as man-in-the-middle attacks and replay attacks. In addition, due to outdated protocol specifications, there is insufficient support for new requirements in modern network environments (such as cross-network interconnection and data protection), resulting in the system being unable to effectively integrate with other modern devices or systems.

[0025] (4) Limited computing and storage resources: Compared with general-purpose processors used in traditional IT systems, industrial controllers mainly use microcontrollers or microprocessors, which results in limited computing power of the controllers and the inability to complete additional complex functions within the controller's threshold time. In addition, the storage resources of industrial controllers are limited, and different versions of firmware or components cannot be backed up in memory space. Moreover, the update unit of existing industrial controllers is firmware or components, and it is impossible to provide a more fine-grained (such as function-level) update solution.

[0026] (5) Security risks caused by long maintenance cycles: The maintenance cycle of industrial controllers is usually long, and comprehensive system maintenance may be carried out only once every several months or even years. Due to long-term non-updates, known vulnerabilities cannot be patched in a timely manner, and attackers can exploit these vulnerabilities to launch delayed repair attacks and penetrate the system between maintenance cycles; in addition, in the industrial control process, any downtime may lead to production interruptions or safety accidents, so users usually postpone system updates, which increases the risk of the system being exposed to an unrepaired state for a long time.

[0027] In order to protect industrial controllers, related technologies have proposed a variety of methods, which can be mainly divided into three categories: intrusion detection, vulnerability assessment and patch management: (1) Intrusion detection is a method to detect whether an industrial control system is under attack by monitoring network traffic and system behavior to identify abnormal or malicious activities. Intrusion detection system (IDS) can be divided into signature-based detection (detection through known attack patterns) and behavior-based detection (detection by identifying abnormal behavior); (2) Vulnerability assessment methods involve identifying and evaluating vulnerabilities in the system and their potential harm. By conducting regular vulnerability scans, it is possible to determine which vulnerabilities may be exploited by attackers, so as to prioritize the repair of vulnerabilities that pose the greatest risk to the system. Vulnerability assessment tools and techniques can help identify system vulnerabilities and provide recommendations for reducing risks; (3) The purpose of patch management is to promptly apply patches released by manufacturers to fix known security vulnerabilities. For industrial controllers, patch management may involve updating device firmware or operating systems.

[0028] The challenge of patch management is to ensure the compatibility of patches and avoid interrupting the operation of critical control systems, so rigorous testing and planning are often required in industrial control systems. For example, for industrial control systems such as gas pipeline transmission systems, the shutdown of the controller may have serious consequences. Although the controller is turned off, the controlled physical process continues to run, which means that the system may temporarily lose monitoring and control of the process, which will bring the following risks: Loss of communication: When the controller is turned off, it will lose communication with other devices, which may cause coordination failure, which in turn triggers the entire system to cause product quality or output to not meet expectations. For example, in a gas pipeline system, the pressure or flow of the gas may not be properly regulated, resulting in quality problems. Safety hazards: During the shutdown of the controller, the operator's direct monitoring of the process may be limited, which increases the risk of accidents and even threatens the life safety of on-site operators in serious cases. For example, a gas pipeline leak that is not discovered and controlled in time may cause a fire or explosion. Due to the above risks, users usually postpone firmware upgrades to the next system maintenance period. However, unlike traditional IoT systems, the maintenance cycle of industrial control systems can be very long, even up to tens of months. During this period, known but unpatched vulnerabilities are easily exploited by attackers to implement delayed repair attacks. This attack exploits the vulnerability of control systems that have not been updated for a long time during maintenance. By attacking these unpatched weaknesses, attackers may cause production stagnation, property loss and even threaten personnel safety.

[0029] Existing vulnerability repair methods cannot solve the real-time repair problem in closed-source scenarios in industrial control systems and still have the following limitations: (1) Long downtime: Industrial controllers are often used in mission-critical scenarios, such as manufacturing, energy pipelines, and transportation systems, which require uninterrupted operation around the clock. Traditional vulnerability repair or system upgrade processes usually require shutting down the controller, which results in a stoppage of production or service. Downtime means the interruption of the production process, which directly leads to reduced production efficiency and increased economic losses for the enterprise. For certain industrial processes with high continuity requirements, such as chemical production and power transmission, downtime may even lead to more serious consequences such as loss of raw materials and equipment damage. In addition, downtime in critical infrastructure usually requires a lot of coordination and planning. For example, downtime in a pipeline system may involve hours of pressure release and re-pressurization, which requires the arrangement of on-site personnel and equipment. The entire process is complicated and costly.

[0030] (2) Difficulty in updating: Due to the architectural characteristics of industrial controllers, traditional repair methods often face the obstacle of difficult updating. Many industrial control systems use old software architectures and lack modular design and online update mechanisms. This means that even if security vulnerabilities are patched, the entire system often needs to be restarted or reinstalled, further increasing downtime. In addition, the hardware performance of traditional industrial controllers is limited and it is difficult to support modern security technologies such as real-time patch management. In particular, controllers with limited computing and storage resources cannot load and install patches at runtime, which makes online updates extremely challenging.

[0031] (3) Increased security risks: In traditional repair methods, because the system needs to remain online for a long time, vulnerabilities are not repaired during the entire maintenance cycle, resulting in obvious security vulnerabilities. This provides attackers with a window to attack the system through unrepaired vulnerabilities. Attackers can penetrate the system for a long time and even achieve full control of the controller before the final repair. Moreover, the discovery and repair of new vulnerabilities are usually very time-sensitive. If the system cannot be updated quickly, even known vulnerabilities may become an attack path for attackers. Therefore, the delay of traditional repair methods makes it difficult for the system to respond to emerging network security threats in a timely manner.

[0032] (4) Mismatch with modern industrial needs: Modern industrial control systems are increasingly dependent on network interconnection, which requires controllers to have higher security and flexibility to cope with complex network threat environments. Traditional repair methods lack rapid response capabilities and are difficult to adapt to the needs of zero downtime and rapid vulnerability patching in modern industrial environments. Therefore, alternatives must be found to reduce interruptions and risks during the repair process.

[0033] Hot Patching is a technology that can fix software vulnerabilities or perform updates without downtime during system operation. These vulnerabilities or problems cannot be postponed until regular system updates. This technology is particularly suitable for critical industrial systems that need to run continuously for a long time because it can minimize interruptions, production losses, and security risks caused by downtime. In industrial control systems, regular repairs require the release of a new version of firmware after emergency repairs of high-risk vulnerabilities, and wait for users to re-download and install the new version of firmware. While waiting for the installation of the new version of firmware (vulnerability window), attackers have the opportunity to launch delayed repair attacks. In order to solve the delayed repair attack, hot repair technology eliminates the steps of users re-downloading and installing, and directly pushes hot patches to the user end to complete emergency vulnerability repairs.

[0034] Memory forensics is an important area in computer forensics. It involves analyzing system memory (RAM) to obtain information related to system operating status, program activities, and potential attacks. Memory forensics is particularly important in detecting and responding to malicious attacks because many attacks and malware are not written to disk but only exist in memory. The steps of memory forensics usually include the following key links: (1) Memory Acquisition: Memory data is acquired by using specialized memory imaging tools, such as FTK Imager, DumpIt, Win32dd, Belkasoft Live RAM Capturer, etc., to export a snapshot of the system memory as an image file. To ensure that the acquired memory data is as unaffected as possible by changes in the system state, the acquisition operation should be performed quickly to reduce potential data contamination; (2) Memory image verification (integrity check): Calculate and record the hash value (such as MD5 or SHA256) of the memory image to ensure that the data has not been modified in subsequent analysis; (3) Memory Analysis: Use tools such as Volatility and Rekall to analyze memory images. These tools analyze the contents of memory to obtain information related to the operating system status, such as running processes, network connections, DLL injections, etc. The focus of memory analysis is to extract system status and identify suspicious behaviors or objects. For example, find hidden processes, services that are not referenced by the registry, or abnormal connections on network ports; (4) Malicious activity identification: Analyze running processes and services to find malicious code features, command and control signals in memory. Detect abnormal areas in memory, such as a large number of invalid code segments, or kernel code that should not normally appear in user-mode processes; (5) Reporting and Recording: Detailed records of the analysis process and any anomalies found, including screenshots and analysis tool output, to support subsequent investigation and forensics.

[0035] Therefore, in order to address the shortcomings of the above traditional hot fix methods, the combination of memory forensics and hot fix technology is particularly necessary: (1) Real-time and online: Memory forensics technology can obtain the memory data of the running system in real time, including running processes, module loading, and temporary data stored in memory. This real-time capture capability enables users to quickly detect abnormal behavior in the system, such as malicious code injection, unauthorized memory modification, etc. By combining memory forensics technology, online repairs can be implemented as soon as the problem is detected, reducing the exposure time of the vulnerability and thus improving security.

[0036] (2) Accurate vulnerability location and rapid repair: Through memory forensics technology, a detailed image of the system memory can be obtained, and tools (such as Volatility) can be used to parse various structural information in the memory, such as processes, threads, network connections, etc., so as to accurately locate the code segment with vulnerabilities or the injected malicious modules. This precise positioning capability provides a direct repair target for hot repair technology. For example, if there is a malicious module in the memory, the module can be directly uninstalled through the memory editing tool, or a specific code fragment can be replaced. This can avoid overall restart or large-scale updates, ensuring that the system remains stable during the repair process.

[0037] (3) Reduce downtime and maintain system stability: Traditional vulnerability repair methods usually require system downtime, which can cause production interruptions and economic losses for mission-critical systems such as industrial controllers. Through real-time detection of memory forensics combined with hot repair technology to repair vulnerabilities during runtime, downtime can be effectively avoided and system continuity can be maintained. In addition, memory forensics can not only provide detailed vulnerability information before repair, but also dynamically monitor the memory after repair to verify the repair effect. This closed-loop process helps ensure the stability and security of the repair, thereby reducing the negative impact on the system.

[0038] (4) Detection and response to advanced threats: Many advanced malware (such as malicious code without file traces) only exist in memory and are not written to the hard disk, which makes it impossible for traditional disk forensics to detect these threats. Memory forensics can effectively detect such malicious code and provide information to the hot repair system in a timely manner. Once malicious code is detected, hot repair can prevent the malicious behavior from further expanding by uninstalling, replacing the code in memory, or immediately isolating the infected process, thereby buying more recovery time and security protection for industrial control systems.

[0039] (5) Automation and efficient response: The detection results of memory forensics can be used as input for hot fixes, and automated repairs can be achieved through scripts or integrated tools. In this way, when an abnormality occurs in the system memory, the memory forensics and hot fix process can be automatically triggered, thereby minimizing the delay of manual intervention and achieving efficient response. In addition, the threat intelligence system can be integrated into the memory forensics process to identify and match known attack features in real time. The hot fix system can automatically perform targeted repairs based on this intelligence information, reducing the time the system is exposed to an unrepaired state.

[0040] In summary, the combination of memory forensics and hot fix technology can provide closed-loop security protection from detection to repair. Memory forensics provides real-time and accurate vulnerability location, while hot fix technology provides the ability to repair online and reduce downtime. The combination of the two can minimize the exposure time of system vulnerabilities and ensure the continuity and stability of the system when dealing with vulnerabilities and threats. This combination is particularly suitable for application scenarios such as industrial controllers that are sensitive to downtime and require high availability and strong security.

[0041] In view of this, the embodiment of the present invention proposes a method and system for hot repairing industrial controller vulnerabilities based on memory forensics, which solves the problems of low security, long downtime, and high maintenance cost of current industrial controllers, improves the security of industrial controllers and industrial control systems, reduces production interruptions and improves system availability, reduces maintenance costs and complexity, copes with security risks brought by long maintenance cycles, improves system stability and reliability, and supports modern industrial security needs. The following is the specific content of the embodiment of the present invention.

[0042] See also Figure 1 The embodiment of the present invention provides a method for hot-fixing industrial controller vulnerabilities based on memory forensics, comprising the following steps: S1. Calling a firmware extraction module, identifying the industrial controller architecture, identifying the processor architecture, analyzing the industrial control communication protocol, and extracting firmware memory data through the firmware extraction module; S2, calling a vulnerability location module, and performing firmware reverse engineering, vulnerability identification processing, vulnerability verification processing and vulnerability location processing on the firmware memory data extracted by the firmware extraction module through the vulnerability location module; S3, calling a vulnerability repair module, and performing patch generation, patch verification, and patch deployment on the industrial controller according to the vulnerability location result of the vulnerability location module when the industrial controller is running through the vulnerability repair module.

[0043] See also Figure 2In this embodiment, in step S1, the firmware extraction module is used to obtain firmware information and memory data from the industrial controller to support the subsequent vulnerability analysis and repair process. The firmware extraction module mainly includes four parts: industrial controller architecture identification, processor architecture identification, industrial control communication protocol analysis and firmware extraction: (11) Industrial controller architecture identification is responsible for determining the hardware and software architecture characteristics of industrial controllers in order to select appropriate tools and methods for firmware extraction and subsequent vulnerability analysis. Specific contents include: (111) Hardware structure analysis identifies the hardware components used by the controller, such as processor type, memory structure, peripheral devices (I / O modules), etc. This step is crucial for choosing the right extraction method because different controllers may use different hardware architectures.

[0044] (112) Operating system identification: Industrial controllers may run embedded operating systems, such as real-time operating systems (RTOS), VxWorks, embedded Linux, etc. Identifying the type and version of the operating system helps determine the specific means of memory forensics, such as which memory areas are important (such as kernel space, user space) and how to parse these areas.

[0045] (12) Processor architecture identification: The purpose of this part is to understand the processor type and characteristics used by the industrial controller in order to select appropriate firmware extraction and memory analysis tools. The specific contents include: (121) Processor type identification: Industrial controllers may use different types of processors, such as ARM, MIPS, x86, etc. Different processor architectures have different memory management methods, so identifying the processor type helps determine how to obtain memory images and extract firmware.

[0046] (122) Instruction set architecture analysis: The processor’s instruction set (e.g., RISC, CISC) determines the format of the code in memory and how the instructions are parsed. When performing memory forensics, it is necessary to be able to correctly parse the code in memory to find the address where a specific vulnerability is located or the area where malicious code is injected.

[0047] (123) Memory management method: The processor's memory management unit (MMU) affects the memory segmentation and paging mechanism. Identifying the processor architecture helps to better understand the memory organization structure for effective memory acquisition and analysis.

[0048] (13) Industrial control communication protocol analysis is responsible for parsing the communication protocol used by industrial controllers, which is very important for correctly understanding the data in the memory. Specific contents include: (131) Protocol type identification: Identify the communication protocol used by the controller (especially at the application layer), such as Modbus, DNP3, PROFINET, S7Comm, etc. These protocols are used for communication between industrial control systems and may retain communication status and information in memory. By analyzing the protocol, unauthorized connections or malicious injections can be discovered.

[0049] (132) Protocol data structure analysis: Understanding the data structure of these communication protocols can help analyze the communication-related parts in the memory, such as TCP / IP connection status, data frames, etc. In this way, when relevant communication data is found in the memory, legal and illegal communication behaviors can be identified.

[0050] (133) Vulnerability analysis of specific protocols: Some protocols are vulnerable to attacks due to their lack of security. Through protocol analysis, the specific location of the protocol implementation in the memory can be found, and further determination can be made as to whether there is a protocol stack vulnerability, which can be used as a basis for repair.

[0051] (14) Firmware extraction is the core of the entire firmware extraction module. Its function is to directly obtain firmware and memory data from industrial controllers for vulnerability location and repair. The specific contents include: (141) Memory image acquisition: Use memory extraction tools (such as FTK Imager, DumpIt, or J-Mem) to obtain a snapshot of the controller's current memory. This process must ensure data integrity and consistency so that subsequent analysis can provide accurate results.

[0052] (142) Firmware image acquisition: The firmware is usually stored in the ROM or flash memory of the controller. The firmware extraction part requires special tools or methods to read the data in these non-volatile memories. For example, the firmware content can be extracted through the JTAG interface or the debug port on the chip.

[0053] (143) Data verification and storage: To ensure that the extracted data has not been tampered with, the firmware extraction module will perform hash verification after the data is acquired. After the data verification is completed, the firmware and memory images will be securely stored for subsequent vulnerability analysis and repair.

[0054] Among them, if the industrial controller has a JTAG debugging interface, the debugging interface needs to be restored first. In order to identify the JTAG signal corresponding to the test point, the present invention adopts a JTAG interface reverse method based on the JTAGulator tool, which mainly includes four steps: test point identification, circuit measurement, signal reasoning and interface verification: in the test point identification stage, first find potential signal test points on the circuit board according to the arrangement of the traditional JTAG port; in the circuit measurement stage, use a multimeter to measure the voltage and resistance of each test point; in the signal reasoning stage, according to the electrical characteristics of the pull-up / pull-down resistor in the JTAG circuit, the signal of each test point is inferred; in the port verification stage, for uncertain JTAG signals, they are identified by manual testing.

[0055] If the industrial controller does not have a JTAG debugging interface, it is necessary to analyze the industrial control communication protocol so that the communication protocol used by the industrial controller can be identified to better understand its interaction mode with other devices. Considering that different industrial controllers use different industrial control protocols, the present invention uses the Wireshark packet capture tool to capture data packets between the industrial controller and the device where the lower computer programming software is located. In order to display certain proprietary or undisclosed industrial protocols in Wireshark, the embodiment of the present invention writes a corresponding Lua script parser. After analyzing the specific data structure of the communication protocol, such as the frame structure of the request and response, the function code, the address information, etc., the data part related to the protocol communication in the memory can be identified, and the communication status information stored in the memory is also included. In addition, by reverse analysis of the protocol implementation part, it can be found whether there are loopholes in the implementation of the communication process in the firmware.

[0056] Among them, through dynamic debugging and communication protocol analysis, the processor architecture information of the controller can be further identified, including the processor type (such as ARM, MIPS, x86) and its instruction set (such as RISC, CISC). Different processor architectures manage and access memory differently, so identifying the processor type helps to select the correct firmware extraction tools and methods. Taking the Rockwell Automation ControlLogix 1756-L61 controller as an example, it uses the NXP LPC2000 series processor, the processor ID is set to 0x1F0F0F0F, and the manufacturer ID is 0x787.

[0057] Among them, in order to obtain the current firmware and memory data of the industrial controller and minimize the impact of the firmware extraction process on the normal operation of the controller, the present invention uses a memory extraction tool (J-Mem) to obtain a memory snapshot of the industrial controller to form a memory image file; in addition, considering that the firmware is usually stored in a non-volatile memory, the present invention extracts the firmware image file through a hardware debugging interface (JTAG). After the firmware and memory data are extracted, a hash calculation is required to verify the integrity of the data to ensure that the data has not been tampered with during the extraction and transmission process.

[0058] In this embodiment, in step S2, the vulnerability location module is responsible for performing a detailed analysis of the memory data obtained from the firmware extraction module to find and locate potential security vulnerabilities or abnormal behaviors. This module mainly includes four parts: controller firmware reverse engineering, vulnerability identification, vulnerability verification, and vulnerability location: (21) Firmware reverse engineering: By reverse analyzing the extracted firmware, we can gain a deeper understanding of the internal logic and functions of the controller and discover potential security vulnerabilities. The specific contents include: (211) Firmware disassembly and decompilation: Reverse engineering begins by disassembling or decompiling the firmware binary code in order to analyze the logical structure and function of the code. Using disassembly tools (such as IDA Pro, Ghidra), the machine code in the firmware can be converted into assembly code, or it can be decompiled into high-level language code to better understand the execution logic of the program.

[0059] (212) Code flow and functional analysis: By performing code flow analysis on the disassembled code, we can understand the interactions and dependencies between modules in the firmware and determine the working mechanisms of key functional modules. Code flow analysis helps us understand the overall architecture of the firmware and helps identify some possible security risks, such as unsafe function calls and improper resource management.

[0060] (213) Protocol and interface analysis: Industrial controller firmware usually contains codes that implement various communication protocols. By analyzing the protocol and interface parts through reverse engineering, possible security issues can be discovered, such as interfaces that lack authentication or communication logic that can be attacked remotely.

[0061] (22) Vulnerability identification: This part is based on the results of firmware reverse engineering and uses various technical means to find potential vulnerabilities in the firmware. The specific contents include: (221) Static analysis: Perform static analysis on the firmware code to find potential vulnerabilities in the code, such as buffer overflow, null pointer reference, insecure memory management, etc. Static analysis tools such as Binwalk and Radare2 can be used to analyze the binary content of the firmware to find possible vulnerabilities.

[0062] (222) Dynamic analysis: Running the firmware in a simulated or sandbox environment, monitoring its behavior, and looking for anomalies and vulnerabilities during execution. For example, using an emulator (such as QEMU) to load the firmware and execute it, observing whether its response to different inputs is as expected, thereby identifying potential security issues.

[0063] (223) Known vulnerability matching: Match known vulnerabilities against vulnerability databases (such as CVE, CNVD, etc.) to find out whether there are publicly known vulnerabilities in the firmware. This method can quickly identify known vulnerabilities and help develop repair measures.

[0064] (23) Vulnerability Verification: The purpose of this part is to confirm whether the vulnerabilities found during the reverse engineering and vulnerability identification phases actually exist and to assess their harmfulness. The specific contents include: (231) Vulnerability Reproduction: Reproduce the identified vulnerability through experiments to verify the impact of the vulnerability in the actual operation of the controller. For example, if a buffer overflow problem is found, you can try to trigger the overflow by inputting specific data in the test environment to confirm the exploitability of the vulnerability.

[0065] (232) Attack vector assessment: Evaluate the attack vector of a vulnerability to determine how an attacker can exploit it. For example, some vulnerabilities may require physical access, while others can be exploited through remote network attacks. The vulnerability verification phase requires confirming the feasibility and complexity of exploiting the vulnerability.

[0066] (233) Impact analysis: Verify the potential impact of the vulnerability, including specific threats to the functions of the industrial controller, the production process, and the system security. For example, some vulnerabilities may cause the controller to lose control of the equipment, affecting the normal operation of production. Through detailed analysis, the severity and priority of the vulnerability are evaluated in order to determine the remediation strategy.

[0067] (24) Vulnerability location: The purpose of this section is to accurately determine the location of the vulnerability in the firmware code and system memory to provide support for subsequent hot fixes. Specific contents include: (241) Confirmation of vulnerability code location: By analyzing the firmware code, determine the specific code segment or function location where the vulnerability is located. This usually involves specific address tags to help determine the memory area that needs to be repaired. For example, by disassembling the assembly code obtained, find the instruction location that causes the buffer overflow.

[0068] (242) Memory address mapping: Use memory forensics to map the location of the vulnerability in the firmware code to a specific address in the system memory for hot fixes. During the operation of the controller, the memory analysis tool is used to determine the memory area where the vulnerability is located, ensuring that it can be repaired online without restarting the system.

[0069] (243) Data flow and control flow location: Analyze the data flow and control flow related to the vulnerability to determine the propagation path of the vulnerability and the scope of impact. This helps determine the scope of the repair measures to ensure that not only the root cause of the vulnerability is repaired, but also the affected related code or memory area is protected.

[0070] See also Figure 3 The vulnerability location process usually includes multiple steps, from the identification of the firmware memory layout to the final location and verification of the vulnerability. The following is a detailed expansion of the process: (a1) Identify the firmware memory layout Identifying the firmware memory layout is a basic step in vulnerability localization. The purpose is to understand the memory structure of the industrial controller in order to determine which memory areas store critical code and data. First, by analyzing the firmware's memory segments, different functional areas are identified, such as code segments, data segments, stack segments, etc. Then, the mapping between virtual addresses and physical addresses in the industrial controller is analyzed to ensure that the location and content of each memory area can be correctly interpreted when extracting the memory image.

[0071] (a2) Positioning control program The control program is the control logic written by the user to describe the automation task. Locating the control program involves finding the program code module in the firmware that is used to actually control the industrial equipment, which is the key to vulnerability analysis because the control program is directly related to the operation of the equipment. Therefore, in order to accurately locate the control program of the industrial controller, the present invention combines the reverse analysis of the network communication protocol data packet and the dynamic debugging method based on breakpoints, utilizes the structural characteristics of the data packet payload, and combines differential analysis to locate different functional modules, and clarifies which module is the core program for equipment control.

[0072] (a3) Analyze program call relationships Based on the location of the control program, the present invention further analyzes the interaction between various functions and modules in the control program through reverse engineering tools. On the one hand, a call graph of the program is generated to show the call relationship between various functions; on the other hand, by analyzing the control flow and data flow of the program, it is determined whether the vulnerability may be propagated through function calls and which data may be affected by the vulnerability.

[0073] (a4) Identify controller vulnerabilities In order to identify controller vulnerabilities, the present invention discovers potential security issues in the control program through static and dynamic analysis. This step is carried out in combination with a known vulnerability database and a customized security scanning tool, which can identify common security vulnerabilities by analyzing the code structure and simulating operation.

[0074] (a5) Query vulnerability documents In order to confirm that the identified vulnerability is a known vulnerability, it is necessary to query the relevant vulnerability documents. On the one hand, query the vulnerability number through the vulnerability database (such as CVE, CNVD, etc.), and understand the history of the vulnerability, repair suggestions and known attack methods; on the other hand, check whether the device manufacturer has issued a security bulletin or patch for the vulnerability, and confirm the repair method or severity of the vulnerability.

[0075] (a6) Obtain the vulnerability location For unknown vulnerabilities, obtain the vulnerability location and confirm the specific location of the vulnerability code for subsequent repair. Combined with reverse analysis and dynamic debugging, the code line or memory address where the vulnerability is located can be found. For example, for buffer overflow problems, confirm the specific function and code segment that caused the overflow. For example, when the four bytes "06 00 0000" starting at address 0x0008008D are modified to "FF FF FF FF", the buffer overflow vulnerability can be triggered, causing the industrial controller to crash and the firmware to fall off.

[0076] (a7) Verification vulnerability Confirm whether the identified vulnerabilities can be effectively exploited through experiments or simulated attacks. Verify whether the vulnerabilities actually exist by constructing malicious inputs. For example, if a buffer overflow problem is found, the overflow can be triggered by injecting specific inputs. Verify the scope and severity of the vulnerability and determine whether the vulnerability can cause system crashes, data leaks, or remote code execution.

[0077] (a8) Locate the vulnerable memory address The purpose of locating the memory address of the vulnerability is to map the code location of the vulnerability to a specific address in the memory for hot fixes. The vulnerability code location obtained by reverse analysis is matched with the memory address space of the controller to determine the specific location of the vulnerability in the memory. Finally, the access rights to the memory area where the vulnerability is located are checked to confirm whether the vulnerability can be directly modified or repaired through the hot fix tool.

[0078] It can be seen that the vulnerability location process includes the initial memory layout analysis, vulnerability location and verification, and finally mapping the vulnerability to a specific location in the memory to provide basic support for subsequent hot fixes. Each step relies on accurate reverse analysis, static and dynamic code analysis, and the support of vulnerability databases to ensure that security vulnerabilities in industrial controllers can be quickly discovered and fixed.

[0079] In this embodiment, in step S3, the role of the vulnerability repair module is to perform hot repair on the located vulnerability when the system is running, to ensure the normal operation of the industrial controller and the continuity of production. This module mainly includes three parts: patch generation, patch verification, and patch deployment.

[0080] (31) Patch Generation: This part is responsible for designing and creating patches to fix identified vulnerabilities. This is the first step in vulnerability repair, ensuring that the generated patches can effectively fix the problem and do not affect the normal operation of the control system. The specific contents include: (311) Vulnerability analysis and repair strategy formulation: Based on the output of the vulnerability location module, analyze the nature and scope of the vulnerability and formulate a corresponding repair strategy. The repair strategy may include modifying the code segment with security risks, removing unnecessary functional modules, or adding input verification logic and other security measures.

[0081] (312) Patch code writing: Patch code is written to replace or repair the vulnerable code according to the established repair strategy. During the patch generation process, the resource limitations of the industrial controller, such as computing power and memory size, need to be considered to ensure that the patch does not cause system performance degradation.

[0082] (313) Patch generation for hot fix support: For online fixes, the patch must be suitable for hot deployment, which means that the patch code needs to be able to be loaded and executed while the system is running without causing a system restart or severe performance loss. The patch generation tool needs to convert the patch into a format that is suitable for the current controller hardware and software environment.

[0083] (32) Patch Verification: The purpose of this part is to ensure that the generated patch can effectively fix the vulnerability and will not have a negative impact on the normal function of the system. The specific contents include: (321) Functional testing: After the patch is generated, it is necessary to perform functional testing on the patch to verify whether the patch has successfully fixed the vulnerability. Testing can be performed in a sandbox environment or a simulated environment to verify the effectiveness of the patch by executing a vulnerability exploit attack to ensure that the vulnerability can no longer be exploited.

[0084] (322) Compatibility testing: Verify that the patch is compatible with the existing system’s hardware, software, and communication protocols. Since industrial controllers usually run critical tasks, their repair patches must ensure that they do not conflict with all existing modules and will not cause system abnormalities. For example, the patch must ensure that it does not affect the controller’s real-time control of the device or its communication with other control nodes.

[0085] (323) Performance and stability testing: Patch verification also requires performance and stability testing to confirm whether the response speed and resource consumption of the repaired system remain within acceptable ranges. This is critical because industrial controllers usually require strict real-time performance, and any excessive performance loss may have a negative impact on production.

[0086] (33) Patch deployment: This part is responsible for applying verified patches to the industrial controller system to complete the repair of vulnerabilities. The specific contents include: (331) Online deployment (hot patch): Using hot patch technology, patches are deployed directly to running industrial controllers without downtime. This can be done by loading the patch code into memory through a specific tool and replacing the original vulnerable code segment. The hot patch method can ensure that the normal function of the system is not disturbed during the patch deployment process and production activities can continue.

[0087] (332) Phased deployment and rollback mechanism: When deploying patches, adopt a phased deployment strategy. First, deploy on the secondary or backup controller and observe the operation to ensure that the patch can run stably, and then gradually apply it to the primary controller. If problems occur during the deployment process, you can enable the rollback mechanism to restore the system to the state before the patch was applied to ensure that there is no impact on production.

[0088] (333) Post-deployment monitoring and maintenance: After the patch is deployed, the system will enter the monitoring state to observe the effect of the patch and the system operation status. Memory and system behavior are continuously monitored to ensure that the repair measures are indeed effective and no new security risks have emerged. If there are any abnormalities, the system can immediately take countermeasures, such as redeploying the patch or further analyzing the problem.

[0089] See also Figure 4 The vulnerability repair module is responsible for repairing the located vulnerabilities to ensure the security and stability of the system. The following is a detailed explanation of each step in the vulnerability repair process, from obtaining patch information to deploying patches: (b1) Obtain patch information Obtaining patch information is the first step in vulnerability repair, which aims to determine the specific content and patch solution required to repair the vulnerability. First, through the vulnerability information obtained by the vulnerability location module, confirm the nature, location, impact range and other details of the vulnerability. Make sure that the vulnerable code segment or memory area that needs to be repaired is clearly known. Then, determine the code or logic that needs to be modified to repair the vulnerability. This requirement may come from the technical documentation after vulnerability analysis, or the handling suggestions for similar vulnerabilities in the existing patch database. Finally, check the existing patch documents or security bulletins, such as the repair measures described by CVE, to ensure that the best practices and repair solutions related to the vulnerability are obtained. For example, the security bulletin about ControlLogix 1756-L61 Serial B PLC released by Rockwell Automation's official website in November 2015 includes the vulnerability name, vulnerability number (00167203), firmware version (20.018), device models involved in the vulnerability and protection measures.

[0090] (b2) Generate hot patch In order to provide hot patches for the hot fix process, the patch generation technology needs to identify the changes in the vulnerability code before and after the fix. At the source code level, patch generation faces challenges such as symbol resolution, function inlining, and compilation optimization. Therefore, the present invention uses binary comparison technology to generate target code level patches from source code differences. Figure 5 ,The hot patch generation process mainly includes disassembly, generation of control flow graph, construction of mapping relationship before and after repair, extraction of patch function and generation of hot patch. In the disassembly stage, IDA Pro is used to recover the symbolic representation (assembly code) of machine code instructions from the binary firmware. In the control flow graph generation stage, the cross-reference relationship between instructions is extracted from the assembly code to restore the control flow during program execution. In the pre- and post-repair mapping relationship construction stage, the mapping relationship between the vulnerability function and the repair function is restored from the control flow graph based on the symbol information and call relationship. In the patch function extraction stage, the patch function is extracted from the repaired firmware using the vulnerability function position and the mapping relationship before and after the vulnerability repair, and a hot patch is generated on this basis.

[0091] (b3) Transfer patch Transmitting patches refers to transmitting the generated hot patches from the development environment to the target control system for deployment. The present invention mainly adopts two methods in the process of transmitting patches: one is to transmit through the JTAG debugging interface; the other is to transmit through network data packets.

[0092] (b4) Verify the patch The purpose of verifying a patch is to ensure that the patch is effective, safe, and does not adversely affect existing system functions before it is deployed in an industrial controller. First, run the patch code in a test environment to verify whether it can successfully fix the vulnerability; then verify whether the patch is compatible with the controller's existing firmware, operating system, and other software components to ensure that the patch does not cause the system to crash or cause other functional abnormalities; finally, the patch may affect the performance of the system, so performance testing is required to ensure that the application of the patch does not reduce the real-time performance of the controller to an unacceptable level.

[0093] (b5) Build binary patches If a debug interface is present, a binary patch can be built, which converts the patch code into a binary format that can be deployed directly in the controller memory, such as for ARM, MIPS, or other architectures. Compilation must ensure that the instruction set and binary format (e.g., big endian, little endian) are consistent with the original firmware. In addition, in order to reduce the size of the patch (especially for devices with limited memory), the binary patch may need to be optimized or compressed to ensure that it can be loaded into the system without taking up too many resources.

[0094] (b6) Build patch data package If the debug interface does not exist, a patch data packet can be constructed, that is, the patch and related metadata (such as version number, verification information, etc.) are packaged into a complete data packet for deployment on the target system. The information contained in the patch data packet usually includes the patch version, the firmware version to which the patch applies, the specific module that the patch affects, dependencies, etc. These metadata are added to ensure that the patch can be properly verified and managed during deployment. In addition, a checksum or digital signature is added to the data packet to verify the integrity and authenticity of the patch during deployment to prevent unauthorized tampering. Finally, it is packaged using a proprietary protocol standard format suitable for industrial controllers so that it can be received by industrial controllers.

[0095] (b7) Deployment of patches Deploying patches is to apply verified patches to the memory or firmware of industrial controllers to fix vulnerabilities in the system. On the one hand, the patch code can be loaded into the running controller memory through the hot fix tool and replace the vulnerable code segment. The advantage of online deployment is that the system does not need to be shut down, thus maintaining the continuity of production. For example, you can use the write command of a memory debugging tool (such as J-Link) to write a binary patch to the memory space for deployment, and then use the mem command to check whether the patch is deployed successfully. After the patch is deployed, it is necessary to monitor the running status of the controller to confirm whether the application effect of the patch meets the expectations and whether it causes new problems. If an abnormality is found, it may be necessary to adjust the patch or further analyze the problem.

[0096] It can be seen that the vulnerability repair process is a delicate and continuous process. From obtaining patch information to generating patches, to verification and deployment, each step involves comprehensive consideration of security, stability and performance. Patches must be deployed quickly and safely without affecting the normal operation of industrial control systems to ensure the security and high availability of the system. The delicate operation of each step can effectively reduce the security threats caused by vulnerabilities while maintaining the stability of the system.

[0097] In summary, traditional industrial control system vulnerability repairs usually require downtime, which will cause production interruptions to mission-critical systems and increase operating costs. The hot repair technology based on memory forensics achieves zero-downtime repair by operating directly in the memory, that is, it can detect and repair vulnerabilities when the system is running normally, reducing production interruption time and related economic losses. The present invention improves system availability: the system can continue to operate without downtime, which is particularly suitable for industrial environments that require all-weather operation, such as energy, transportation and other fields; reduces downtime costs: traditional repairs often need to wait for maintenance windows, while hot repairs can respond immediately, significantly reducing system downtime and reducing the company's downtime losses. Memory forensics technology allows real-time detection of abnormal behavior and malicious code in memory during system operation, thereby realizing rapid identification of potential security threats. By using memory snapshots and memory analysis tools, the location of vulnerabilities in memory can be accurately located, and further repair operations can be performed. The present invention uses memory forensics technology to accurately detect vulnerabilities, can capture real-time data in the system memory, and promptly discover potential vulnerabilities, abnormal activities or unauthorized processes, thereby improving the accuracy of vulnerability detection; reduce false positives: by combining dynamic analysis of memory data, it can reduce false positives in security detection and ensure that only real problems are repaired. Many legacy industrial controllers and systems are based on old hardware and software architectures, and updating these systems is not only complex but also costly. The hot repair technology based on memory forensics can repair vulnerabilities without changing the existing architecture, and is suitable for resource-constrained embedded systems. The present invention does not require large-scale system upgrades: for old devices that cannot frequently update firmware or operating systems, hot repair technology can be repaired without replacing hardware or system structure, and supports embedded systems: this technology can work on embedded systems with limited resources, has strong adaptability, and ensures that repairs can be completed even when device performance is limited. Traditional repair methods usually require waiting for maintenance windows, and unrepaired vulnerabilities during this period may be exploited by attackers. The hot repair technology based on memory forensics can quickly detect and repair vulnerabilities, shorten the vulnerability exposure time, and reduce the risk of delayed repair attacks. The present invention can quickly respond to vulnerabilities and can repair them immediately after detection, thereby reducing the time the system is exposed to threats and reducing the risk of attacks. Especially for delayed repair attacks in industrial control systems, this technology can significantly reduce the chances of attackers exploiting vulnerabilities.

[0098] It should be noted that the method of the embodiment of the present invention can be performed by a single device, such as a computer or a server. The method of this embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present invention, and the multiple devices will interact with each other to complete the described method.

[0099] It should be noted that some embodiments of the present invention are described above. In some cases, the actions or steps recorded can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0100] See also Figure 6 Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, an embodiment of the present invention further provides an industrial controller vulnerability hot repair system based on memory forensics, including: The firmware extraction module 100 is used to identify the industrial controller architecture, identify the processor architecture, analyze the industrial control communication protocol, and extract the firmware memory data; A vulnerability location module 200, used to perform firmware reverse engineering, vulnerability identification processing, vulnerability verification processing and vulnerability location processing on the firmware memory data extracted by the firmware extraction module; The vulnerability repair module 300 is used to generate, verify and deploy patches for the industrial controller according to the vulnerability location results of the vulnerability location module when the industrial controller is running.

[0101] In this embodiment, the firmware extraction module 100 is also used to analyze the hardware structure of the industrial controller to obtain the memory structure and peripheral devices of the industrial controller; and to identify the operating system of the industrial controller; The firmware extraction module 100 is also used to identify the type of processor used by the industrial controller and analyze the instruction set architecture of the processor to obtain the memory management method of the processor; The firmware extraction module 100 is also used to identify the type of communication protocol used by the industrial controller, parse the protocol data structure, and analyze the protocol stack vulnerabilities; The firmware extraction module 100 is also used to obtain memory images, obtain firmware images, verify and store data on the industrial controller.

[0102] In this embodiment, the firmware reverse engineering performed by the vulnerability location module 200 on the firmware memory data extracted by the firmware extraction module includes firmware disassembly and decompilation, code flow and function analysis, and protocol and interface analysis; The vulnerability identification processing performed by the vulnerability location module 200 on the firmware memory data extracted by the firmware extraction module includes static analysis, dynamic analysis and known vulnerability matching.

[0103] In this embodiment, the vulnerability verification processing performed by the vulnerability location module 200 on the firmware memory data extracted by the firmware extraction module includes vulnerability reproduction, attack vector assessment and vulnerability impact analysis; The vulnerability location processing performed by the vulnerability location module 200 on the firmware memory data extracted by the firmware extraction module includes vulnerability code location confirmation, memory address mapping, data flow and control flow location.

[0104] In this embodiment, when the industrial controller is running, the vulnerability repair module 300 generates patches for the industrial controller according to the vulnerability location results of the vulnerability location module 200, including vulnerability analysis and repair strategy formulation, patch code writing, and patch generation supported by hot repair; The patch verification performed by the vulnerability repair module 300 on the industrial controller includes patch function testing, patch compatibility testing, and patch performance and stability testing; The patch deployment performed by the vulnerability repair module 300 on the industrial controller includes online deployment, phased deployment, and post-deployment monitoring and maintenance.

[0105] The system of the above embodiment is used to implement a corresponding industrial controller vulnerability hot repair method based on memory forensics in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0106] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the industrial controller vulnerability hot repair method based on memory forensics described in any of the above embodiments is implemented.

[0107] Figure 7 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 410, a memory 420, an input / output interface 430, a communication interface 440, and a bus 450. The processor 410, the memory 420, the input / output interface 430, and the communication interface 440 are connected to each other through the bus 450 in the device.

[0108] The processor 410 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0109] The memory 420 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 420 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 420 and are called and executed by the processor 410.

[0110] The input / output interface 430 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0111] The communication interface 440 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0112] The bus 450 comprises a pathway that transmits information between the various components of the device (eg, the processor 410 , the memory 420 , the input / output interface 430 , and the communication interface 440 ).

[0113] It should be noted that, although the above device only shows the processor 410, the memory 420, the input / output interface 430, the communication interface 440 and the bus 450, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0114] The electronic device of the above embodiment is used to implement a corresponding industrial controller vulnerability hot repair method based on memory forensics in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0115] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present invention also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute a memory forensics-based industrial controller vulnerability hot repair method as described in any of the above embodiments.

[0116] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0117] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute an industrial controller vulnerability hot repair method based on memory forensics as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0118] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present invention is limited to these examples. Under the concept of the present invention, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of the embodiments of the present invention as described above, which are not provided in detail for the sake of simplicity.

[0119] In addition, to simplify the description and discussion, and in order not to obscure the embodiments of the present invention, well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, the system may be shown in the form of a block diagram so as to avoid obscuring the embodiments of the present invention, and this also takes into account the fact that the details of the implementation of these block diagram systems are highly dependent on the platform on which the embodiments of the present invention are to be implemented (i.e., these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present invention, it is apparent to those skilled in the art that embodiments of the present invention may be implemented without these specific details or with variations in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0120] Although the invention has been described in conjunction with specific embodiments of the invention, many alternatives, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the discussed embodiments.

[0121] The embodiments of the present invention are intended to cover all such substitutions, modifications and variations that fall within the scope of the protection claimed. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present invention should be included in the protection scope of the present invention.

Claims

1. Industrial controller vulnerability hot fix method based on memory forensics, including: include: Calling a firmware extraction module, identifying the industrial controller architecture, identifying the processor architecture, analyzing the industrial control communication protocol, and extracting firmware memory data through the firmware extraction module; Calling a vulnerability location module, and performing firmware reverse engineering, vulnerability identification processing, vulnerability verification processing, and vulnerability location processing on the firmware memory data extracted by the firmware extraction module through the vulnerability location module; A vulnerability repair module is called, and when the industrial controller is running, the vulnerability repair module generates, verifies and deploys patches for the industrial controller according to the vulnerability locating result of the vulnerability locating module.

2. The method for hot-fixing industrial controller vulnerabilities based on memory forensics according to claim 1, wherein: In the process of identifying the industrial controller architecture through the firmware extraction module, the hardware structure of the industrial controller is analyzed to obtain the memory structure and peripheral devices of the industrial controller; and the operating system of the industrial controller is identified; In the process of identifying the processor architecture through the firmware extraction module, the processor type used by the industrial controller is identified, and the instruction set architecture of the processor is analyzed to obtain the memory management method of the processor; In the process of analyzing the industrial control communication protocol through the firmware extraction module, the type of communication protocol used by the industrial controller is identified, the protocol data structure is parsed, and the protocol stack vulnerability is analyzed; In the process of extracting the firmware memory data through the firmware extraction module, the memory image acquisition, firmware image acquisition, data verification and storage are performed on the industrial controller.

3. The method for hot-fixing industrial controller vulnerabilities based on memory forensics according to claim 1, wherein: The firmware reverse engineering performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes firmware disassembly and decompilation, code flow and function analysis, and protocol and interface analysis; The vulnerability identification processing performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes static analysis, dynamic analysis and known vulnerability matching.

4. The method for hot-fixing industrial controller vulnerabilities based on memory forensics according to claim 3, wherein: The vulnerability verification processing performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes vulnerability reproduction, attack vector assessment and vulnerability impact analysis; The vulnerability location processing performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes vulnerability code location confirmation, memory address mapping, data flow and control flow location.

5. The method for hot-fixing industrial controller vulnerabilities based on memory forensics according to claim 4, wherein: When the industrial controller is running, the vulnerability repair module generates a patch for the industrial controller according to the vulnerability location result of the vulnerability location module, including vulnerability analysis and repair strategy formulation, patch code writing, and patch generation supported by hot repair; Patch verification for industrial controllers includes patch function testing, patch compatibility testing, patch performance and stability testing; Patch deployment for industrial controllers includes online deployment, phased deployment, and post-deployment monitoring and maintenance.

6. Industrial controller vulnerability hot fix system based on memory forensics, including: include: Firmware extraction module, used to identify industrial controller architecture, processor architecture, analyze industrial control communication protocols, and extract firmware memory data; A vulnerability location module, used to perform firmware reverse engineering, vulnerability identification processing, vulnerability verification processing and vulnerability location processing on the firmware memory data extracted by the firmware extraction module; The vulnerability repair module is used to generate, verify and deploy patches for the industrial controller according to the vulnerability location results of the vulnerability location module when the industrial controller is running.

7. The industrial controller vulnerability hot repair system based on memory forensics according to claim 6, wherein: The firmware extraction module is also used to analyze the hardware structure of the industrial controller to obtain the memory structure and peripheral devices of the industrial controller; and to identify the operating system of the industrial controller; The firmware extraction module is also used to identify the type of processor used by the industrial controller and analyze the instruction set architecture of the processor to obtain the memory management method of the processor; The firmware extraction module is also used to identify the type of communication protocol used by the industrial controller, parse the protocol data structure, and analyze the protocol stack vulnerabilities; The firmware extraction module is also used to obtain memory images, obtain firmware images, verify and store data on the industrial controller.

8. The industrial controller vulnerability hot repair system based on memory forensics according to claim 6, wherein: The firmware reverse engineering performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes firmware disassembly and decompilation, code flow and function analysis, and protocol and interface analysis; The vulnerability identification processing performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes static analysis, dynamic analysis and known vulnerability matching.

9. The industrial controller vulnerability hot repair system based on memory forensics according to claim 8, wherein: The vulnerability verification processing performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes vulnerability reproduction, attack vector assessment and vulnerability impact analysis; The vulnerability location processing performed by the vulnerability location module on the firmware memory data extracted by the firmware extraction module includes vulnerability code location confirmation, memory address mapping, data flow and control flow location.

10. The industrial controller vulnerability hot repair system based on memory forensics according to claim 9, wherein: When the industrial controller is running, the vulnerability repair module generates patches for the industrial controller according to the vulnerability location results of the vulnerability location module, including vulnerability analysis and repair strategy formulation, patch code writing, and patch generation supported by hot repair; The patch verification of the industrial controller by the vulnerability repair module includes patch function test, patch compatibility test, patch performance and stability test; The patch deployment performed by the vulnerability repair module on the industrial controller includes online deployment, phased deployment, and post-deployment monitoring and maintenance.

Images