Firmware vulnerability detection method and related device

Abstract

The invention discloses a firmware vulnerability detection method and a related device, and relates to the technical field of network security, a first double-layer feature control flow diagram of to-be-detected firmware and a second double-layer control flow diagram of historical detection firmware are obtained, the two control flow diagrams are input into a similarity matching model to obtain the similarity between the two control flow diagrams, and the similarity between the two control flow diagrams is obtained. Whether the similarity between the two control flow diagrams reaches a first preset threshold value or not is judged, and when the similarity between the two control flow diagrams does not reach the first preset threshold value, difference positioning is carried out according to a similarity set output in a similarity model, a taint source in the first double-layer feature control flow diagram is determined, taint source tracking and analysis are carried out, and a vulnerability analysis result of the firmware to be detected is obtained. According to the method, the historical detection firmware before upgrading participates in the vulnerability detection process of the detection firmware after upgrading, taint source extraction and taint source analysis are carried out on the basis of the double-layer feature control flow diagram with more feature details, vulnerabilities in the to-be-detected firmware can be effectively found, and the coverage rate of vulnerability detection is greatly increased.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a firmware vulnerability detection method and related devices. Background Art

[0002] Firmware is software embedded in hardware that controls the basic operation and functions of a device. It includes the device's drivers, operating system, and other necessary programs to enable the device to function as expected.

[0003] If there are known or unknown security vulnerabilities in the firmware and these vulnerabilities are not fixed in time, the device where the firmware is located may become a potential target for attackers. Specifically, attackers can exploit the vulnerabilities in the firmware to execute malicious code, steal data, and other illegal activities. Therefore, it is of great significance to detect known vulnerabilities in the firmware and to mine unknown vulnerabilities in the firmware.

[0004] Vulnerability detection methods in the known art usually use similarity matching technology. This method specifically detects whether there is a vulnerability in firmware B in firmware A by comparing the similarity between the firmware A to be detected and the firmware B with known vulnerabilities, so as to repair it. However, this vulnerability detection method in the known art has certain limitations. It can only detect known vulnerabilities in firmware B in firmware A, but cannot mine unknown vulnerabilities in firmware A. Therefore, the unknown vulnerabilities in firmware A that cannot be detected may be exploited by attackers.

[0005] It can be seen that the coverage of firmware vulnerability detection in the firmware vulnerability detection method in the known technology is low. Summary of the invention

[0006] In view of the above problems, the present application provides a firmware vulnerability detection method and related devices to achieve the purpose of improving vulnerability detection coverage. The specific scheme is as follows:

[0007] The first aspect of the present application provides a firmware vulnerability detection method, comprising:

[0008] Obtaining a first double-layer feature control flow graph of the firmware to be detected and a second double-layer feature control flow graph of the historical detection firmware corresponding to the firmware to be detected; the firmware to be detected is a new version of the firmware obtained by upgrading the historical detection firmware;

[0009] The first double-layer feature control flow graph and the second double-layer feature control flow graph are input into the similarity matching model to obtain the similarity between the first double-layer feature control flow graph and the second double-layer feature control flow graph; the similarity matching model is configured as follows: the first double-layer feature control flow graph and the second double-layer feature control flow graph are respectively input into the basic block embedding model to obtain the first feature vector and the second feature vector correspondingly; the similarity set of the function pairs between the first feature vector and the second feature vector is determined; the similarity set is arranged from low to high according to the similarity between the function pairs;

[0010] Determine whether the similarity between the first double-layer feature control flow graph and the second double-layer feature control flow graph reaches a first preset threshold;

[0011] When the similarity does not reach the first preset threshold, locate the function pairs whose similarity is lower than the second preset threshold in the similarity set to obtain difference information; determine the stain source in the first feature vector according to the difference information;

[0012] Trace and analyze the path from the taint source to the preset sensitive function to obtain the vulnerability analysis results of the firmware to be tested.

[0013] In a possible implementation, inputting the first double-layer feature control flow graph and the second double-layer feature control flow graph into a similarity matching model includes:

[0014] The first double-layer feature control flow graph and the second double-layer feature control flow graph are input into the similarity matching model generated based on the long short-term memory network LSTM training.

[0015] In a possible implementation, determining a similarity set of a function pair between a first feature vector and a second feature vector includes:

[0016] Calculate the cosine distance of each function pair between the first eigenvector and the second eigenvector to obtain a cosine distance set, and use the cosine distance as the similarity between the function pairs;

[0017] The cosine distance set is processed using a function filter to obtain a similarity set arranged from low to high similarity.

[0018] In a possible implementation, determining the stain source in the first feature vector according to the difference information includes:

[0019] Decompile the difference information to get the decompiled code;

[0020] The flow variables are extracted from the decompiled code, and the extracted flow variables are used as the taint sources in the first feature vector.

[0021] In a possible implementation, the path from the taint source to the preset sensitive function is traced and analyzed to obtain the firmware vulnerability analysis results, including:

[0022] Track the path from the taint source to the preset sensitive function; the preset sensitive functions include buffer overflow sensitive functions, command injection functions, structured query language injection functions, and formatted string functions;

[0023] Determine whether the taint source directly reaches the preset sensitive function without harmless processing;

[0024] When the taint source directly reaches the preset sensitive function without being harmlessly processed, it is determined that the firmware to be tested has a vulnerability;

[0025] The vulnerability type is obtained by analyzing the preset sensitive function type reached by the taint source.

[0026] In a possible implementation, the first double-layer feature control flow graph and the second double-layer feature control flow graph both include function-layer features and basic block-layer features; and the feature granularities of the function-layer features and the basic block-layer features both meet preset refinement requirements.

[0027] A second aspect of the present application provides a firmware vulnerability detection device, comprising:

[0028] Acquisition unit, similarity matching unit, judgment unit, difference positioning unit and tracking unit; wherein:

[0029] An acquisition unit is used to acquire a first double-layer feature control flow graph of the firmware to be detected and a second double-layer feature control flow graph of the historical detection firmware corresponding to the firmware to be detected; the firmware to be detected is a new version of the firmware obtained by upgrading the historical detection firmware;

[0030] A similarity matching unit is used to input the first double-layer feature control flow graph and the second double-layer feature control flow graph into a similarity matching model to obtain the similarity between the first double-layer feature control flow graph and the second double-layer feature control flow graph; the similarity matching model is configured to: input the first double-layer feature control flow graph and the second double-layer feature control flow graph into the basic block embedding model respectively, and obtain the first feature vector and the second feature vector correspondingly; determine the similarity set of the function pair between the first feature vector and the second feature vector; the similarity set is arranged from low to high according to the similarity between the function pairs;

[0031] A judging unit, used to judge whether the similarity between the first double-layer feature control flow graph and the second double-layer feature control flow graph reaches a first preset threshold;

[0032] A difference locating unit, used for locating a function pair whose similarity in the similarity concentration is lower than a second preset threshold value when the similarity does not reach the first preset threshold value, to obtain difference information; and determining a stain source in the first feature vector according to the difference information;

[0033] The tracking unit is used to track and analyze the path from the taint source to the preset sensitive function to obtain the vulnerability analysis result of the firmware to be detected.

[0034] A third aspect of the present application provides a computer program product, comprising computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements a firmware vulnerability detection method as described in any one of the above.

[0035] A fourth aspect of the present application provides a firmware vulnerability detection device, comprising at least one processor and a memory connected to the processor, wherein:

[0036] The memory is used to store computer programs;

[0037] The processor is used to execute a computer program so that the firmware vulnerability detection device can implement the firmware vulnerability detection method as described in any one of the above.

[0038] A fifth aspect of the present application provides a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement a firmware vulnerability detection method as described in any one of the above.

[0039] By means of the above technical scheme, the firmware vulnerability detection method and related devices provided by the present application obtain the first double-layer characteristic control flow graph of the firmware to be detected and the second double-layer control flow graph of the historical detection firmware, input the two control flow graphs into the similarity matching model, obtain the similarity between the two control flow graphs, and judge whether the similarity between the two control flow graphs reaches the first preset threshold. When it does not reach it, the difference is located according to the similarity set output in the similarity model, and the taint source in the first double-layer characteristic control flow graph is determined. Finally, the taint source is tracked and analyzed to obtain the vulnerability analysis result of the firmware to be detected. The present application will use the historical detection firmware before the upgrade to participate in the vulnerability detection process of the upgraded detection firmware, and perform taint source extraction and taint source analysis based on the double-layer characteristic control flow graph with more characteristic details, which can effectively discover known and unknown vulnerabilities in the firmware to be detected, and greatly improve the coverage of vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0041] Figure 1 A flowchart of a firmware vulnerability detection method provided by this application;

[0042] Figure 2 A structural example diagram of the control flow graph provided by this application;

[0043] Figure 3 This is an example diagram of the processing flow of the similarity matching model provided in this application;

[0044] Figure 4 A flowchart of a firmware vulnerability detection method provided by this application;

[0045] Figure 5 A schematic diagram of the structure of a firmware vulnerability detection device provided by the present application;

[0046] Figure 6 This is a schematic diagram of the structure of the firmware vulnerability detection device provided in this application. DETAILED DESCRIPTION

[0047] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0048] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0049] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0050] Firmware is the basic software of the device, which controls the basic operation and functions of the hardware. Once there is a vulnerability, it may become a target of attackers. Through firmware vulnerability detection, these vulnerabilities can be discovered and fixed in time, reducing the attack surface and improving the security of the device. In addition, firmware vulnerabilities may cause unauthorized users or malicious code to gain control of the device, threatening the security of the network where the device is located. Therefore, it is of great significance to detect known vulnerabilities in firmware and to mine unknown vulnerabilities in firmware.

[0051] However, the coverage of firmware vulnerability detection by vulnerability detection methods in the known technologies is low.

[0052] In order to solve the above problems, the present application provides a firmware vulnerability detection method and related devices.

[0053] The firmware vulnerability detection method and related devices provided in the present application can be used for firmware vulnerability detection in bank over-the-counter clearing equipment. The present application will be described below using firmware vulnerability detection in over-the-counter clearing equipment as an example.

[0054] The off-counter clearing device is an intelligent bank counter terminal that integrates functions such as a password keyboard, business evaluation, and voice intercom. It enables banks to achieve paperless office, reduce the use of paper documents, and thus reduce the bank's operating costs.

[0055] At present, over-the-counter clearing equipment is widely used in the handling of banking business. Therefore, it is very important to ensure the reliability of over-the-counter clearing equipment. As an embedded device, over-the-counter clearing includes operating systems, applications, and various firmware provided by developers. Specifically, firmware is a software embedded in hardware that is responsible for controlling the basic operations and functions of the device, including the device driver, operating system, and other necessary programs, so that the device can operate as expected.

[0056] Regular firmware updates are one of the important measures to ensure the security and stability of over-the-counter equipment. Firmware upgrades usually include security upgrade patches to fix known security vulnerabilities and defects. These vulnerabilities may be exploited by malicious attackers, causing over-the-counter equipment to be attacked, resulting in data leakage and denial of service. Therefore, developers will release firmware upgrades to ensure the security of over-the-counter equipment. However, taking the above security measures in a timely manner cannot completely rule out the possibility of over-the-counter firmware being attacked. Therefore, it is necessary to perform vulnerability detection on the over-the-counter firmware so that the discovered vulnerabilities can be repaired in a timely manner to avoid asset losses to the bank.

[0057] If there are known or unknown security vulnerabilities in the firmware, and these vulnerabilities are not fixed in time, the cabinet cleaning equipment may become a potential target for attackers. Specifically, known vulnerabilities are vulnerabilities that have been discovered and made public, and usually have security patches that can be fixed, but the manufacturer may not have fixed the known vulnerabilities in the firmware. Attackers can easily obtain the details of known vulnerabilities and even automatically generate vulnerability exploits; unknown vulnerabilities are undiscovered or undisclosed vulnerabilities. These vulnerabilities may exist in the software, but have not been revealed due to lack of sufficient testing or new attack sending and receiving. Unknown vulnerabilities have a higher risk and may be exploited by hackers to attack, and users and developers are often unable to take defensive measures in time.

[0058] It can be seen that it is of great significance to detect known vulnerabilities in the external cabinet firmware and to explore unknown vulnerabilities in the firmware.

[0059] However, the vulnerability detection method based on similarity matching technology in the known technology can only detect known vulnerabilities but does not have the ability to mine unknown vulnerabilities; and the type of known vulnerabilities detected depends on the firmware of the known vulnerability function, and has poor scalability.

[0060] In order to improve the low coverage of firmware vulnerability detection, this application provides the following firmware vulnerability detection method.

[0061] Optional, see Figure 1 , a flow chart of a firmware vulnerability detection method provided by the present application.

[0062] Step 101, obtain a first double-layer feature control flow graph of the firmware to be detected and a second double-layer feature control flow graph of the historical detection firmware corresponding to the firmware to be detected; the firmware to be detected is a new version of the firmware obtained by upgrading the historical detection firmware.

[0063] It can be understood that the firmware to be detected is a new version of firmware obtained after upgrading the historical detection firmware, and the historical detection firmware is an old version of firmware corresponding to the firmware to be detected.

[0064] In this application, the new version of the firmware and the old version of the firmware are obtained in order to use the old version of the firmware as a comparison basis. In particular, the new version of the firmware and the old version of the firmware are processed into a two-layer feature control flow graph. The two-layer feature control flow graph includes rich firmware information and can accurately represent the firmware function.

[0065] Specifically, a control flow graph is an abstract representation of a firmware program. It is an abstract data structure in the compiler that represents all the paths that will be traversed during the execution of a program. It uses a graph to represent the possible flow of all basic blocks in a process. Each function in the executable file can be regarded as a directed graph with a special shape, namely, a control flow graph.

[0066] For example, see Figure 2 , a structural example diagram of the control flow graph provided in this application.

[0067] like Figure 2 As shown in the figure, each node in the figure represents a basic block, that is, a continuous code statement without any jump or jump target. The directed edges in the control flow graph are used to represent jumps in the control flow. Among them, the S node represents the entry block, which is used to enter the control flow graph; the E node represents the exit block, through which all control flows leave. The A, B, and C nodes represent the code fragments of the program.

[0068] It is understandable that after the old version of the firmware is upgraded to the new version of the firmware, the new version of the firmware will include the vulnerability repair data or function optimization data of the old version of the firmware.

[0069] In order to improve the comparison accuracy of two versions of firmware, the present application processes both the new and old versions of firmware into a double-layer feature control flow graph. The basic blocks in the control flow graph include syntax, structural code, semantic information, etc. The double-layer feature control flow graph in the present application adopts some features in the basic blocks: function layer features and basic block layer features, and refines the granularity of the two layer features, so as to finely compare the granularity and improve the comparison accuracy.

[0070] Specifically, the basic block layer features include but are not limited to: the number of character constants, the number of numeric constants, the number of instructions, the number of mathematical operation instructions, the number of transfer instructions, the number of logical instructions, the number of function calls, the distance from the entry basic block, and the distance from the exit basic block.

[0071] Function layer features include, but are not limited to: number of nodes, number of directed edges, number of function calls, number of function calls, number of logic instructions, number of transfer instructions, and number of instructions.

[0072] These fine-grained features are helpful to improve the accuracy of the similarity between the two double-layer feature control flow graphs and the accuracy of the subsequent difference positioning.

[0073] Optionally, a double-layer feature control flow graph of the new version of the firmware and a double-layer feature control flow graph of the old version of the firmware corresponding to the new version of the firmware are obtained.

[0074] Step 102: input the first double-layer feature control flow graph and the second double-layer feature control flow graph into a similarity matching model to obtain the similarity between the first double-layer feature control flow graph and the second double-layer feature control flow graph; the similarity matching model is configured as follows: input the first double-layer feature control flow graph and the second double-layer feature control flow graph into the basic block embedding model respectively to obtain the first feature vector and the second feature vector correspondingly; determine the similarity set of the function pairs between the first feature vector and the second feature vector; the similarity set is arranged from low to high according to the similarity between the function pairs.

[0075] It should be noted that the similarity matching model is mainly used to calculate the similarity between the first double-layer feature control flow graph corresponding to the firmware to be detected and the second double-layer feature control flow graph corresponding to the old version of the firmware. The processing flow of the similarity matching model mainly includes three parts: basic block embedding model, similarity calculation, and similarity sorting.

[0076] First, the first double-layer feature control flow graph and the second double-layer feature control flow graph are input into the basic block embedding model respectively, and the first feature vector and the second feature vector corresponding to the two double-layer control flow graphs are obtained respectively. Given that the LSTM network can automatically learn and effectively retain the syntax and semantic information of the code, the basic block embedding model can be designed and trained based on the LSTM (Long Short-Term Memory).

[0077] Specifically, in the basic block embedding model, LSTM regards program statements as single sequences with internal dependencies, encodes newly read single sentences at each time step, updates the dependencies between words, and generates the embedding of program statements at the end of the program statement, that is, generates the basic block embedding, that is, the feature vector. The feature vector contains all words and their dependencies. Each LSTM consists of four parts: forget gate, input gate, output gate and current cell state, among which the forget gate determines how much of the cell state at the previous moment is retained to the current state, the input gate determines how much of the current input is retained to the cell state, and the output gate controls how much of the cell state is output to the current output value of the LSTM.

[0078] Optionally, let the input basic block be B and the forget gate be , the input gate is The output gate is , the current unit status is , time step is t, h t-1 is the value of the hidden layer at the previous moment of the current moment; the formula for updating the state of an LSTM unit in the basic block embedding model at the time step is as follows:

[0079]

[0080]

[0081]

[0082]

[0083]

[0084]

[0085] in, and is the weight matrix; b f , , and is the bias vector;

[0086] Then, the similarity between the first eigenvector and the second eigenvector is calculated. Specifically, the cosine function is used to calculate the cosine distance between each function pair between the two vectors, and the cosine distance is used as the similarity value between each function pair to obtain a similarity set.

[0087] Use function filters to process the similarity between function pairs and sort the similarity values ​​in the similarity set from low to high.

[0088] Finally, a similarity set is outputted, in which the similarity values ​​are sorted from high to low. It should be noted that the reason for sorting the similarity values ​​from low to high is to facilitate finding the functional differences between the two firmwares.

[0089] For example, see Figure 3 , an example diagram of the processing flow of the similarity matching model provided in this application.

[0090] like Figure 3 As shown, the control flow Figure 1 Input to the basic block embedding generation module generated based on LSTM network training to generate the corresponding numerical feature vector h1. At the same time, the control flow Figure 2 The input is sent to the basic block embedding generation module generated based on LSTM network training to generate the corresponding numerical feature vector h2. Then, the Cosine function is used to calculate the similarity between the numerical feature vector h1 and the numerical feature vector h2, and the function filter is used to sort the calculated similarities from low to high, and the various similarities are output in order from low to high.

[0091] Optionally, the first double-layer feature control flow graph and the second double-layer feature control flow graph are input into a similarity matching model to obtain similarities output in order from low to high corresponding to each function pair between the firmware to be detected and the historical detection firmware.

[0092] Step 103: Determine whether the similarity between the first double-layer feature control flow graph and the second double-layer feature control flow graph reaches a first preset threshold.

[0093] It is understandable that the higher the similarity between the firmware to be tested and the historically tested firmware, the smaller the difference between the two firmwares, and the smaller the possibility that the firmware to be tested has vulnerabilities that need to be fixed. Therefore, this step is mainly to determine whether the similarity between the firmware to be tested and the historically tested firmware is high enough. If the similarity between the two is extremely high, there is no need to perform vulnerability detection.

[0094] Optionally, it is determined whether the similarity between the firmware to be detected and the historically detected firmware reaches a first preset threshold, and if so, vulnerability detection is no longer performed on the firmware to be detected. If the similarity between the two firmwares does not reach the preset threshold, subsequent steps are performed.

[0095] Exemplarily, the preset threshold may be 100%, that is, to determine whether the two firmwares are completely consistent, when the similarity between the two double-layer feature control flow graphs is 100%, the subsequent difference location step is no longer performed on the first double-layer control flow graph.

[0096] Step 104: When the first double-layer feature control flow graph and the second double-layer feature control flow graph do not reach a preset threshold, locate the function pairs whose similarity in the similarity set is lower than the second preset threshold to obtain difference information; determine the stain source in the first feature vector based on the difference information.

[0097] When the first double-layer feature control flow graph and the second double-layer feature control flow graph do not reach the first preset threshold, it indicates that there are differences between the firmware to be detected and the historical detected firmware. Specifically, it may be that the firmware to be detected has added or modified the original program logic, or it may be a vulnerability repair.

[0098] First, the difference is located. It can be understood that the lower the similarity of the function pair between the firmware to be tested and the historical tested firmware, the greater the difference. The function pairs with similarity lower than the preset threshold are located in the similarity concentration, and the position of the low-similarity function in the firmware to be tested is specifically located. After the function position is located, the location of the difference code, variables and other information are obtained. This information is the difference information.

[0099] Then, decompile these difference information to obtain the decompiled code, extract the flow variables from the decompiled code, and track the flow variables to determine whether there are vulnerabilities in the logic of the firmware to be tested. These flow variables are considered to be related to the vulnerabilities. Therefore, the extracted flow variables are used as the taint source of the firmware to be tested.

[0100] Step 105: trace and analyze the path from the taint source to the preset sensitive function to obtain the vulnerability analysis result of the firmware to be detected.

[0101] It should be noted that the preset sensitive functions are functions where vulnerabilities may occur, including buffer overflow sensitive functions, command injection functions, structured query language injection functions, and formatted string functions.

[0102] Specifically, sensitive functions of buffer overflow include: strcpy(), strcat(), memcpy(), etc. If the target buffer size of this type of function is not large enough to accommodate the source string and its terminator ('\0'), a buffer overflow will occur, resulting in information leakage; structured query language injection functions include: mysql_query(), sqlite3_exec(), psql_exec(), etc. If this type of function does not correctly handle user input when building SQL queries, attackers can manipulate query results or perform unauthorized operations by injecting malicious SQL code; format string functions: format output functions such as printf() and sprintf(). If the firmware code uses format output functions and allows users to control the format string, attackers can read or modify sensitive data on the stack by entering a specific format string.

[0103] Through static taint analysis technology, data is tracked from the taint source, and all paths that pass through the taint source to reach sensitive functions are constructed. Specifically, it is a technology that tracks and analyzes the flow of taint information in the program, which is a common means of information flow analysis. In vulnerability analysis, taint analysis technology marks the data of interest (usually from the external input of the program) as a taint source, and then tracks the flow of information related to the taint source to determine whether they will affect certain key program operations, thereby discovering program vulnerabilities.

[0104] Optionally, static taint analysis technology can be used to track the taint source, build the path from the taint source to all preset sensitive functions, and determine whether the taint source directly reaches the preset sensitive function without harmless processing. If so, it is determined that there is a vulnerability in the firmware to be tested, and the vulnerability type is specifically analyzed based on the preset sensitive function type reached by the taint source. If not, it means that the taint source does not have a vulnerability.

[0105] It should be noted that the tainted source data directly reaches the preset sensitive function without harmless processing, which violates the information flow policy and will lead to security issues such as privacy data leakage or dangerous data operations. Therefore, the tainted source in this case can be regarded as a vulnerability. Specifically, the vulnerability types include but are not limited to buffer overflow vulnerabilities corresponding to the preset sensitive functions, command injection vulnerabilities, SQL injection vulnerabilities, and format string vulnerabilities.

[0106] It can be understood that when there is a firmware upgrade operation in the off-cabinet cleaning device, applying the firmware vulnerability detection method provided by the present application can improve the reliability of the off-cabinet cleaning device.

[0107] In summary, the firmware vulnerability detection method provided by the present application obtains the first double-layer feature control flow graph of the firmware to be detected and the second double-layer control flow graph of the historical detection firmware, inputs the two control flow graphs into the similarity matching model, obtains the similarity between the two control flow graphs, and determines whether the similarity between the two control flow graphs reaches the first preset threshold. When it does not reach the threshold, the difference is located according to the similarity set output in the similarity model, and the taint source in the first double-layer feature control flow graph is determined. Finally, the taint source is tracked and analyzed to obtain the vulnerability analysis result of the firmware to be detected. The present application will use the historical detection firmware before the upgrade to participate in the vulnerability detection process of the upgraded detection firmware, and perform taint source extraction and taint source analysis based on the double-layer feature control flow graph with more feature details, which can effectively discover known and unknown vulnerabilities in the firmware to be detected, and greatly improve the coverage of vulnerability detection.

[0108] For example, see Figure 4 , a flow chart of an example of a firmware vulnerability detection method provided in this application.

[0109] like Figure 4 As shown, the firmware vulnerability detection method includes the following:

[0110] Generate control flow graphs for the new version of firmware and the old version of firmware respectively, calculate the similarity between the two control flow graphs, determine the difference data in the new version of the control flow graph through difference positioning, determine and extract the taint source from the difference data, and finally obtain the vulnerability check result for the new version of firmware after taint analysis.

[0111] In summary, this application proposes a taint analysis technology based on differential extraction of taint sources, which uses the extracted taint sources to discover vulnerabilities. It can not only effectively detect known vulnerabilities, but also effectively mine unknown vulnerabilities, thereby preventing vulnerabilities from being exploited by attackers and causing problems such as sensitive information leakage and device denial of service.

[0112] A firmware vulnerability detection method provided by an embodiment of the present application is introduced above, and a device for executing the above firmware vulnerability detection method will be introduced below.

[0113] See also Figure 5 , Figure 5 This is a schematic diagram of the structure of a firmware vulnerability detection device provided by this application. Figure 5 As shown, the device comprises:

[0114] An acquisition unit 10, a similarity matching unit 20, a judgment unit 30, a difference positioning unit 40 and a tracking unit 50; wherein:

[0115] The acquisition unit 10 is used to acquire a first double-layer feature control flow graph of the firmware to be detected and a second double-layer feature control flow graph of the historical detection firmware corresponding to the firmware to be detected; the firmware to be detected is a new version of the firmware obtained by upgrading the historical detection firmware;

[0116] The similarity matching unit 20 is used to input the first double-layer feature control flow graph and the second double-layer feature control flow graph into the similarity matching model to obtain the similarity between the first double-layer feature control flow graph and the second double-layer feature control flow graph; the similarity matching model is configured to: input the first double-layer feature control flow graph and the second double-layer feature control flow graph into the basic block embedding model respectively, and obtain the first feature vector and the second feature vector correspondingly; determine the similarity set of the function pair between the first feature vector and the second feature vector; the similarity set is arranged from low to high according to the similarity between the function pairs;

[0117] A judging unit 30, configured to judge whether the similarity between the first double-layer feature control flow graph and the second double-layer feature control flow graph reaches a first preset threshold;

[0118] The difference locating unit 40 is used to locate the function pairs whose similarity is lower than the second preset threshold in the similarity set when the similarity does not reach the first preset threshold, and obtain the difference information; and determine the stain source in the first feature vector according to the difference information;

[0119] The tracking unit 50 is used to track and analyze the path from the taint source to the preset sensitive function to obtain the vulnerability analysis result of the firmware to be detected.

[0120] In one embodiment, the similarity matching unit 20 is specifically configured to:

[0121] The first double-layer feature control flow graph and the second double-layer feature control flow graph are input into the similarity matching model generated based on the long short-term memory network LSTM training.

[0122] In one implementation, the similarity matching unit 20 is specifically configured to:

[0123] Calculate the cosine distance of each function pair between the first eigenvector and the second eigenvector to obtain a cosine distance set, and use the cosine distance as the similarity between the function pairs;

[0124] The cosine distance set is processed using a function filter to obtain a similarity set arranged from low to high similarity.

[0125] In one embodiment, the difference positioning unit 40 is specifically used for:

[0126] Decompile the difference information to get the decompiled code;

[0127] The flow variables are extracted from the decompiled code, and the extracted flow variables are used as the taint sources in the first feature vector.

[0128] In one embodiment, the tracking unit 50 is specifically configured to:

[0129] Track the path from the taint source to the preset sensitive function; the preset sensitive functions include buffer overflow sensitive functions, command injection functions, structured query language injection functions, and formatted string functions;

[0130] Determine whether the taint source directly reaches the preset sensitive function without harmless processing;

[0131] When the taint source directly reaches the preset sensitive function without being harmlessly processed, it is determined that the firmware to be tested has a vulnerability;

[0132] The vulnerability type is obtained by analyzing the preset sensitive function type reached by the taint source.

[0133] In one embodiment, the first double-layer feature control flow graph and the second double-layer feature control flow graph in the acquisition unit 10 both include function-layer features and basic block-layer features; the feature granularity of the function-layer features and the basic block-layer features both meet the preset refinement requirements.

[0134] An embodiment of the present application also provides a computer program product, including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements any firmware vulnerability detection method provided in the embodiment of the present application.

[0135] The present application also provides a firmware vulnerability detection device. Figure 6 As shown, it shows a schematic diagram of a structure suitable for implementing the firmware vulnerability detection device provided by the present application. The firmware vulnerability detection device in the embodiment of the present application may include but is not limited to fixed terminals such as mobile phones, laptops, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Figure 6 The firmware vulnerability detection device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0136] like Figure 6As shown, the firmware vulnerability detection device may include a processing device (such as a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 to a random access memory (RAM) 603. When the firmware vulnerability detection device is powered on, various programs and data required for the operation of the firmware vulnerability detection device are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0137] Typically, the following devices may be connected to the I / O interface 605: input devices 606 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 608 including, for example, a memory card, a hard disk, etc.; and communication devices 609. The communication device 609 may allow the firmware vulnerability detection device to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The firmware vulnerability detection device with various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0138] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any firmware vulnerability detection method provided in an embodiment of the present application.

[0139] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0140] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0141] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0142] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, a computer, a training device or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device or data center. The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integration. Available media can be magnetic media, (e.g., floppy disk, hard disk, tape), optical media (e.g., DVD), or semiconductor media (e.g., solid-state hard disk (SSD)), etc.

Claims

1. A firmware vulnerability detection method, characterized in that: include: Acquire a first double-layer characteristic control flow graph of the firmware to be detected and a second double-layer characteristic control flow graph of the historical detection firmware corresponding to the firmware to be detected; The firmware to be tested is a new version of firmware obtained by upgrading the historical tested firmware; The first double-layer feature control flow graph and the second double-layer feature control flow graph are input into a similarity matching model to obtain the similarity between the first double-layer feature control flow graph and the second double-layer feature control flow graph; the similarity matching model is configured to: input the first double-layer feature control flow graph and the second double-layer feature control flow graph into a basic block embedding model respectively, and obtain a first feature vector and a second feature vector correspondingly; determine a similarity set of function pairs between the first feature vector and the second feature vector; the similarity set is arranged from low to high according to the similarity between the function pairs; Determine whether the similarity between the first double-layer feature control flow graph and the second double-layer feature control flow graph reaches a first preset threshold; When the similarity does not reach the first preset threshold, locate the function pairs whose similarity is lower than the second preset threshold in the similarity set to obtain difference information; determine the stain source in the first feature vector according to the difference information; The path from the taint source to the preset sensitive function is tracked and analyzed to obtain the vulnerability analysis result of the firmware to be detected.

2. The firmware vulnerability detection method according to claim 1, characterized in that: The step of inputting the first double-layer feature control flow graph and the second double-layer feature control flow graph into a similarity matching model includes: The first double-layer feature control flow graph and the second double-layer feature control flow graph are input into a similarity matching model generated based on long short-term memory network LSTM training.

3. The firmware vulnerability detection method according to claim 1, characterized in that: Determining a similarity set of function pairs between the first feature vector and the second feature vector includes: Calculating the cosine distance of each function pair between the first eigenvector and the second eigenvector to obtain a cosine distance set, and using the cosine distance as the similarity between the function pairs; The cosine distance set is processed by using a function filter to obtain the similarity set arranged from low to high similarity.

4. The firmware vulnerability detection method according to claim 1, characterized in that: The determining the stain source in the first feature vector according to the difference information includes: Decompiling the difference information to obtain decompiled code; Extracting flow variables from the decompiled code, and using the extracted flow variables as taint sources in the first feature vector.

5. The firmware vulnerability detection method according to claim 1, characterized in that: Track and analyze the path from the taint source to the preset sensitive function to obtain the firmware vulnerability analysis results, including: Tracking the path from the taint source to the preset sensitive function; the preset sensitive function includes buffer overflow sensitive function, command injection function, structured query language injection function, and formatted string function; Determining whether the taint source directly reaches the preset sensitive function without being harmlessly processed; When the taint source directly reaches the preset sensitive function without being harmlessly processed, determining that the firmware to be detected has a vulnerability; The vulnerability type is obtained by analyzing the preset sensitive function type reached by the taint source.

6. The firmware vulnerability detection method according to claim 1, characterized in that: The first double-layer feature control flow graph and the second double-layer feature control flow graph both include function-layer features and basic block-layer features; the feature granularities of the function-layer features and basic block-layer features both meet preset refinement requirements.

7. A firmware vulnerability detection device, characterized in that: include: Acquisition unit, similarity matching unit, judgment unit, difference positioning unit and tracking unit; wherein: The acquisition unit is used to acquire a first double-layer feature control flow graph of the firmware to be detected and a second double-layer feature control flow graph of the historical detection firmware corresponding to the firmware to be detected; the firmware to be detected is a new version of the firmware obtained by upgrading the historical detection firmware; The similarity matching unit is used to input the first double-layer feature control flow graph and the second double-layer feature control flow graph into a similarity matching model to obtain the similarity between the first double-layer feature control flow graph and the second double-layer feature control flow graph; the similarity matching model is configured to: input the first double-layer feature control flow graph and the second double-layer feature control flow graph into a basic block embedding model respectively, and obtain a first feature vector and a second feature vector correspondingly; determine a similarity set of function pairs between the first feature vector and the second feature vector; the similarity set is arranged from low to high according to the similarity between the function pairs; The judging unit is configured to judge whether the similarity between the first double-layer feature control flow graph and the second double-layer feature control flow graph reaches a first preset threshold; The difference locating unit is used to locate the function pairs whose similarity is lower than the second preset threshold in the similarity set when the similarity does not reach the first preset threshold, to obtain difference information; and determine the stain source in the first feature vector according to the difference information; The tracking unit is used to track and analyze the path from the taint source to the preset sensitive function to obtain the vulnerability analysis result of the firmware to be detected.

8. A computer program product, characterized in that It includes computer-readable instructions, and when the computer-readable instructions are executed on an electronic device, the electronic device implements the firmware vulnerability detection method according to any one of claims 1 to 6.

9. A firmware vulnerability detection device, characterized in that: The method comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the firmware vulnerability detection device can implement the firmware vulnerability detection method according to any one of claims 1 to 6.

10. A computer storage medium, characterized in that: The storage medium carries one or more computer programs, and when the one or more computer programs are executed by an electronic device, the electronic device can implement the firmware vulnerability detection method as described in any one of claims 1 to 6.

Images