Embedded device static taint analysis optimization method and system based on taint source identification

Abstract

The invention relates to the technical field of embedded system security, in particular to an embedded device static taint analysis optimization method and system based on taint source identification, and the method comprises the steps: preprocessing firmware of an embedded device, and extracting binary executable files at the front end and the rear end of the firmware; matching the taint keywords in the front-end binary executable file and the rear-end binary executable file by utilizing semantic similarity matching strategy identification to obtain similar taint keyword sets in the front-end binary executable file and the rear-end binary executable file; all functions used for analyzing user input in the binary executable file are extracted based on the stain keywords, and stain introduction functions are recognized according to function behavior characteristics; and generating a path from the taint keywords to the taint convergent point based on the taint keyword set and the taint introduction function, and filtering the taint introduction function on the path to obtain an effective taint source in the binary executable file. According to the method, more hidden stain keywords missed by SaTC can be recognized, and meanwhile, the situation that too much time is wasted on invalid stain sources is avoided.

Description

Technical Field

[0001] The present invention relates to the field of embedded system security technology, and in particular to an embedded device static taint analysis optimization method and system based on taint source identification. Background Art

[0002] The Internet of Things (IoT) is becoming an increasingly important part of our lives, with more and more devices being connected to the Internet. However, this explosive growth has also led to a rapid increase in the number of vulnerabilities in embedded devices. Compared with other IoT devices, IoT devices with Web services are more vulnerable to attacks because attackers can use Web pages as a springboard to create opportunities for intrusion. Therefore, it is very important to detect vulnerabilities in IoT devices with Web services. Existing vulnerability detection methods for such embedded devices are basically divided into two categories: dynamic analysis and static analysis. However, the detection efficiency of most dynamic analysis techniques is limited by the low code coverage, and dynamic analysis methods often involve program status monitoring methods such as instrumentation, which have a large execution overhead. Compared with dynamic analysis, static analysis is more suitable for vulnerability detection of such IoT devices. Static taint analysis is a common method among various static analysis methods. The static taint analysis technology model includes taint sources, taint sinks, and harmless processing. Among them, the taint source means introducing tainted data into the system; the taint sink means that the system outputs tainted data to the sensitive data area in the system, causing the sensitive data area to be illegally rewritten or the privacy data to be leaked; harmless processing means that through operations such as data encryption or reassignment, data propagation no longer poses a threat to the integrity and confidentiality of the system.

[0003] The existing taint analysis focuses mainly on taint propagation analysis, lacking in-depth thinking and inspection of taint sources. Insufficient identification of taint sources will also lead to a large number of missed reports in vulnerability detection methods. Therefore, sufficient identification of taint sources can enhance the effect of taint analysis and has great research significance. In addition, in the existing taint source identification, there is a method of extracting keywords using static analysis, which often leads to the omission of some keywords due to imperfect parsing rule settings. In addition, some external data may be processed by library functions (such as cJSON_AddItemToObject) before being used, and the keywords of the data transmission are changed. Therefore, relying solely on strings that exist in both the front-end and the back-end as taint keywords will inevitably lead to a large number of missed reports. There are also methods based on pattern matching to identify functions that reference keywords shared by the front-end and back-end as taint introduction functions, that is, the starting point of taint analysis. However, this method does not consider the behavioral characteristics and semantic information of the taint reference function, resulting in some irrelevant functions, such as the response generation function websXMLBodyResponse, being mistakenly identified as taint introduction functions, because such functions also use keywords as parameters to respond to requests from the front-end. Therefore, there is an urgent need for a method that can accurately identify the source of taint to enhance the effect of taint analysis and thereby improve the security of embedded device systems. Summary of the invention

[0004] To this end, the present invention provides an embedded device static taint analysis optimization method and system based on taint source identification to solve the problems of underreporting and unsatisfactory accuracy in existing taint source analysis.

[0005] According to the design scheme provided by the present invention, on the one hand, a static taint analysis optimization method for embedded devices based on taint source identification is provided, comprising:

[0006] Preprocess embedded device firmware and extract firmware front-end and back-end binary executable files;

[0007] Using semantic similarity matching strategy to identify and match tainted keywords in front-end and back-end binary executable files, and obtaining a set of similar tainted keywords in the front-end and back-end binary executable files;

[0008] Extract all functions used to parse user input in binary executable files based on tainted keywords, and identify tainted introduction functions based on function behavior characteristics;

[0009] Based on the taint keyword set and the taint introduction function, a path from the taint keyword to the taint convergence point is generated, and the effective taint source in the binary executable file is obtained by filtering the taint keyword on the path, so as to identify potential vulnerabilities of the firmware using the effective taint source.

[0010] The static taint analysis optimization method for embedded devices based on taint source identification of the present invention further preprocesses the embedded device firmware, including:

[0011] Use the unpacking tool to unpack the firmware and obtain the firmware file system;

[0012] Based on the firmware file system attributes, the preset filtering rules are used to exclude redundant data and filter out all front-end and back-end binary executable programs in the firmware file system, wherein the redundant data includes script files, configuration files and dynamic link libraries;

[0013] Disassemble the front-end and back-end binary executable programs to obtain the boundary binary executable file.

[0014] As an embedded device static taint analysis optimization method based on taint source identification of the present invention, further, a semantic similarity matching strategy is used to identify and match taint keywords in front-end and back-end binary executable files, including:

[0015] Eliminate the strings containing special characters in the binary executable file, and use the string screening rules to screen the remaining strings in the binary executable file to obtain the filtered string data in the front-end and back-end binary executable files. The string screening rules are pre-set according to the naming rules of the tainted keywords.

[0016] The filtered string data are respectively input into the natural language pre-training model, and the string embedding vector is obtained by using the natural language pre-training model, wherein the natural language pre-training model adopts the pre-trained lightweight paraphrase-MiniLM-L6-v2 model;

[0017] The cosine similarity is used to measure the distance between the front-end and back-end string embedding vectors. The strings with similarity distance exceeding the threshold are regarded as tainted keywords and added to the similar tainted keyword set.

[0018] As the embedded device static taint analysis optimization method based on taint source identification of the present invention, further, the string screening rule includes:

[0019] Calculate the maximum common substring length between two strings in the front-end and back-end binary executable files and the length of the shorter string between the two strings;

[0020] When the ratio of the maximum common substring length to the shorter string length is greater than a preset threshold, the two strings are added to the filtered string data.

[0021] As the embedded device static taint analysis optimization method based on taint source identification of the present invention, further, the taint introduction function is identified according to the function behavior characteristics, including:

[0022] Extract the function control flow graph, generate a set of successor basic blocks for each basic block, and construct a directed graph based on the set of successor basic blocks, so as to use the directed graph to convert the execution flow of the function into a directed graph structure, wherein each basic block in the directed graph is a node, and the successor basic block of each node is a directed edge starting from the current node;

[0023] Identify loops in the function execution flow by detecting whether there are rings in the directed graph, filter out paths with more than a preset number of basic blocks, and obtain a set of basic block execution paths containing loops;

[0024] The instructions in the basic block are converted into VEX IR instructions, the operand variables in the instructions are parsed and extracted according to the VEX IR instruction type, and the data flow graph is constructed using the operand variable relationship to identify the taint introduction function using the data flow graph.

[0025] As an embedded device static taint analysis optimization method based on taint source identification of the present invention, further, a taint introduction function is identified by using a data flow graph, including:

[0026] Setting the taint state characteristics of the data flow graph loop path, the taint state characteristics of the data flow graph loop path include: there is a CMP point and the CMP point operand comes from the function parameter, the loop path includes a LOAD point and a STORE point, and the LOAD point on the path appears before the STORE point, there is a ring structure between the LOAD point and the STORE point, and there are arithmetic operations on the ring structure at the same time;

[0027] A function that includes at least one loop path and the loop path simultaneously satisfies the taint state characteristics of the data flow graph loop path is taken as a candidate taint introduction function, and the final taint introduction function is identified from the candidate taint introduction functions based on the number of function calls.

[0028] As an embedded device static taint analysis optimization method based on taint source identification of the present invention, further, by filtering taint keywords on the path to obtain effective taint sources in the binary executable file, it includes:

[0029] Get the function in the context of the tainted keyword call and determine whether the call path contains the tainted introduction function;

[0030] If at least one function on the call path is a taint introduction function, the function that references the taint keyword is determined to be a valid taint source.

[0031] On the other hand, the present invention also provides an embedded device static taint analysis optimization system based on taint source identification, comprising: a firmware preprocessing module, a keyword matching module, a taint function identification module and a taint source filtering module, wherein:

[0032] The firmware preprocessing module is used to preprocess the embedded device firmware and extract the firmware front-end and back-end binary executable files;

[0033] A keyword matching module is used to identify and match tainted keywords in the front-end and back-end binary executable files using a semantic similarity matching strategy, and obtain a set of similar tainted keywords in the front-end and back-end binary executable files;

[0034] The tainted function identification module is used to extract all functions used to parse user input in the binary executable file based on the tainted keywords, and identify the tainted introduction function based on the function behavior characteristics;

[0035] The taint source filtering module is used to generate a path from the taint keyword to the taint convergence point based on the taint keyword set and the taint introduction function, and obtain the effective taint source in the binary executable file by filtering the taint keyword on the path, so as to identify potential firmware vulnerabilities using the effective taint source.

[0036] Beneficial effects of the present invention:

[0037] 1. The present invention utilizes the keywords with the same form in the front-end and back-end files, and calculates the semantic similarity between these keywords that may be used as user input entries and the remaining keywords in the back-end files to obtain more possible implicit keywords; it searches for functions for parsing user input to verify the validity of the keywords, and infers all possible taint introduction functions by observing the behavior characteristics of the functions; based on the identified keyword set and taint introduction function, it uses the path from the keyword to the taint convergence point generated by Ghidra to check the validity of the taint source and improve the accuracy of taint source identification.

[0038] 2. From the perspective of solving the problem of missed reports in vulnerability detection, this solution can identify more implicit taint keywords missed by SaTC by deeply checking the taint sources and using the strategy of semantic similarity matching. Secondly, from the perspective of solving the problem of false alarms in vulnerability detection, by identifying the taint introduction function, the validity of the taint keywords is filtered on the path from the taint keywords to the taint convergence point, avoiding wasting too much time on invalid taint sources, significantly enhancing the vulnerability detection effect of the static taint analysis method for embedded systems, and effectively improving the security of embedded device systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 The following is a schematic diagram of an optimization process of static taint analysis of an embedded device based on taint source identification in an embodiment;

[0040] Figure 2 The schematic diagram is a schematic diagram of the principle framework of the static taint analysis optimization algorithm for embedded devices based on taint source identification in the embodiment. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0042] Before introducing the embodiments of this case, the relevant technical terms are first explained as follows:

[0043] Taint sources are the starting point of taint analysis, usually external inputs from embedded devices, which are considered untrusted or unverified. The main purpose of taint analysis is to trace the propagation paths of these untrusted data in the program and analyze how these data flows affect the security and operational correctness of the system.

[0044] Static taint analysis is a program analysis technique that is mainly used to track and manage "tainted" data in data flows. The core idea is to identify potential security vulnerabilities and unsafe operations in programs by marking untrusted or unsafe data (i.e. "taints"). By analyzing the code without executing the program, the data flow and control flow are checked. Static taint analysis can quickly identify potential taint propagation and give vulnerability alerts.

[0045] Embedded devices are electronic devices that embed computer hardware and software into other devices or systems to achieve specific functions or tasks. Unlike general-purpose computers, embedded devices are usually designed for a specific application and have relatively simple functions, but they are highly efficient and reliable in their fields.

[0046] Existing developers follow a certain pattern when naming strings during embedded system development, so that the strings responsible for the same module functions in the embedded device are semantically related. This means that if a string is highly similar to a known tainted keyword in semantics, then this string is also likely to be a potential tainted keyword. Therefore, by looking for strings in the backend file that have a high semantic similarity to known tainted keywords, more implicit tainted keywords can be effectively discovered. To this end, an embodiment of the present invention provides an embedded device static taint analysis optimization method based on taint source identification, comprising:

[0047] S101, preprocessing the embedded device firmware and extracting the firmware front-end and back-end binary executable files.

[0048] Specifically, the embedded device firmware is preprocessed and can be designed to include:

[0049] Use the unpacking tool to unpack the firmware and obtain the firmware file system;

[0050] Based on the firmware file system attributes, the preset filtering rules are used to exclude redundant data and filter out all front-end and back-end binary executable programs in the firmware file system, wherein the redundant data includes script files, configuration files and dynamic link libraries;

[0051] Disassemble the front-end and back-end binary executable programs to obtain the boundary binary executable file.

[0052] Before firmware analysis, the existing Binwalk tool can be used to pre-process the firmware to obtain the file system and boundary binary files. Subsequently, these binary executable files can be disassembled to obtain the target binary executable file.

[0053] S102: Using a semantic similarity matching strategy to identify and match tainted keywords in the front-end and back-end binary executable files, and obtaining a set of similar tainted keywords in the front-end and back-end binary executable files.

[0054] Specifically, the semantic similarity matching strategy is used to identify and match the tainted keywords in the front-end and back-end binary executable files, which can be designed to include:

[0055] Eliminate the strings containing special characters in the binary executable file, and use the string screening rules to screen the remaining strings in the binary executable file to obtain the filtered string data in the front-end and back-end binary executable files. The string screening rules are pre-set according to the naming rules of the tainted keywords.

[0056] The filtered string data are respectively input into the natural language pre-training model, and the string embedding vector is obtained by using the natural language pre-training model, wherein the natural language pre-training model adopts the pre-trained lightweight paraphrase-MiniLM-L6-v2 model;

[0057] The cosine similarity is used to measure the distance between the front-end and back-end string embedding vectors. The strings with similarity distance exceeding the threshold are regarded as tainted keywords and added to the similar tainted keyword set.

[0058] Among them, the string filtering rules can be designed to include: calculating the maximum common substring length between two strings in the front-end and back-end binary executable files and the length of the shorter string of the two strings; when the ratio of the maximum common substring length to the shorter string length is greater than a preset threshold, adding the two strings to the filtered string data.

[0059] In the process of obtaining the string embedding vector, the natural language pre-training model based on the transformer architecture, Sentence-Transformer, can be used to calculate the string embedding. The model is designed for sentence or paragraph level representation learning and is trained on paired or multiple sentence data sets. It can effectively capture the deep semantic information of the text by learning the semantic similarity between sentences. In this case embodiment, the lightweight and efficient paraphrase-MiniLM-L6-v2 model is selected and widely trained on a variety of data sets to improve the generalization ability of the model. In view of the large number of strings in the backend file and their diverse forms, in order to improve the efficiency of semantic calculation, some strings containing special characters (such as =) are first excluded, because the key strings responsible for data transmission are usually in very standardized formats and have the same naming rules. After that, the remaining strings are further screened. The screening method is shown in formula (1): first calculate the maximum common substring length (LCS) between the two strings, then find the length of the shorter string (min), and calculate the ratio (f) of the common substring length to the shorter string length. Only when the f value exceeds the set threshold α, further similarity calculation will be performed.

[0060] The similarity calculation is shown in formulas (2) and (3). First, the embedding vector of the string is obtained through the model, and then the distance between the two embedding vectors is measured by cosine similarity, and the strings whose similarity exceeds the set threshold are added to the similar string set.

[0061]

[0062] S103: extract all functions used for parsing user input in the binary executable file based on the tainted keywords, and identify the tainted introduction function according to the function behavior characteristics.

[0063] Specifically, the taint introduction function is identified based on the function behavior characteristics, and can be designed to include:

[0064] Extract the function control flow graph, generate a set of successor basic blocks for each basic block, and construct a directed graph based on the set of successor basic blocks, so as to use the directed graph to convert the execution flow of the function into a directed graph structure, wherein each basic block in the directed graph is a node, and the successor basic block of each node is a directed edge starting from the current node;

[0065] Identify loops in the function execution flow by detecting whether there are rings in the directed graph, filter out paths with more than a preset number of basic blocks, and obtain a set of basic block execution paths containing loops;

[0066] The instructions in the basic block are converted into VEX IR instructions, the operand variables in the instructions are parsed and extracted according to the VEX IR instruction type, and the data flow graph is constructed using the operand variable relationship to identify the taint introduction function using the data flow graph.

[0067] Among them, using the data flow graph to identify the taint introduction function may include:

[0068] Setting the taint state characteristics of the data flow graph loop path, the taint state characteristics of the data flow graph loop path include: there is a CMP point and the CMP point operand comes from the function parameter, the loop path includes a LOAD point and a STORE point, and the LOAD point on the path appears before the STORE point, there is a ring structure between the LOAD point and the STORE point, and there are arithmetic operations on the ring structure at the same time;

[0069] A function that includes at least one loop path and the loop path simultaneously satisfies the taint state characteristics of the data flow graph loop path is taken as a candidate taint introduction function, and the final taint introduction function is identified from the candidate taint introduction functions based on the number of function calls.

[0070] like Figure 2 In the algorithm framework shown, a detection algorithm is designed specifically according to the characteristics of the taint introduction function. The algorithm mainly consists of four parts: function control flow graph (CFG) extraction, generation of subsequent basic block path, detection of basic block path loop, data flow generation and feature analysis. The taint introduction function is usually responsible for receiving external data and saving the result in the form of return value pointer or global variable through a series of processing. Its behavior is similar to that of the memory operation function. Therefore, it is possible to determine whether a function is a taint introduction function by analyzing the behavioral characteristics of the function. Algorithm 1 shows the relevant algorithm pseudo code.

[0071]

[0072]

[0073] First, all functions in the boundary binary file are used as algorithm input. Then, the CFG of the function is extracted with the help of IDA pro to help determine the relationship between basic blocks. In order to obtain all execution flows in the function, all the successor basic block sets are further generated for each basic block (line 3). The import and transfer of external input usually rely on loop structures. Functions copy qualified characters through loops and compare constraints in loops until certain conditions are met. Therefore, loop detection is the key to identifying tainted introduction functions. By constructing a directed graph, each basic block is used as a node, and the successor basic block of each node is used as a directed edge starting from the node. In this way, the execution flow of the function is converted into a directed graph structure. Then, by detecting whether there is a loop in the directed graph, the loop in the function execution flow is identified (line 4-8). In order to make the algorithm focus on detecting the key code segments that implement external data import and transfer, a threshold is set for the number of basic blocks on the path, and those paths with too many basic blocks are filtered out, because these paths usually do not contain the target code segment. After obtaining the path set containing loops, data flow generation and function feature analysis are further performed on these paths to confirm the tainted introduction function. Data flow tracing is based on VEX IR, a popular intermediate representation (IR) widely used in many program analysis tools, such as angr. By converting the instructions in the basic block into VEX IR instructions (line 9), SFtaint is able to handle instruction sets of different architectures. Data flow tracing is achieved by identifying the relationship between variables. For VEX IR instruction types, the stmt attribute of VEX IR is used to distinguish different types of statements, and pattern matching methods are applied to different instruction opcodes to parse and extract operand variables in instructions. These variables are divided into a pair of source operands and destination operands (dst, src). For example, the VEX IR statement "t8 = GET: I32 (r1), t20 = LDbe: I8 (t17)" will be divided into (t8, r1) and (t20, t17) to facilitate subsequent data flow tracing (line 11). In the process of data flow construction, it is very important to distinguish between variables and constants in instructions, because if the memory location or offset accessed is the same each time the variable is iteratively accessed, it may mean that the constant is actually accessed, and no tracking is performed in this case. After traversing all basic blocks and generating variable tuples in turn, the set of variables involved in memory comparison (the corresponding instruction points are recorded as CMP points), the set of memory access variables (the corresponding load instruction points are recorded as LOAD points, and the storage instruction points are recorded as STORE points), and the set of variables involved in arithmetic operations are recorded. Then, these variable relationships are used to construct the data flow graph DFG, and the following features of DFG are proposed:

[0074] 1. There is a CMP point (line 13)

[0075] 2. The operands of the CMP point come from the function parameters (line 14)

[0076] 3. Includes LOAD point and STORE point (line 15-16)

[0077] 4. The LOAD point on the path appears before the STORE point (line 17)

[0078] 5. There is a ring structure between the LOAD point and the STORE point, and arithmetic operations also exist on the ring structure.

[0079] In the experiment, it was found that many functions contain complex loop paths. Therefore, it can be considered that any function containing at least one loop path that satisfies the above conditions can be regarded as a taint introduction function. During the analysis process, it was found that taint introduction functions often have multiple recognition results. In order to filter out false positives, it can be found that taint introduction functions usually show the characteristics of high-frequency calls. Based on this finding, in the implementation of this case, the function with the most calls among all recognition results was selected as the taint introduction function.

[0080] S104: Generate a path from the taint keyword to the taint convergence point based on the taint keyword set and the taint introduction function, and obtain valid taint sources in the binary executable file by filtering the taint keywords on the path, so as to identify potential vulnerabilities of the firmware using the valid taint sources.

[0081] By filtering the taint keywords on the path, we can obtain the valid taint sources in the binary executable file, which can be designed to include:

[0082] Get the function in the context of the tainted keyword call and determine whether the call path contains the tainted introduction function;

[0083] If at least one function on the call path is a taint introduction function, the function that references the taint keyword is determined to be a valid taint source.

[0084] Since only external data can be controlled by the attacker, there must be a function that receives and parses this data on the path from the valid tainted keyword to the sink point, that is, the tainted introduction function. Therefore, in order to exclude those keywords that are not derived from network input or do not involve front-end and back-end data interaction from the identified tainted keyword set, Ghidra is first used to perform static analysis on the binary file to obtain the call path from the keyword to the sink point. By analyzing the function in the tainted keyword call context and determining whether the tainted introduction function is included in its call path, it can be determined whether a keyword is parsed by the tainted introduction function. If at least one function in the path is a confirmed tainted introduction function, the function that references the keyword is considered a valid taint source. For example, the path from the keyword "wla_temp_ssid" to the sensitive function strcpy [Param

[0085] "wla_temp_ssid"(0x00109a44),Referenced at FUN_000c19c0:0x000c272c]>>0x000c27d0>>FUN_000be890>>0x000bec84>>FUN_000be82c>>0x000be87c->strcpy. This path includes three functions: FUN_000c19c0, FUN_000be890, and FUN_000be82c. In the embodiment of this case, as long as one of the functions is a confirmed taint introduction function, "wla_temp_ssid" can be considered to be a valid taint keyword, thereby reducing the burden of subsequent taint analysis.

[0086] Furthermore, based on the above method, an embodiment of the present invention also provides an embedded device static taint analysis optimization system based on taint source identification, comprising: a firmware preprocessing module, a keyword matching module, a taint function identification module and a taint source filtering module, wherein:

[0087] The firmware preprocessing module is used to preprocess the embedded device firmware and extract the firmware front-end and back-end binary executable files;

[0088] A keyword matching module is used to identify and match tainted keywords in the front-end and back-end binary executable files using a semantic similarity matching strategy, and obtain a set of similar tainted keywords in the front-end and back-end binary executable files;

[0089] The tainted function identification module is used to extract all functions used to parse user input in the binary executable file based on the tainted keywords, and identify the tainted introduction function based on the function behavior characteristics;

[0090] The taint source filtering module is used to generate a path from the taint keyword to the taint convergence point based on the taint keyword set and the taint introduction function, and obtain the effective taint source in the binary executable file by filtering the taint keyword on the path, so as to identify potential firmware vulnerabilities using the effective taint source.

[0091] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0092] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0093] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0094] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0095] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A static taint analysis optimization method for embedded devices based on taint source identification, characterized in that: Include: Preprocess embedded device firmware and extract firmware front-end and back-end binary executable files; Using semantic similarity matching strategy to identify and match tainted keywords in front-end and back-end binary executable files, and obtaining a set of similar tainted keywords in the front-end and back-end binary executable files; Extract all functions used to parse user input in binary executable files based on tainted keywords, and identify tainted introduction functions based on function behavior characteristics; Based on the taint keyword set and the taint introduction function, a path from the taint keyword to the taint convergence point is generated, and the effective taint source in the binary executable file is obtained by filtering the taint keyword on the path, so as to identify potential vulnerabilities of the firmware using the effective taint source.

2. The method for optimizing static taint analysis of embedded devices based on taint source identification according to claim 1, characterized in that: Preprocess embedded device firmware, including: Use the unpacking tool to unpack the firmware and obtain the firmware file system; Based on the firmware file system attributes, the preset filtering rules are used to exclude redundant data and filter out all front-end and back-end binary executable programs in the firmware file system, wherein the redundant data includes script files, configuration files and dynamic link libraries; Disassemble the front-end and back-end binary executable programs to obtain the boundary binary executable file.

3. The method for optimizing static taint analysis of embedded devices based on taint source identification according to claim 1, characterized in that: Use semantic similarity matching strategy to identify and match tainted keywords in front-end and back-end binary executable files, including: Eliminate the strings containing special characters in the binary executable file, and use the string screening rules to screen the remaining strings in the binary executable file to obtain the filtered string data in the front-end and back-end binary executable files. The string screening rules are pre-set according to the naming rules of the tainted keywords. The filtered string data are respectively input into the natural language pre-training model, and the string embedding vector is obtained by using the natural language pre-training model, wherein the natural language pre-training model adopts the pre-trained lightweight paraphrase-MiniLM-L6-v2 model; The cosine similarity is used to measure the distance between the front-end and back-end string embedding vectors. The strings with similarity distance exceeding the threshold are regarded as tainted keywords and added to the similar tainted keyword set.

4. The method for optimizing static taint analysis of embedded devices based on taint source identification according to claim 3 is characterized in that: String filtering rules, including: Calculate the maximum common substring length between two strings in the front-end and back-end binary executable files and the length of the shorter string between the two strings; When the ratio of the maximum common substring length to the shorter string length is greater than a preset threshold, the two strings are added to the filtered string data.

5. The method for optimizing static taint analysis of embedded devices based on taint source identification according to claim 1, characterized in that: Identify tainted functions based on their behavior characteristics, including: Extract the function control flow graph, generate a set of successor basic blocks for each basic block, and construct a directed graph based on the set of successor basic blocks, so as to use the directed graph to convert the execution flow of the function into a directed graph structure, wherein each basic block in the directed graph is a node, and the successor basic block of each node is a directed edge starting from the current node; Identify loops in the function execution flow by detecting whether there are rings in the directed graph, filter out paths with more than a preset number of basic blocks, and obtain a set of basic block execution paths containing loops; The instructions in the basic block are converted into VEX IR instructions, the operand variables in the instructions are parsed and extracted according to the VEX IR instruction type, and the data flow graph is constructed using the operand variable relationship to identify the taint introduction function using the data flow graph.

6. The method for optimizing static taint analysis of embedded devices based on taint source identification according to claim 5, characterized in that: Use data flow graphs to identify taint introduction functions, including: Setting the taint state characteristics of the data flow graph loop path, the taint state characteristics of the data flow graph loop path include: there is a CMP point and the CMP point operand comes from the function parameter, the loop path includes a LOAD point and a STORE point, and the LOAD point on the path appears before the STORE point, there is a ring structure between the LOAD point and the STORE point, and there are arithmetic operations on the ring structure at the same time; A function that includes at least one loop path and the loop path simultaneously satisfies the taint state characteristics of the data flow graph loop path is taken as a candidate taint introduction function, and the final taint introduction function is identified from the candidate taint introduction functions based on the number of function calls.

7. The method for optimizing static taint analysis of embedded devices based on taint source identification according to claim 1, characterized in that: Valid taint sources in binary executable files are obtained by filtering taint keywords on the path, including: Get the function in the context of the tainted keyword call and determine whether the call path contains the tainted introduction function; If at least one function on the call path is a taint introduction function, the function that references the taint keyword is determined to be a valid taint source.

8. A static taint analysis optimization system for embedded devices based on taint source identification, characterized in that: It includes: firmware preprocessing module, keyword matching module, taint function identification module and taint source filtering module, among which, The firmware preprocessing module is used to preprocess the embedded device firmware and extract the firmware front-end and back-end binary executable files; A keyword matching module is used to identify and match tainted keywords in the front-end and back-end binary executable files using a semantic similarity matching strategy, and obtain a set of similar tainted keywords in the front-end and back-end binary executable files; The tainted function identification module is used to extract all functions used to parse user input in the binary executable file based on the tainted keywords, and identify the tainted introduction function based on the function behavior characteristics; The taint source filtering module is used to generate a path from the taint keyword to the taint convergence point based on the taint keyword set and the taint introduction function, and obtain the effective taint source in the binary executable file by filtering the taint keyword on the path, so as to identify potential firmware vulnerabilities using the effective taint source.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images