Firmware logic vulnerability detection method and system based on large language model thinking chain, electronic equipment and computer readable storage medium

Abstract

The invention provides a firmware logic vulnerability detection method and system based on a big language model thinking chain, electronic equipment and a computer readable storage medium. The method comprises the following steps: constructing a business logic vulnerability knowledge base by adopting a first big language model; obtaining basic data of a firmware business program to be detected to construct a business object knowledge graph; based on the business logic vulnerability knowledge base, adopting a retrieval enhancement generation algorithm to obtain a sensitive control flow and a business logic vulnerability normal form corresponding to the to-be-detected firmware business program; based on the business logic vulnerability normal form and the sensitive control flow corresponding to the to-be-detected firmware business program, adopting a large language model thinking chain technology to iteratively generate multi-level cue words; and based on the multi-level cue word and the business object knowledge graph, adopting a second large language model to obtain a logic vulnerability detection result. According to the method and the device, various service logic vulnerabilities in the Internet of Things terminal firmware can be detected.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a firmware logic vulnerability detection method, system, electronic device and computer-readable storage medium based on a large language model thinking chain. Background Art

[0002] Business logic vulnerabilities in IoT terminal firmware usually involve improper design, implementation, and configuration, allowing attackers to bypass normal processes or gain undue access rights through specific operations. The types of business logic vulnerabilities in IoT terminal firmware include but are not limited to the following.

[0003] 1. Authentication bypass: Vulnerability description: Attackers can bypass authentication mechanisms or abuse weak authentication to gain unauthorized access to devices or services. For example, bypassing password or token verification through some interfaces that are not fully authenticated. Common scenarios: The default password or hard-coded password of an IoT device has not been changed, and attackers gain administrator privileges through brute force or dictionary attacks.

[0004] 2. Privilege escalation: Vulnerability description: When the permission control mechanism is improperly designed, low-privilege users can obtain higher permissions by operating or tampering with requests. Common scenarios: Ordinary users can access or operate settings under administrator privileges, or increase permissions by tampering with firmware configuration files or request parameters.

[0005] 3. Unauthorized access: Vulnerability description: Some interfaces or services of the device are not fully authorized, allowing attackers to directly access sensitive data or control the device. Common scenarios: If sensitive information (such as API keys, passwords, etc.) is stored in remote access interfaces, device configurations, or log files, attackers can directly access it through interfaces exposed on the network.

[0006] 4. Command injection: Vulnerability description: An attacker can change the normal behavior of the device or even make the device perform arbitrary operations by injecting malicious commands or codes. Common scenarios: The firmware of IoT devices may have incorrect data validation, allowing malicious commands to be injected into the execution process of the device.

[0007] 5. Improper data verification and processing: Vulnerability description: The device does not correctly verify the legitimacy of the input data, resulting in malicious tampering or incorrect processing of the data, which in turn affects the normal operation of the device. Common scenarios: If the command parameters input by the device are not correctly verified, an attacker can cause the device to behave incorrectly or crash through malicious input.

[0008] 6. Business Process Bypass: Vulnerability description: An attacker can bypass restrictions or obtain improper permissions or functions by bypassing the normal business process of the device. Common scenarios: An attacker can bypass certain business logic by modifying the process control parameters in the device firmware, such as avoiding multi-factor authentication or payment authentication by modifying the request order.

[0009] 7. Weak security configuration: Vulnerability description: IoT devices may lack sufficient security considerations during design and use default or easily guessed configurations, which may expose the device to attackers. Common scenarios: Using default settings, weak passwords, or not performing encrypted communications, attackers can easily gain access to device access or data.

[0010] 8. Firmware Update Abuse: Vulnerability Description: An attacker may abuse the device's firmware update mechanism to implant malicious code or bypass security controls. Common scenarios: The firmware update mechanism of IoT devices lacks verification or signature checks, allowing attackers to upload malicious firmware and replace the device's original firmware.

[0011] 9. Improper resource management: Vulnerability description: IoT devices improperly manage internal resources (such as memory, storage, bandwidth, etc.), allowing attackers to exhaust resources or occupy a large amount of computing power through specific operations, affecting the normal function of the device. Common scenarios: For example, the device does not limit the size of the log file or flow control, and attackers can use this to cause the device to overload.

[0012] Since the business logic vulnerability paradigm is changeable and is closely related to the functional characteristics, application scenarios, and business design of the upper-level applications, there are no universal and fixed characteristics and rules. Therefore, there is an urgent need for a detection method for business logic vulnerabilities in IoT terminal firmware.

[0013] It should be noted that the information disclosed in the background technology section of the invention is only intended to deepen the understanding of the general background technology of the invention, and should not be regarded as an admission or suggestion in any form that the information constitutes prior art already known to those skilled in the art. Summary of the invention

[0014] The purpose of the present invention is to provide a firmware logic vulnerability detection method, system, electronic device and computer-readable storage medium based on a large language model thinking chain, which can realize the detection of various business logic vulnerabilities in the firmware of the Internet of Things terminal.

[0015] To achieve the above-mentioned purpose, the present invention provides a firmware logic vulnerability detection method based on a large language model thinking chain, comprising: using a first large language model to process the collected firmware business program vulnerability data source to construct a business logic vulnerability knowledge base, wherein the business logic vulnerability knowledge base includes vulnerability information summaries, vulnerability context information, vulnerability constraints, logic vulnerability paradigms and business functions corresponding to different types of business logic vulnerabilities; obtaining basic data of the firmware business program to be detected, and constructing a business object knowledge graph based on the basic data of the firmware business program to be detected, wherein the basic data includes function descriptions, high-level function summaries, loop summaries, data According to dependency relationships and program call graphs; based on the business logic vulnerability knowledge base, a retrieval enhancement generation algorithm is used to obtain sensitive control flows and business logic vulnerability paradigms corresponding to the firmware business program to be detected; based on the business logic vulnerability paradigm and sensitive control flows corresponding to the firmware business program to be detected, a large language model thinking chain technology is used to decompose the reasoning process of logic vulnerabilities and related taint analysis processes, so as to iteratively generate multi-level prompt words corresponding to the logic vulnerability analysis steps; based on the multi-level prompt words and the business object knowledge graph, a second large language model is used to perform taint analysis to obtain the logic vulnerability detection result corresponding to the firmware business program to be detected.

[0016] Optionally, obtaining basic data of the firmware business program to be detected includes: using a static analysis tool to analyze the source code or decompiled code of the firmware business program to be detected to obtain a static analysis result corresponding to the firmware business program to be detected, the static analysis result including data flow and control flow; using a third language model to analyze the source code or decompiled code of the firmware business program to be detected to obtain a large model analysis result corresponding to the firmware business program to be detected, the large model analysis result including a vulnerability associated function summary, business function, business scenario and description information; combining the static analysis result corresponding to the firmware business program to be detected and the large model analysis result to obtain the basic data of the firmware business program to be detected.

[0017] Optionally, based on the business logic vulnerability knowledge base, a retrieval enhancement generation algorithm is used to obtain sensitive control flow and business logic vulnerability paradigm corresponding to the firmware business program to be detected, including: based on the source code or decompiled code of the firmware business program to be detected, searching in a pre-created vector database through a retrieval enhancement generation algorithm to obtain a target vulnerability report associated with the target logic vulnerability in the firmware business program to be detected and the corresponding target vulnerability code; performing code semantic description of the target vulnerability code to construct a business logic vulnerability paradigm corresponding to the target logic vulnerability; performing similarity matching on the business logic vulnerability paradigm in the business logic vulnerability knowledge base to obtain the vulnerability function summary and sensitive control flow corresponding to the target logic vulnerability.

[0018] Optionally, the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention also includes: based on the target vulnerability report, searching in the business logic vulnerability knowledge base to obtain the vulnerability information summary, business function, vulnerability constraint conditions and vulnerability context information that matches the target logic vulnerability.

[0019] Optionally, based on the business logic vulnerability paradigm and sensitive control flow corresponding to the firmware business program to be detected, the large language model thinking chain technology is used to decompose the reasoning process of the logic vulnerability and the related taint analysis process, so as to iteratively generate multi-level prompt words corresponding to the logic vulnerability analysis steps, including: according to the business logic vulnerability paradigm and sensitive control flow corresponding to the firmware business program to be detected and the vulnerability information summary, business function, vulnerability constraint conditions and vulnerability context information matching the target logic vulnerability, the large language model thinking chain technology is used to decompose the reasoning process of the logic vulnerability and the related taint analysis process; iteratively generate multi-level prompt words corresponding to the function call chain taint tracking analysis, security vulnerability judgment and constraint solving.

[0020] Optionally, the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention also includes: using the first large language model to analyze the target vulnerability report to obtain a functional description of the target vulnerability code associated with the target logic vulnerability and the root cause of the target logic vulnerability.

[0021] Optionally, based on the multi-level prompt words and the business object knowledge graph, a second largest language model is used to perform taint analysis to obtain a logic vulnerability detection result corresponding to the firmware business program to be detected, including: inputting a functional description of the target vulnerability code and a root cause of the target logic vulnerability into the second largest language model; inputting the multi-level prompt words, the business object knowledge graph, the sensitive control flow, and the data flow corresponding to the firmware business program to be detected into the second largest language model in sequence; and using a taint analysis algorithm to gradually infer whether each node function in the sensitive control flow violates a security policy to obtain a logic vulnerability detection result corresponding to the firmware business program to be detected.

[0022] To achieve the above-mentioned purpose, the present invention also provides a firmware logic vulnerability detection system based on a large language model thinking chain, including: a knowledge base construction module, configured to use a first large language model to process the collected firmware business program vulnerability data source to construct a business logic vulnerability knowledge base, wherein the business logic vulnerability knowledge base includes vulnerability information summaries, vulnerability context information, vulnerability constraints, logic vulnerability paradigms and business functions corresponding to different types of business logic vulnerabilities; a knowledge graph construction module, configured to construct a business object knowledge graph based on the basic data of the firmware business program to be detected, wherein the basic data includes function descriptions, high-level function summaries, loop summaries, data dependencies and program call graphs; a retrieval enhancement module , configured to use a retrieval enhancement generation algorithm to obtain the sensitive control flow and business logic vulnerability paradigm corresponding to the firmware business program to be detected based on the business logic vulnerability knowledge base; a multi-level prompt word generation module, configured to use a large language model thinking chain technology based on the business logic vulnerability paradigm and sensitive control flow corresponding to the firmware business program to be detected, to decompose the reasoning process of the logic vulnerability and the related taint analysis process, so as to iteratively generate multi-level prompt words corresponding to the logic vulnerability analysis steps; and a business logic vulnerability analysis module, configured to use a second large language model to perform taint analysis based on the multi-level prompt words and the business object knowledge graph to obtain the logic vulnerability detection result corresponding to the firmware business program to be detected.

[0023] To achieve the above-mentioned purpose, the present invention also provides an electronic device, including a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the firmware logic vulnerability detection method based on the large language model thinking chain as described in any one of the above items is implemented.

[0024] To achieve the above objectives, the present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the firmware logic vulnerability detection method based on the large language model thinking chain as described in any one of the above items is implemented.

[0025] Compared with the prior art, the firmware logic vulnerability detection method, system, electronic device and computer-readable storage medium based on the large language model thinking chain provided by the present invention have the following beneficial effects: the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention can fully utilize the large language model's ability to understand the semantics of vulnerability codes by using the first large language model to process the collected firmware business program vulnerability data source, and construct a business logic vulnerability knowledge base covering the logic vulnerability paradigm of various typical business logic vulnerabilities, thereby ensuring that the present invention can detect various business logic vulnerabilities in the IoT terminal firmware; by constructing a business object knowledge graph based on basic data such as the functional description, high-level function summary, loop summary, data dependency and program call graph of the firmware business program to be detected, the accuracy of the subsequent logic vulnerability detection results of the firmware business program to be detected can be further guaranteed; by using the business logic vulnerability knowledge base, a retrieval method can be used to retrieve the business logic vulnerability knowledge base. The enhanced generation algorithm obtains the sensitive control flow and business logic vulnerability paradigm corresponding to the firmware business program to be detected, and can establish a high-dimensional mapping of control flow semantic representation and potential vulnerability types, so as to dynamically and adaptively provide a guiding example for the large language model thinking chain technology; by adopting the large language model thinking chain technology, the reasoning process of the logical vulnerability and the related taint analysis process are decomposed, and the multi-level prompts (Prompt) corresponding to the atomic operations of the call chain data flow tracking analysis and the security vulnerability existence judgment vulnerability analysis are generated, and the context learning and fine-tuning of the large language model can be repeatedly iterated; by using the second large language model for taint analysis based on the multi-level prompt words and the business object knowledge graph, the large language model can be driven to gradually infer whether each node function of the sensitive control flow of the firmware business program to be detected violates the security policy according to the taint analysis steps, so as to effectively ensure the accuracy of the logic vulnerability detection results of the firmware business program to be detected. In summary, it can be seen that by adopting the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention, the ability of the large language model to understand, analyze and discover the logic vulnerabilities of the firmware business program of the Internet of Things terminal can be effectively promoted.

[0026] Since the firmware logic vulnerability detection system based on the large language model thinking chain, electronic device and computer-readable storage medium provided by the present invention belong to the same inventive concept as the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention, the firmware logic vulnerability detection system based on the large language model thinking chain, electronic device and computer-readable storage medium provided by the present invention at least have all the beneficial effects of the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention. For details, please refer to the relevant description above. Therefore, the beneficial effects of the firmware logic vulnerability detection system based on the large language model thinking chain, electronic device and computer-readable storage medium provided by the present invention will not be described one by one. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A flowchart of a firmware logic vulnerability detection method based on a large language model thinking chain provided in one embodiment of the present invention.

[0028] Figure 2 A schematic diagram of a firmware logic vulnerability detection method based on a large language model thinking chain provided in accordance with an embodiment of the present invention.

[0029] Figure 3 A flowchart of a paradigm for obtaining sensitive control flows and business logic vulnerabilities provided by one embodiment of the present invention.

[0030] Figure 4 A flowchart of generating multi-level prompt words provided by one embodiment of the present invention.

[0031] Figure 5 A flowchart of obtaining logic vulnerability detection results based on the second largest language model provided by one embodiment of the present invention.

[0032] Figure 6 A structural block diagram of a firmware logic vulnerability detection system based on a large language model thinking chain provided in one embodiment of the present invention.

[0033] Figure 7 A structural block diagram of an electronic device provided in one embodiment of the present invention.

[0034] Among them, the figure marks are explained as follows: knowledge base construction module-110; knowledge graph construction module-120; retrieval enhancement module-130; multi-level prompt word generation module-140; business logic vulnerability analysis module-150; processor-210; communication interface-220; memory-230; communication bus-240. DETAILED DESCRIPTION

[0035] The following is a further detailed description of the firmware logic vulnerability detection method, system, electronic device and computer-readable storage medium based on the large language model thinking chain proposed in the present invention in combination with the accompanying drawings and specific embodiments. According to the following description, the advantages and features of the present invention will be clearer. It should be noted that the drawings are in a very simplified form and use non-precise proportions, which are only used to conveniently and clearly assist in explaining the purpose of the present invention. In order to make the purposes, features and advantages of the present invention more obvious and easy to understand, please refer to the accompanying drawings. It should be noted that the structures, proportions, sizes, etc. illustrated in the drawings of this specification are only used to match the contents disclosed in the specification for people familiar with this technology to understand and read, and are not used to limit the limiting conditions for the implementation of the present invention. Any modification of the structure, change in the proportional relationship or adjustment of the size, when the effects and purposes that can be achieved by the present invention are the same or similar, should still fall within the scope of the technical content disclosed by the present invention.

[0036] The core idea of ​​the present invention is to provide a firmware logic vulnerability detection method, system, electronic device and computer-readable storage medium based on a large language model thinking chain, which can realize the detection of various business logic vulnerabilities in the firmware of the Internet of Things terminal.

[0037] It should be noted that the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention can be applied to the firmware logic vulnerability detection system based on the large language model thinking chain provided by the present invention, and the firmware logic vulnerability detection system based on the large language model thinking chain can be configured on an electronic device, wherein the electronic device can be a personal computer, a mobile terminal, etc., and the mobile terminal can be a mobile phone, a tablet computer, and other hardware devices with various operating systems.

[0038] To realize the above idea, the present invention provides a firmware logic vulnerability detection method based on a large language model thinking chain, please refer to Figure 1 , which is a flow chart of a firmware logic vulnerability detection method based on a large language model thinking chain provided by an embodiment of the present invention. Figure 1 As shown, the firmware logic vulnerability detection method based on the large language model thinking chain includes the following steps S100 to S500.

[0039] Step S100: Use the first language model to process the collected firmware business program vulnerability data source to build a business logic vulnerability knowledge base, wherein the business logic vulnerability knowledge base includes vulnerability information summaries, vulnerability context information, vulnerability constraints, logic vulnerability paradigms and business functions corresponding to different types of business logic vulnerabilities.

[0040] Step S200, obtaining basic data of the firmware business program to be detected, and constructing a business object knowledge graph based on the basic data of the firmware business program to be detected, wherein the basic data includes function description, high-level function summary, loop summary, data dependency and program call graph.

[0041] Step S300: Based on the business logic vulnerability knowledge base, a retrieval enhancement generation algorithm is used to obtain sensitive control flows and business logic vulnerability paradigms corresponding to the firmware business program to be detected.

[0042] Step S400: Based on the business logic vulnerability paradigm and sensitive control flow corresponding to the firmware business program to be detected, the large language model thinking chain technology is used to decompose the reasoning process of the logic vulnerability and the related taint analysis process to iteratively generate multi-level prompt words corresponding to the logic vulnerability analysis steps.

[0043] Step S500: Based on the multi-level prompt words and the business object knowledge graph, a second language model is used to perform taint analysis to obtain a logic vulnerability detection result corresponding to the firmware business program to be detected.

[0044] Therefore, the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention can fully utilize the large language model's ability to understand the semantics of the vulnerability code by using the first large language model to process the collected firmware business program vulnerability data source, and construct a business logic vulnerability knowledge base covering the logic vulnerability paradigm of various typical business logic vulnerabilities, thereby ensuring that the present invention can detect various business logic vulnerabilities in the firmware of the Internet of Things terminal; by constructing a business object knowledge graph based on basic data such as the functional description, high-level function summary, loop summary, data dependency and program call graph of the firmware business program to be detected, the accuracy of the subsequent logic vulnerability detection results of the firmware business program to be detected can be further guaranteed; by using the retrieval enhancement generation algorithm based on the business logic vulnerability knowledge base, the sensitive control flow and business logic corresponding to the firmware business program to be detected are obtained. The service logic vulnerability paradigm can establish a high-dimensional mapping of control flow semantic representation and potential vulnerability types, so as to dynamically and adaptively provide a guiding example for the large language model thinking chain technology; by adopting the large language model thinking chain technology, the reasoning process of the logic vulnerability and the related taint analysis process are decomposed, and the multi-level prompts (Prompt) corresponding to the atomic operations of the call chain data flow tracking analysis and the security vulnerability existence judgment vulnerability analysis are generated, which can repeatedly iterate and promote the context learning and fine-tuning of the large language model; by using the second large language model for taint analysis based on the multi-level prompt words and the business object knowledge graph, the large language model can be driven to be able to gradually infer whether each node function of the sensitive control flow of the firmware business program to be detected violates the security policy according to the taint analysis steps, so as to effectively ensure the accuracy of the logic vulnerability detection results of the firmware business program to be detected. In summary, it can be seen that by adopting the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention, the ability of the large language model to understand, analyze and discover the logic vulnerabilities of the firmware business program of the Internet of Things terminal can be effectively promoted.

[0045] Please continue to refer to Figure 2 , which is a schematic diagram of a firmware logic vulnerability detection method based on a large language model thinking chain provided by an embodiment of the present invention. Figure 2 As shown in the figure, we can collect logical vulnerability cases of IoT terminal firmware business programs (i.e. firmware business program vulnerability data sources, i.e. multi-source vulnerability information) from public vulnerability databases (such as CVE, NVD, CNVD, etc.), open source projects (such as security vulnerability datasets ReposVul, etc.), patches and PoC (vulnerability verification programs), covering common security vulnerabilities such as unauthorized access and information leakage. It should be noted that Figure 2 The "Source" in the figure represents the taint source; the "Sink" represents the taint sink.

[0046] Furthermore, based on the information collected above (i.e., the firmware business program vulnerability data source), the first language model (such as ChatGPT, Claude, DeepSeek) can be used to normalize the vulnerability descriptions, vulnerability source code contexts, vulnerability patches, and security vulnerability detection rule bases in the public vulnerability database to summarize the different source information of the vulnerability.

[0047] Based on vulnerability-related patches and PoC (vulnerability verification program), the first language model is used to understand the vulnerability principle at the code semantic level to generate a comprehensive vulnerability information summary, understand the vulnerability logic at the business level to generate accurate business constraints, and build a logical vulnerability paradigm. This paradigm contains vulnerability code semantic information such as code functions related to logical vulnerabilities, attributes or operations of vulnerability codes, etc. The vulnerability information summaries, vulnerability context information, vulnerability constraints, logical vulnerability paradigms and business functions corresponding to different types of business logic vulnerabilities are uniformly stored in the business logic vulnerability knowledge base to build a business logic vulnerability knowledge base.

[0048] Furthermore, the vulnerability summary is a brief and concise summary of the key information of the vulnerability. It usually includes the type of vulnerability (such as SQL injection, cross-site scripting attack, buffer overflow, etc.), the severity of the vulnerability (such as low, medium, high, critical), the affected system or component, and the main consequences that the vulnerability may cause (such as data leakage, system crash, privilege escalation, etc.).

[0049] Business functions refer to the specific business operations or services involved in the code containing vulnerabilities in the entire business system. It describes the tasks that this part of the code should have completed from a business perspective, such as user registration, order processing, data query and other specific business processes.

[0050] Vulnerability constraints refer to the limiting factors on the functional module where the vulnerability code is located during the code implementation and business operation process. These restrictions may come from business rules, security policies, performance requirements, compatibility requirements, etc. For example, the password length must be between 8 and 16 characters, the file upload size cannot exceed 2MB, and the system must be compatible with a specific version of the browser.

[0051] Vulnerability context information refers to the broader information environment related to the vulnerability, including the system architecture where the vulnerable code is located, other modules that interact with it, the environment in which the code runs (such as the operating system, database system, etc.), and the location and conditions in the business process where the vulnerability is triggered. It provides a more comprehensive perspective to help understand how the vulnerability is integrated into the entire system and under what circumstances it will be exploited.

[0052] In some exemplary embodiments, obtaining basic data of the firmware business program to be detected includes: using a static analysis tool to analyze the source code or decompiled code of the firmware business program to be detected to obtain a static analysis result corresponding to the firmware business program to be detected, and the static analysis result includes data flow and control flow; using a third language model to analyze the source code or decompiled code of the firmware business program to be detected to obtain a large model analysis result corresponding to the firmware business program to be detected, and the large model analysis result includes a vulnerability associated function summary, business function, business scenario and description information; combining the static analysis result corresponding to the firmware business program to be detected and the large model analysis result to obtain the basic data of the firmware business program to be detected.

[0053] Therefore, by combining the static analysis results corresponding to the firmware business program to be tested with the large model analysis results, the basic data such as the functional description, high-level function summary, loop summary, data dependency and program call graph of the firmware business program to be tested can be obtained, so as to further ensure the accuracy of the constructed business object knowledge graph and lay a good foundation for the subsequent acquisition of accurate logic vulnerability detection results.

[0054] Specifically, the third language model (such as DeepSeek) can be used to automatically analyze the source code or disassembled code (decompiled code) of the firmware business program to be tested, and automatically identify and extract the functions of each function in the code, especially the vulnerability-related functions (functions where vulnerabilities often occur, such as logical judgment functions), analyze each code block, especially the business scenarios related to the vulnerability (such as the application scenario of the authentication function), and generate vulnerability-related function summaries, business functions, business scenarios and description information (including vulnerability descriptions, business function descriptions and business scenario descriptions). At the same time, static analysis tools are used to analyze the above-mentioned firmware business program to be tested to generate key information such as data flow and control flow.

[0055] Please continue to refer to Figure 3 , which is a flow chart of obtaining sensitive control flow and business logic vulnerability paradigms provided by an embodiment of the present invention. Figure 3 As shown, in some exemplary embodiments, the step S300, based on the business logic vulnerability knowledge base, adopts a retrieval enhancement generation algorithm to obtain the sensitive control flow and business logic vulnerability paradigm corresponding to the firmware business program to be detected, including the following steps S310 to S330.

[0056] Step S310: Based on the source code or decompiled code of the firmware business program to be detected, a search is performed in a pre-created vector database through a search enhancement generation algorithm to obtain a target vulnerability report associated with a target logical vulnerability in the firmware business program to be detected and a corresponding target vulnerability code.

[0057] Step S320: Perform code semantic description on the target vulnerability code to construct a business logic vulnerability paradigm corresponding to the target logic vulnerability.

[0058] Step S330: performing similarity matching on the business logic vulnerability pattern in the business logic vulnerability knowledge base to obtain a vulnerability function summary and a sensitive control flow corresponding to the target logic vulnerability.

[0059] Therefore, by using the retrieval-augmented generation algorithm (RAG) to search in a pre-created vector database, the accuracy of the target vulnerability report associated with the target logical vulnerability and the corresponding target vulnerability code can be effectively guaranteed, thereby ensuring the accuracy of the obtained vulnerability function summary and sensitive control flow information, thereby laying a good foundation for obtaining accurate logical vulnerability detection results in the future.

[0060] Specifically, the process of creating a vector database includes: first, based on the firmware business program vulnerability data source mentioned above, the vulnerability reports and corresponding vulnerability codes generated after the firmware business program is detected are collected. These vulnerability reports record in detail the various vulnerability information existing in the business object program (firmware business program), including descriptions of the vulnerability type, location, potential impact, etc. The corresponding vulnerability code specifically points to the program code fragment with the vulnerability, providing a key basis for further analysis and processing of the vulnerability.

[0061] Then, we vectorize the vulnerability reports and vulnerability codes collected above. In the process of vectorization, we use natural language processing technology and code analysis algorithms to transform the text information in the vulnerability reports and the structural and semantic features of the vulnerability codes into high-dimensional vector representations. This vectorization process can effectively capture the essential features of vulnerability reports and vulnerability codes, allowing them to be efficiently stored and retrieved in the vector space.

[0062] Finally, the vectorized vulnerability reports and vulnerability codes are stored in a dedicated vector database. This vector database has efficient data storage and retrieval capabilities, and can quickly respond to subsequent queries and analysis needs for vulnerability information. The vulnerability reports and vulnerability code vectors stored in the vector database can be easily associated and analyzed with other related data, providing strong support for vulnerability repair and security reinforcement of business object programs.

[0063] When the target code segment in the source code or decompiled code of the firmware business program to be detected is retrieved, the most similar code segment (target vulnerability code) can be directly searched in the vector database and associated with the corresponding vulnerability (target logical vulnerability). After the target code segment is retrieved, the associated vulnerability report (target vulnerability report) can be used as the basic vulnerability knowledge for subsequent analysis.

[0064] Based on the vulnerability code (target vulnerability code) retrieved above, the code semantics (e.g., code function summary, data dependency, and sensitive control flow information) are used to describe the vulnerability and construct a business logic vulnerability paradigm. The paradigm includes vulnerability code semantic information such as code functions that may cause logic vulnerabilities, attributes or operations of vulnerability codes, etc. Then, by matching similar logic vulnerability paradigms in the business logic vulnerability knowledge base (when constructing the logic vulnerability paradigm in the business logic vulnerability knowledge base, the association between the logic vulnerability paradigm and the vulnerability function summary and sensitive control flow is established), the function summary (vulnerability function summary) and sensitive control flow of the business logic vulnerability (i.e., the target logic vulnerability) can be obtained.

[0065] In some exemplary embodiments, the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention also includes: based on the target vulnerability report, searching in the business logic vulnerability knowledge base to obtain the vulnerability information summary, business function, vulnerability constraint conditions and vulnerability context information that matches the target logic vulnerability.

[0066] Specifically, the associated vulnerability (target logical vulnerability) can be retrieved based on the vulnerability name and vulnerability number in the target vulnerability report, thereby obtaining the vulnerability information summary, business function, constraint conditions and vulnerability context information matching the target logical vulnerability in the vulnerability knowledge base.

[0067] Please continue to refer to Figure 4 , which is a flow chart of generating multi-level prompt words provided by one embodiment of the present invention. Figure 4 As shown, in some exemplary embodiments, the step S400, based on the business logic vulnerability paradigm and sensitive control flow corresponding to the firmware business program to be detected, adopts the large language model thinking chain technology to decompose the reasoning process of the logic vulnerability and the related taint analysis process to iteratively generate multi-level prompt words corresponding to the logic vulnerability analysis steps, including the following steps S410 and S420.

[0068] Step S410: Based on the business logic vulnerability paradigm and sensitive control flow corresponding to the firmware business program to be detected, as well as the vulnerability information summary, business function, vulnerability constraint conditions and vulnerability context information matching the target logic vulnerability, the large language model thinking chain technology is used to decompose the reasoning process of the logic vulnerability and the related taint analysis process.

[0069] Step S420, iteratively generate multi-level prompt words corresponding to function call chain taint tracking analysis, security vulnerability judgment and constraint solving.

[0070] Therefore, by using the vulnerability information summary, business function, vulnerability constraint conditions and vulnerability context information retrieved from the business logic vulnerability knowledge base, as well as the business logic vulnerability paradigm, vulnerability function summary and sensitive control flow corresponding to the firmware business program to be detected, and utilizing the automated thinking chain to decompose the logical vulnerability reasoning and related taint analysis process, multi-level prompt words corresponding to common vulnerability analysis steps such as function call chain taint tracking analysis, security vulnerability judgment, and constraint solving can be effectively iterated to generate multi-level prompt words corresponding to common vulnerability analysis steps such as function call chain taint tracking analysis, security vulnerability judgment, and constraint solving, so that the prompt words can be used in the large language model to extract relevant functional features such as the business logic of the vulnerability, and then accurately obtain the functional background of the vulnerability code.

[0071] Specifically, due to the large differences in vulnerability paradigms of different business logic vulnerabilities, different chains of thought should be established for different types of business logic vulnerabilities. For example, a missing authentication vulnerability refers to a system or application that does not implement any authentication mechanism, resulting in users or attackers being able to directly access certain sensitive resources or perform certain operations without verifying their identity or permissions; an authentication bypass vulnerability refers to a system or application that has an authentication mechanism, but due to design or implementation defects, attackers can bypass permission checks through specific means and access or operate resources that are not within their authority.

[0072] In some exemplary embodiments, the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention also includes: using the first large language model to analyze the target vulnerability report to obtain a functional description of the target vulnerability code associated with the target logic vulnerability and the root cause of the target logic vulnerability.

[0073] The functional description of the target vulnerability code refers to the description of the tasks and responsibilities of the vulnerable code in the entire program system. It mainly describes the functions that the code should achieve when it runs normally, including how the code receives input, how it processes the input, how it interacts with other components (such as databases, external interfaces, etc.), and what kind of output it finally produces.

[0074] The root cause of the vulnerability is defects in the design, implementation or configuration of the code. These defects allow attackers to exploit the system's vulnerabilities to achieve unintended purposes, such as obtaining sensitive information, performing malicious operations, etc.

[0075] Please continue to refer to Figure 5 , which is a flow chart of obtaining logic vulnerability detection results based on the second largest language model provided by one embodiment of the present invention. Figure 5 As shown, in some exemplary embodiments, the step S500, based on the multi-level prompt words and the business object knowledge graph, uses a second language model to perform taint analysis to obtain the logic vulnerability detection result corresponding to the firmware business program to be detected, including the following steps S510 to S530.

[0076] Step S510: Input the functional description of the target vulnerability code and the root cause of the target logical vulnerability into the second largest language model.

[0077] Step S520: input the multi-level prompt words, the business object knowledge graph, the sensitive control flow, and the data flow corresponding to the firmware business program to be detected into the second language model in sequence.

[0078] Step S530: Use a taint analysis algorithm to gradually infer whether each node function in the sensitive control flow violates the security policy, so as to obtain a logic vulnerability detection result corresponding to the firmware business program to be detected.

[0079] Therefore, by inputting the functional description of the target vulnerability code and the root cause of the target logical vulnerability into the second largest language model (such as Llama3), the second largest language model can be helped to better understand the logical vulnerability to be analyzed; by inputting the multi-level prompt words, the business object knowledge graph, the sensitive control flow and the data flow corresponding to the firmware business program to be detected into the second largest language model in sequence, the large language model can be used to perform step-by-step reasoning on each node function in the sensitive control flow according to the taint analysis steps to determine whether it violates the security policy, thereby effectively ensuring the accuracy of the obtained logical vulnerability detection results.

[0080] Specifically, the logic vulnerability detection results output by the second largest language model include vulnerability location, vulnerability type, vulnerability verification procedure (PoC) and vulnerability principle.

[0081] Furthermore, the contextual business features of the vulnerability location can be extracted based on the multi-level prompt words, and combined with the existing vulnerability information in the public dataset to form a complete vulnerability sample dataset, so that the large language model can autonomously locate the vulnerability and repair the vulnerability code when responding to vulnerability attacks.

[0082] Based on the same inventive concept, the present invention also provides a firmware logic vulnerability detection system based on a large language model thinking chain, please refer to Figure 6 , which is a structural block diagram of a firmware logic vulnerability detection system based on a large language model thinking chain provided by an embodiment of the present invention. Figure 6As shown, the firmware logic vulnerability detection system based on the large language model thinking chain provided by the present invention includes a knowledge base construction module 110, a knowledge graph construction module 120, a retrieval enhancement module 130, a multi-level prompt word generation module 140 and a business logic vulnerability analysis module 150, wherein the knowledge base construction module 110 is configured to use the first large language model to process the collected firmware business program vulnerability data source to construct a business logic vulnerability knowledge base, wherein the business logic vulnerability knowledge base includes vulnerability information summaries, vulnerability context information, vulnerability constraints, logic vulnerability paradigms and business functions corresponding to different types of business logic vulnerabilities; the knowledge graph construction module 120 is configured to construct a business object knowledge graph according to the basic data of the firmware business program to be detected, wherein the basic data includes function descriptions, high-level function summaries, and high-level function summaries. , loop summary, data dependency and program call graph; the retrieval enhancement module 130 is configured to obtain the sensitive control flow and business logic vulnerability paradigm corresponding to the firmware business program to be detected based on the business logic vulnerability knowledge base by adopting the retrieval enhancement generation algorithm; the multi-level prompt word generation module 140 is configured to decompose the reasoning process of the logic vulnerability and the related taint analysis process based on the business logic vulnerability paradigm and sensitive control flow corresponding to the firmware business program to be detected by adopting the large language model thinking chain technology to iteratively generate multi-level prompt words corresponding to the logic vulnerability analysis steps; the business logic vulnerability analysis module 150 is configured to perform taint analysis based on the multi-level prompt words and the business object knowledge graph by adopting the second largest language model to obtain the logic vulnerability detection result corresponding to the firmware business program to be detected.

[0083] It should be noted that the firmware logic vulnerability detection system based on the large language model thinking chain provided by the present invention can be used to execute the firmware logic vulnerability detection method based on the large language model thinking chain described above. The technical principles, technical problems solved and technical effects produced by the two are similar. Technical personnel in this technical field can clearly understand that for the convenience and conciseness of description, for more content about the firmware logic vulnerability detection system based on the large language model thinking chain provided by the present invention, please refer to the content described above about the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention, which will not be repeated here.

[0084] Based on the same inventive concept, the present invention also provides an electronic device, please refer to Figure 7 , which is a structural block diagram of an electronic device provided by an embodiment of the present invention. Figure 7As shown, the electronic device may include: a processor 210, a communication interface 220, a memory 230 and a communication bus 240, wherein the processor 210, the communication interface 220, and the memory 230 communicate with each other through the communication bus 240. The processor 210 can call the computer program in the memory 230 to execute the firmware logic vulnerability detection method based on the large language model thinking chain described above. Since the electronic device provided by the present invention and the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention belong to the same inventive concept, the electronic device provided by the present invention at least has all the beneficial effects of the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention. For details, please refer to the relevant description above, so the beneficial effects of the electronic device provided by the present invention will not be repeated here.

[0085] It should be noted that the computer program in the memory 230 can be implemented in the form of a software functional unit and sold or used as an independent product, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the firmware logic vulnerability detection method based on the large language model thinking chain described in the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

[0086] Based on the same inventive concept, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the firmware logic vulnerability detection method based on the large language model thinking chain described above. Since the computer-readable storage medium provided by the present invention and the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention belong to the same inventive concept, the computer-readable storage medium provided by the present invention at least has all the beneficial effects of the firmware logic vulnerability detection method based on the large language model thinking chain provided by the present invention. For details, please refer to the relevant description above, so the beneficial effects of the computer-readable storage medium provided by the present invention will not be repeated one by one.

[0087] In summary, compared with the prior art, the firmware logic vulnerability detection method, system, electronic device and computer-readable storage medium based on the large language model thinking chain provided by the present invention have the following beneficial effects: the present invention uses the first large language model to process the collected firmware business program vulnerability data source, which can make full use of the large language model's ability to understand the semantics of the vulnerability code, and construct a business logic vulnerability knowledge base covering the logic vulnerability paradigm of various typical business logic vulnerabilities, thereby ensuring that the present invention can detect various business logic vulnerabilities in the IoT terminal firmware; by constructing a business object knowledge graph based on basic data such as the functional description, high-level function summary, loop summary, data dependency and program call graph of the firmware business program to be detected, the accuracy of the subsequent logic vulnerability detection results of the firmware business program to be detected can be further guaranteed; by using the retrieval enhancement generation algorithm based on the business logic vulnerability knowledge base, the business logic vulnerability knowledge base is obtained. The sensitive control flow and business logic vulnerability paradigm corresponding to the firmware business program to be detected can establish a high-dimensional mapping of control flow semantic representation and potential vulnerability types, so as to dynamically and adaptively provide a guiding example for the large language model thinking chain technology; by adopting the large language model thinking chain technology, the reasoning process of logical vulnerabilities and the related taint analysis process are decomposed, and multi-level prompts (Prompts) corresponding to the atomic operations of call chain data flow tracking analysis and security vulnerability existence judgment vulnerability analysis are generated, which can repeatedly iterate and promote the context learning and fine-tuning of the large language model; by using the second large language model for taint analysis based on the multi-level prompt words and the business object knowledge graph, the large language model can be driven to gradually infer whether each node function of the sensitive control flow of the firmware business program to be detected violates the security policy according to the taint analysis steps, thereby effectively ensuring the accuracy of the logic vulnerability detection results of the firmware business program to be detected.

[0088] It should be noted that the computer program code for performing the operation of the present invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0089] It should be noted that the devices and methods disclosed in the embodiments of this article can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to the multiple embodiments of this article. In this regard, each box in the flowchart or block diagram can represent a module, a part of a program or a code, and the module, a part of a program segment or a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of boxes in the block diagram and / or the flowchart, can be implemented by a dedicated hardware-based system for performing a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions. In addition, the functional modules in the various embodiments of this document may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

[0090] It should also be noted that the above description is only a description of the preferred embodiment of the present invention, and is not any limitation on the scope of the present invention. Any changes and modifications made by a person skilled in the art in the field of the present invention based on the above disclosure are within the scope of protection of the present invention. Obviously, a person skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations fall within the scope of the present invention and its equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A firmware logic vulnerability detection method based on a large language model thinking chain, characterized in that: include: The first language model is used to process the collected firmware business program vulnerability data source to construct a business logic vulnerability knowledge base, wherein the business logic vulnerability knowledge base includes vulnerability information summaries, vulnerability context information, vulnerability constraints, logic vulnerability paradigms, and business functions corresponding to different types of business logic vulnerabilities; Obtain basic data of the firmware business program to be detected, and construct a business object knowledge graph based on the basic data of the firmware business program to be detected, wherein the basic data includes function description, high-level function summary, loop summary, data dependency and program call graph; Based on the business logic vulnerability knowledge base, a retrieval enhancement generation algorithm is used to obtain the sensitive control flow and business logic vulnerability paradigm corresponding to the firmware business program to be detected; Based on the business logic vulnerability paradigm and sensitive control flow corresponding to the firmware business program to be detected, the large language model thinking chain technology is used to decompose the reasoning process of the logic vulnerability and the related taint analysis process to iteratively generate multi-level prompt words corresponding to the logic vulnerability analysis steps; Based on the multi-level prompt words and the business object knowledge graph, a second language model is used to perform taint analysis to obtain a logic vulnerability detection result corresponding to the firmware business program to be detected.

2. The firmware logic vulnerability detection method based on large language model thinking chain according to claim 1 is characterized in that: The step of obtaining basic data of the firmware service program to be detected includes: Using a static analysis tool to analyze the source code or decompiled code of the firmware service program to be detected to obtain a static analysis result corresponding to the firmware service program to be detected, wherein the static analysis result includes a data flow and a control flow; Using a third language model to analyze the source code or decompiled code of the firmware business program to be detected, so as to obtain a large model analysis result corresponding to the firmware business program to be detected, wherein the large model analysis result includes a vulnerability associated function summary, business function, business scenario and description information; The static analysis result corresponding to the firmware business program to be detected is combined with the large model analysis result to obtain basic data of the firmware business program to be detected.

3. The firmware logic vulnerability detection method based on large language model thinking chain according to claim 1 is characterized in that: The method of obtaining the sensitive control flow and business logic vulnerability paradigm corresponding to the firmware business program to be detected by using a retrieval enhancement generation algorithm based on the business logic vulnerability knowledge base includes: Based on the source code or decompiled code of the firmware business program to be detected, a search is performed in a pre-created vector database through a search enhancement generation algorithm to obtain a target vulnerability report associated with a target logical vulnerability in the firmware business program to be detected and a corresponding target vulnerability code; Performing code semantic description on the target vulnerability code to construct a business logic vulnerability paradigm corresponding to the target logic vulnerability; The business logic vulnerability paradigm is similarly matched in the business logic vulnerability knowledge base to obtain the vulnerability function summary and sensitive control flow corresponding to the target logic vulnerability.

4. The firmware logic vulnerability detection method based on large language model thinking chain according to claim 3 is characterized in that: The method further comprises: Based on the target vulnerability report, a search is performed in the business logic vulnerability knowledge base to obtain vulnerability information summaries, business functions, vulnerability constraints, and vulnerability context information that match the target logic vulnerability.

5. The firmware logic vulnerability detection method based on large language model thinking chain according to claim 4 is characterized in that: Based on the business logic vulnerability paradigm and sensitive control flow corresponding to the firmware business program to be detected, the large language model thinking chain technology is used to decompose the reasoning process of the logic vulnerability and the related taint analysis process to iteratively generate multi-level prompt words corresponding to the logic vulnerability analysis steps, including: According to the business logic vulnerability paradigm and sensitive control flow corresponding to the firmware business program to be detected, as well as the vulnerability information summary, business function, vulnerability constraint conditions and vulnerability context information matching the target logic vulnerability, the large language model thinking chain technology is used to decompose the reasoning process of the logic vulnerability and the related taint analysis process; Iteratively generate multi-level prompt words corresponding to function call chain taint tracking analysis, security vulnerability judgment and constraint solving.

6. The firmware logic vulnerability detection method based on large language model thinking chain according to claim 4 is characterized in that: The method further comprises: The target vulnerability report is analyzed using the first language model to obtain a functional description of a target vulnerability code associated with the target logic vulnerability and a root cause of the target logic vulnerability.

7. The firmware logic vulnerability detection method based on large language model thinking chain according to claim 6 is characterized in that: The method of performing taint analysis based on the multi-level prompt words and the business object knowledge graph using the second largest language model to obtain a logic vulnerability detection result corresponding to the firmware business program to be detected includes: Inputting the functional description of the target vulnerability code and the root cause of the target logic vulnerability into the second largest language model; Inputting the multi-level prompt words, the business object knowledge graph, the sensitive control flow, and the data flow corresponding to the firmware business program to be detected into the second language model in sequence; A taint analysis algorithm is used to gradually infer whether each node function in the sensitive control flow violates the security policy, so as to obtain the logic vulnerability detection result corresponding to the firmware business program to be detected.

8. A firmware logic vulnerability detection system based on a large language model thinking chain, characterized in that: include: A knowledge base construction module is configured to process the collected firmware business program vulnerability data source using the first language model to construct a business logic vulnerability knowledge base, wherein the business logic vulnerability knowledge base includes vulnerability information summaries, vulnerability context information, vulnerability constraints, logic vulnerability paradigms, and business functions corresponding to different types of business logic vulnerabilities; A knowledge graph construction module is configured to construct a business object knowledge graph based on basic data of the firmware business program to be detected, wherein the basic data includes function description, high-level function summary, loop summary, data dependency and program call graph; A retrieval enhancement module is configured to obtain the sensitive control flow and business logic vulnerability paradigm corresponding to the firmware business program to be detected by using a retrieval enhancement generation algorithm based on the business logic vulnerability knowledge base; A multi-level prompt word generation module is configured to use a large language model thinking chain technology to decompose the reasoning process of the logic vulnerability and the related taint analysis process based on the business logic vulnerability paradigm and sensitive control flow corresponding to the firmware business program to be detected, so as to iteratively generate multi-level prompt words corresponding to the logic vulnerability analysis steps; as well as The business logic vulnerability analysis module is configured to perform taint analysis using a second language model based on the multi-level prompt words and the business object knowledge graph to obtain a logic vulnerability detection result corresponding to the firmware business program to be detected.

9. An electronic device, characterized in that: It includes a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the firmware logic vulnerability detection method based on the large language model thinking chain as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the firmware logic vulnerability detection method based on a large language model thinking chain as described in any one of claims 1 to 7 is implemented.

Images