Automatic security vulnerability detection method and system for multi-type scripts in embedded system, electronic equipment and readable storage medium

Abstract

The invention provides an automatic security vulnerability detection method and system for multiple types of scripts in an embedded system, electronic equipment and a readable storage medium, the method comprises the following steps: unpacking and analyzing firmware of a to-be-detected embedded system to identify a script file and a template file; identifying a dependency relationship between script files and template files and interaction and dependency relationships between different types of script files, marking sensitive input source points and potential vulnerability sink points, and generating a control flow graph and an abstract syntax tree by adopting a context-sensitive control flow analysis algorithm; constructing a power set lattice according to an assignment statement in the control flow graph, and performing data flow analysis by using a fixed point algorithm to obtain a data flow constraint relationship; and performing taint analysis to identify all dangerous execution paths. The script security vulnerability can be automatically identified, the security of the embedded system in the script execution process is improved, and potential security threats are effectively prevented.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security technology, and in particular to an automated security vulnerability detection method, system, electronic device and readable storage medium for multiple types of scripts in an embedded system. Background Art

[0002] With the rapid development of Internet of Things (IoT) technology, embedded systems have been widely used in various intelligent devices, covering a variety of fields from home automation, intelligent transportation to industrial control. These embedded systems usually need to process a large amount of external input data, including user instructions, communication information between devices, etc. In order to achieve flexible function expansion and device interaction, embedded systems often use various scripting languages ​​for configuration and control. Although these scripting languages ​​improve the programmability and adaptability of the system, they also bring potential security risks to the system.

[0003] Traditional embedded system security protection methods focus on hardware-level protection or static code analysis, but these methods often lack effective vulnerability detection methods when facing dynamically executed scripts. Especially in the process of processing multiple types of scripts, how to identify and prevent attacks through script injection, malicious script tampering, etc. has become an important challenge facing embedded system security.

[0004] At present, although there are some security detection technologies for embedded systems, most methods still rely on manual review and static analysis tools, lack automation and efficiency, and are difficult to fully cover all potential security risks in a dynamic environment with multiple script types. Therefore, how to design a method that can automatically identify script security vulnerabilities has become a key issue that urgently needs to be solved in the field of embedded system security.

[0005] It should be noted that the information disclosed in the background technology section of the invention is only intended to deepen the understanding of the general background technology of the invention, and should not be regarded as an admission or suggestion in any form that the information constitutes prior art already known to those skilled in the art. Summary of the invention

[0006] The purpose of the present invention is to provide an automated security vulnerability detection method, system, electronic device and readable storage medium for multiple types of scripts in an embedded system, which can automatically identify script security vulnerabilities, improve the security of the embedded system during script execution, and effectively prevent potential security threats, especially for complex system environments with multiple script types.

[0007] To achieve the above-mentioned purpose, the present invention provides an automated security vulnerability detection method for multiple types of scripts in an embedded system, comprising: unpacking and analyzing the firmware of the embedded system to be detected to identify the script files and template files in the firmware; identifying the dependency relationship between the script file and the template file and the interaction and dependency relationship between different types of script files, and based on the dependency relationship between the script file and the template file and the interaction and dependency relationship between different types of script files, marking the sensitive input source points and potential vulnerability sink points in the script file and the template file, and using a context-sensitive control flow analysis algorithm to generate a control flow graph and an abstract syntax tree; constructing a power set lattice according to the assignment statements in the control flow graph, and using a fixed point algorithm to perform data flow analysis to obtain the data flow constraint relationship between each node in the control flow graph; performing taint analysis based on the control flow graph, the abstract syntax tree and the data flow constraint relationship to identify all dangerous execution paths from the sensitive input source points to the potential vulnerability sink points, thereby obtaining a security vulnerability detection result.

[0008] Optionally, the firmware of the embedded system to be detected is unpacked and analyzed to identify script files and template files in the firmware, including: using a firmware analysis tool to scan and parse the firmware image of the embedded system to be detected to extract the file system in the firmware, and using directory scanning and file suffix matching technology to identify script files and template files in the file system; using a dynamic behavior simulation algorithm to analyze files dynamically loaded in the firmware to identify script files.

[0009] Optionally, the identifying of the dependency relationship between the script file and the template file and the interaction and dependency relationship between different types of script files includes: dynamically reconstructing the dependency relationship between the script file and the template file based on a multi-dimensional collaborative analysis mechanism; and constructing a unified syntax and execution semantic model for different types of script files to identify the interaction and dependency relationship between different types of script files.

[0010] Optionally, the sensitive input sources include external input data, API interface parameters, and environment variables.

[0011] Optionally, the use of a context-sensitive control flow analysis algorithm to generate a control flow graph and an abstract syntax tree includes: performing lexical analysis and syntactic analysis on the script file to generate an abstract syntax tree; traversing the abstract syntax tree to extract all function calls, and for each function call, using a context-sensitive control flow analysis algorithm to create an independent function call copy for it, thereby generating a control flow graph.

[0012] Optionally, the fixed point algorithm is used to perform data flow analysis to obtain the data flow constraint relationship between each node in the control flow graph, including: using data flow constraint equations to describe the data transfer relationship between each node in the control flow graph; according to the data transfer relationship between each node in the control flow graph, using the fixed point algorithm to perform iterative calculations until the data flow constraint relationship converges.

[0013] Optionally, the taint analysis is performed based on the control flow graph, the abstract syntax tree and the data flow constraint relationship to identify all dangerous execution paths from the sensitive input source point to the potential vulnerability sink point, including: describing the code structure and execution path based on the control flow graph and the abstract syntax tree; tracking the data propagated by the sensitive input source point according to the data flow constraint relationship to identify all dangerous execution paths from the sensitive input source point to the potential vulnerability sink point.

[0014] Optionally, the security vulnerability detection results include vulnerability occurrence time, taint sources, taint convergence points and related data flow paths; the automated security vulnerability detection method for multi-type scripts in embedded systems provided by the present invention also includes: organizing the vulnerability occurrence time, taint sources, taint convergence points and related data flow paths in the security vulnerability detection results into entry form, and displaying them on the front-end interface.

[0015] To achieve the above-mentioned purpose, the present invention also provides an automated security vulnerability detection system for multiple types of scripts in an embedded system, comprising: a firmware parsing module, configured to unpack and analyze the firmware of the embedded system to be detected, so as to identify the script files and template files in the firmware; a dependency and data flow reconstruction module, configured to identify the dependency between the script file and the template file and the interaction and dependency between different types of script files, and based on the dependency between the script file and the template file and the interaction and dependency between different types of script files, mark the script file and the template file. The sensitive input source points and potential vulnerability sink points in the template file are detected, and a context-sensitive control flow analysis algorithm is used to generate a control flow graph and an abstract syntax tree; a data flow constraint relationship analysis module is configured to construct a power set lattice according to the assignment statements in the control flow graph, and use a fixed point algorithm to perform data flow analysis to obtain the data flow constraint relationship between each node in the control flow graph; and a taint analysis module is configured to perform taint analysis based on the control flow graph, the abstract syntax tree and the data flow constraint relationship to identify all dangerous execution paths from the sensitive input source points to the potential vulnerability sink points, thereby obtaining security vulnerability detection results.

[0016] To achieve the above-mentioned purpose, the present invention also provides an electronic device, including a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the above-mentioned automated security vulnerability detection method for multiple types of scripts in an embedded system is implemented.

[0017] To achieve the above-mentioned object, the present invention also provides a readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the above-mentioned automated security vulnerability detection method for multiple types of scripts in an embedded system is implemented.

[0018] Compared with the prior art, the method, system, electronic device and readable storage medium for automatic security vulnerability detection of multiple types of scripts in embedded systems provided by the present invention have the following beneficial effects: The automated security vulnerability detection method for multiple types of scripts in embedded systems provided by the present invention can fully cover multiple types of scripts in embedded systems and identify potential security risks, avoiding the risk of missing vulnerabilities. In addition, the present invention can effectively capture static vulnerabilities and dynamic vulnerabilities by adopting a context-sensitive control flow analysis algorithm and accurate data flow modeling and tracking, thereby improving the accuracy and comprehensiveness of vulnerability detection. Unlike the existing static analysis method, the taint analysis technology in the present invention can automatically identify the dangerous execution path from the sensitive input source point to the potential vulnerability sink point, significantly improving the efficiency of vulnerability analysis. At the same time, the present invention can cross the interaction between different types of scripts, dig out complex vulnerability hazards, and solve the problem that vulnerability detection in the prior art has certain limitations. In addition, the present invention has efficient cross-script type vulnerability detection capabilities, and is easy to deploy and expand, and can be quickly integrated into existing development and testing processes, reducing labor costs and improving adaptability. In summary, it can be seen that by adopting the automated security vulnerability detection method for multiple types of scripts in embedded systems provided by the present invention, script security vulnerabilities can be automatically identified, and the effect of embedded system security vulnerability detection can be significantly improved, thereby effectively improving the security of embedded systems during script execution, effectively preventing potential security threats, and providing a strong guarantee for the security of embedded systems.

[0019] Since the automated security vulnerability detection system, electronic device and readable storage medium for multiple types of scripts in an embedded system provided by the present invention and the automated security vulnerability detection method for multiple types of scripts in an embedded system provided by the present invention belong to the same inventive concept, the automated security vulnerability detection system, electronic device and readable storage medium for multiple types of scripts in an embedded system provided by the present invention at least have all the beneficial effects of the automated security vulnerability detection method for multiple types of scripts in an embedded system provided by the present invention. For details, please refer to the relevant description above. Therefore, the beneficial effects of the automated security vulnerability detection system, electronic device and readable storage medium for multiple types of scripts in an embedded system provided by the present invention will not be described one by one. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A flowchart of an automated security vulnerability detection method for multiple types of scripts in an embedded system provided by one embodiment of the present invention.

[0021] Figure 2 A structural block diagram of an automated security vulnerability detection system for multiple types of scripts in an embedded system provided by one embodiment of the present invention.

[0022] Figure 3 A structural block diagram of an electronic device provided in one embodiment of the present invention.

[0023] The reference numerals are as follows: firmware parsing module-110; dependency and data flow reconstruction module-120; data flow constraint relationship analysis module-130; taint analysis module-140; processor-210; communication interface-220; memory-230; communication bus-240. DETAILED DESCRIPTION

[0024] The following is a further detailed description of the automated security vulnerability detection method, system, electronic device and readable storage medium for multiple types of scripts in embedded systems proposed by the present invention in combination with the accompanying drawings and specific embodiments. According to the following description, the advantages and features of the present invention will be clearer. It should be noted that the accompanying drawings are in a very simplified form and use non-precise proportions, which are only used to conveniently and clearly assist in explaining the purpose of the present invention. In order to make the purpose, features and advantages of the present invention more obvious and easy to understand, please refer to the accompanying drawings. It should be noted that the structure, proportion, size, etc. illustrated in the accompanying drawings of this specification are only used to match the content disclosed in the specification for people familiar with this technology to understand and read, and are not used to limit the limiting conditions for the implementation of the present invention. Any modification of the structure, change of the proportional relationship or adjustment of the size, in the case of the same or similar effects and purposes that can be achieved by the present invention, should still fall within the scope of the technical content disclosed by the present invention.

[0025] In order to facilitate understanding, the research background of the present invention is first described.

[0026] Static analysis is a technique that discovers potential security issues by analyzing source code, bytecode, or other program representations without executing the program. For security vulnerability detection in embedded systems, static analysis can help identify potential vulnerabilities in the code, such as buffer overflows, resource leaks, unvalidated input, etc. By analyzing the structure and control flow of the source code, static analysis can discover security risks without running the program.

[0027] The basic process of static analysis includes steps such as code abstraction, vulnerability pattern matching, data flow analysis, and symbolic execution. First, static code analysis tools convert source code or binary files into abstract representations that are easy to analyze, such as abstract syntax trees (ASTs) or control flow graphs (CFGs). Then, potential errors are discovered by looking for known vulnerability patterns (such as unsafe function calls), analyzing the control risks of data flow and external inputs, or simulating the execution process of the program through symbolic execution.

[0028] When performing static analysis on IoT systems, existing technologies usually use taint analysis to track external inputs, and combine control flow analysis, symbolic execution, and various heuristic methods to assist in determining the location of security vulnerabilities and whether external inputs may trigger them, and give alerts containing specific addresses and path information for security personnel to confirm. Security personnel use reverse engineering tools (such as IDA Pro or Ghidra) to disassemble system firmware or binary programs to locate unsafe external calls or potential vulnerabilities.

[0029] Dynamic analysis technology is a method of discovering potential problems by executing a program and monitoring its runtime behavior. Unlike static analysis, dynamic analysis requires the program to actually run, during which the program's input and output, resource usage, memory access, system calls, etc. can be observed, thereby capturing some vulnerabilities that static analysis cannot detect. For security vulnerability detection in embedded systems, dynamic analysis can identify some vulnerabilities caused by complex environmental factors or external inputs during runtime.

[0030] Since IoT system firmware usually lacks a unified operating environment, dynamic analysis often simulates firmware operation through simulation methods to get rid of the dependence on the underlying hardware. This simulation environment not only solves the hardware adaptation problem, but also provides key internal information for gray box testing methods, such as path coverage. At present, existing related research focuses on specific device types, and effectively discovers potential vulnerabilities in firmware by implementing system simulation of firmware and combining heuristic methods to carry out fuzz testing.

[0031] Embedded systems usually use closed-source commercial embedded software, and the source code is difficult to obtain, so security detection mainly relies on the analysis of firmware and binary programs. However, existing binary analysis tools cannot fully cope with the high security and high specialization characteristics of embedded systems, especially the lack of support for scripting languages ​​and template languages ​​embedded in HTML.

[0032] Based on this, the core idea of ​​the present invention is to provide an automated security vulnerability detection method, system, electronic device and readable storage medium for multiple types of scripts in embedded systems, which can automatically identify script security vulnerabilities, improve the security of embedded systems during script execution, and effectively prevent potential security threats, especially for complex system environments with multiple script types.

[0033] It should be noted that the automated security vulnerability detection method for multiple types of scripts in an embedded system provided by the present invention can be applied to the automated security vulnerability detection system for multiple types of scripts in an embedded system provided by the present invention, and the automated security vulnerability detection system for multiple types of scripts in an embedded system can be configured on an electronic device, wherein the electronic device can be a personal computer, a mobile terminal, etc., and the mobile terminal can be a mobile phone, a tablet computer, and other hardware devices with various operating systems. It should also be noted that the development platform of the present invention can be an Ubuntu 22.04 operating system, and is developed using Python 3.8. Static code analysis is based on the Ghidra framework, and the taint analysis engine is based on the Angr framework.

[0034] To realize the above idea, the present invention provides an automated security vulnerability detection method for multiple types of scripts in embedded systems. Figure 1 , which is a flow chart of an automated security vulnerability detection method for multiple types of scripts in an embedded system provided by an embodiment of the present invention. Figure 1As shown, the automated security vulnerability detection method for multiple types of scripts in an embedded system provided by the present invention includes: step S100, unpacking and analyzing the firmware of the embedded system to be detected to identify the script files and template files in the firmware; step S200, identifying the dependency relationship between the script file and the template file and the interaction and dependency relationship between different types of script files, and marking the sensitive input source points and potential vulnerability sink points in the script file and the template file based on the dependency relationship between the script file and the template file and the interaction and dependency relationship between different types of script files, and using a context-sensitive control flow analysis algorithm to generate a control flow graph and an abstract syntax tree; step S300, constructing a power set lattice according to the assignment statements in the control flow graph, and using a fixed point algorithm to perform data flow analysis to obtain the data flow constraint relationship between each node in the control flow graph; step S400, performing taint analysis based on the control flow graph, the abstract syntax tree and the data flow constraint relationship to identify all dangerous execution paths from the sensitive input source points to the potential vulnerability sink points, thereby obtaining a security vulnerability detection result.

[0035] The present invention can comprehensively cover multiple types of scripts in embedded systems and identify potential security risks, avoiding the risk of missing vulnerabilities. In addition, the present invention can effectively capture static vulnerabilities and dynamic vulnerabilities by adopting context-sensitive control flow analysis algorithms and accurate data flow modeling and tracking, thereby improving the accuracy and comprehensiveness of vulnerability detection. Unlike the existing static analysis methods, the taint analysis technology in the present invention can automatically identify dangerous execution paths from sensitive input sources to potential vulnerability sinks, significantly improving the efficiency of vulnerability analysis. At the same time, the present invention can cross the interactions between different types of scripts, dig out complex vulnerability hazards, and solve the problem that vulnerability detection in the prior art has certain limitations. In addition, the present invention has efficient cross-script type vulnerability detection capabilities, is easy to deploy and expand, can be quickly integrated into existing development and testing processes, reduces labor costs and improves adaptability. In summary, it can be seen that by adopting the automated security vulnerability detection method for multiple types of scripts in embedded systems provided by the present invention, script security vulnerabilities can be automatically identified, significantly improving the effect of embedded system security vulnerability detection, thereby effectively improving the security of embedded systems during script execution, effectively preventing potential security threats, and providing a strong guarantee for the security of embedded systems.

[0036] Furthermore, the present invention can effectively capture the data flow and control flow path between different types of script files by identifying the interaction and dependency between different types of script files, and can then effectively analyze potential vulnerabilities between multiple script languages, such as command injection between script files, data leakage, and other issues. By tracking the interaction and data flow paths between different script files, it can accurately identify security vulnerabilities that may occur in a multi-language environment, ensuring that vulnerability detection covers all possible security risks. In particular, in the context of cross-script analysis, it is possible to identify interactive vulnerabilities between script files, such as Shell scripts affecting the execution results of Python scripts through command injection vulnerabilities, thereby affecting the behavior of Lua scripts, ensuring that vulnerabilities between script files are fully covered, including vulnerabilities within a single script language and cross-language interactions.

[0037] Furthermore, the present invention can effectively capture the structure of the code through the generated abstract syntax tree, making the subsequent analysis more targeted; through the generated control flow graph, it is easy to track potential tainted paths, determine whether the data flows as expected, and identify possible security vulnerabilities. Since assignment statements are important operations that affect data flow and play a key role in data flow analysis, the present invention can more accurately express the impact of assignment statements on data flow by converting the assignment statements in the control flow graph into a power set lattice form. By using a fixed point algorithm to perform data flow analysis to obtain the data flow constraint relationship between each node in the control flow graph, it can help to accurately track the flow path of data in the program and provide reliable data support for taint analysis; by adopting the taint analysis method, all potentially dangerous execution paths from the source point to the sink point can be found, and then potential security risks can be accurately found, helping developers to repair vulnerabilities in a timely manner.

[0038] In some exemplary embodiments, the step S100, unpacking and analyzing the firmware of the embedded system to be detected to identify the script files and template files in the firmware, includes: using a firmware analysis tool to scan and parse the firmware image of the embedded system to be detected to extract the file system in the firmware, and using directory scanning and file suffix matching technology to identify the script files and template files in the file system; using a dynamic behavior simulation algorithm to analyze the files dynamically loaded in the firmware to identify the script files.

[0039] Specifically, the firmware analysis tool can be Binwalk, that is, the firmware unpacking can be achieved by using the Binwalk framework. Binwalk is a widely used firmware analysis tool that can scan firmware images and identify common embedded file formats and file systems, thereby extracting various files in the firmware and providing data support for subsequent analysis. In embedded systems, firmware is usually based on the OpenWRT operating system, so it is necessary to perform targeted parsing according to the specific format of the firmware. If the firmware uses a manufacturer-defined format or a special version format, Binwalk may not be able to recognize it directly. In this case, the function of Binwalk can be extended to enhance the parsing capability of the custom firmware format, ensuring that binary files can be accurately extracted even in firmware with special formats, laying the foundation for subsequent static analysis.

[0040] Since static directory scanning and file suffix matching can only locate a part of the script files, some scripts are directly written in the program and cannot be extracted by static extraction. Therefore, the present invention adopts a dynamic behavior simulation algorithm to analyze the files dynamically loaded in the firmware to ensure that all potential script files are covered.

[0041] It should be noted that in embedded systems, script files (such as Lua, Shell, Perl) usually store the core business logic of the device, while template files are used for rendering and configuration management. By matching specific suffixes in the file system (such as ".lua", ".htm", ".sh"), script files with sensitive operations can be identified, providing analysis targets for subsequent steps. By analyzing the dependency between script files and template files, it can be ensured that all related code files can be fully covered in subsequent vulnerability analysis, thereby improving the accuracy of vulnerability detection.

[0042] In some exemplary embodiments, the sensitive input source points include external input data, parameters of an API interface, and environmental variables.

[0043] Specifically, sensitive input sources in embedded systems include form data submitted by users (external input data), API interface parameters, environment variables, etc. These sensitive input sources (such as luci.http.formvalue, luci.http.getcookie, etc.) can be identified and marked through regular expressions and syntax parsing. Furthermore, these sensitive input sources can be automatically identified and classified through machine learning models.

[0044] In some exemplary embodiments, the identification of the dependency between the script file and the template file and the interaction and dependency between different types of script files in step S200 includes: dynamically reconstructing the dependency between the script file and the template file based on a multi-dimensional collaborative analysis mechanism; building a unified syntax and execution semantic model for different types of script files to identify the interaction and dependency between different types of script files. Thus, by dynamically reconstructing the dependency between the script file and the template file based on a multi-dimensional collaborative analysis mechanism (combining multiple analysis methods, such as syntax analysis, control flow analysis, data flow analysis, etc.), the accuracy of the dependency between the obtained script file and the template file can be effectively guaranteed; by building a unified syntax and execution semantic model for different types of script files, the calls and dependencies between scripts can be processed through a unified syntax model, so that the interactions and dependencies between different types of script files can be accurately identified, ensuring that all vulnerability detection requirements can be fully covered in a multi-script environment.

[0045] In some exemplary embodiments, the context-sensitive control flow analysis algorithm is used in step S200 to generate a control flow graph and an abstract syntax tree, including: performing lexical analysis and syntactic analysis on the script file to generate an abstract syntax tree; traversing the abstract syntax tree to extract all function calls, and for each function call, creating an independent function call copy for it using a context-sensitive control flow analysis algorithm, thereby generating a control flow graph.

[0046] Therefore, by performing lexical analysis and syntax analysis on the script file to generate an abstract syntax tree, it is easy to accurately identify each line of code in the script, so that the code structure can be effectively captured, making subsequent analysis more targeted. By traversing the abstract syntax tree to generate a control flow graph, the process of code execution can be understood based on the control flow graph, especially in complex conditional judgments and loop statements, to understand how to transfer data flow and control flow; by analyzing the control flow graph, potential tainted paths can be tracked to determine whether the data flows as expected, so as to identify possible security vulnerabilities. Each function call is processed by using a context-sensitive control flow analysis algorithm: whenever a function is called, an independent function call copy is created for the function, and its control flow is spliced ​​into the control flow graph, which ensures that the analysis of the same function at different locations does not interfere with each other, thereby accurately reflecting the execution path of the program and helping to identify potential security vulnerabilities.

[0047] In some exemplary embodiments, the data flow analysis using the fixed point algorithm in step S300 to obtain the data flow constraint relationship between the nodes in the control flow graph includes: using the data flow constraint equation to describe the data transfer relationship between the nodes in the control flow graph; according to the data transfer relationship between the nodes in the control flow graph, using the fixed point algorithm to perform iterative calculations until the data flow constraint relationship converges. Thus, by using the data flow constraint equation to describe the constraint relationship between the nodes in the control flow graph, the value of each node can be associated with the adjacent nodes. By using the fixed point algorithm to perform iterative calculations until the results of two adjacent iterations no longer change, that is, reaching the fixed point, it means that the data flow constraint relationship has converged, so that the flow path of the data in the program can be accurately tracked, providing reliable data support for taint analysis.

[0048] In some exemplary embodiments, the step S400 performs taint analysis based on the control flow graph, the abstract syntax tree, and the data flow constraint relationship to identify all dangerous execution paths from the sensitive input source point to the potential vulnerability sink point, including: describing the code structure and execution path based on the control flow graph and the abstract syntax tree; tracking the data propagated by the sensitive input source point according to the data flow constraint relationship to identify all dangerous execution paths from the sensitive input source point to the potential vulnerability sink point.

[0049] Therefore, by parsing the abstract syntax tree and control flow graph, we can fully understand the variable relationship and execution path in the program. The abstract syntax tree is used to extract key nodes such as function calls and assignment operations, while the control flow graph describes the execution order and jump path between nodes. By marking source points (such as external input data or sensitive interface calls) and tracking the data propagated by these source points, combined with the fixed point algorithm and data flow constraint relationship, we can analyze how the data propagates in the control flow graph, thereby ensuring the accuracy of taint propagation. If it is found that taints in certain data flow paths are not handled correctly, these paths are marked as potentially dangerous paths, and in-depth analysis continues to ensure that the vulnerabilities are thoroughly discovered.

[0050] In some exemplary embodiments, the security vulnerability detection result includes the time when the vulnerability occurs, the source of the taint, the taint convergence point, and the related data flow path. The automated security vulnerability detection method for multiple types of scripts in an embedded system provided by the present invention also includes: organizing the vulnerability occurrence time, the source of the taint, the taint convergence point, and the related data flow path in the security vulnerability detection result into an entry form, and displaying them on the front-end interface. Thus, by organizing the information such as the time when the vulnerability occurs, the source of the taint, the taint convergence point, and the related data flow path into entries, and displaying them on the front-end interface, the security assessment of the embedded system can be made more intuitive, and developers can view the detailed information of the vulnerability on the interface, analyze potential security risks, and take corresponding repair measures, thereby improving the security and stability of the embedded system.

[0051] Specifically, the template mechanism in the Django framework can be used to generate a web page for vulnerability detection reports. The view part is responsible for processing requests and passing the results to the front-end for display. In this flexible and efficient way, developers can quickly view the details of each vulnerability and locate and repair it according to the specific data flow path provided in the report.

[0052] Based on the same inventive concept, the present invention also provides an automated security vulnerability detection system for multiple types of scripts in embedded systems, please refer to Figure 2 , which is a structural block diagram of an automated security vulnerability detection system for multiple types of scripts in an embedded system provided by an embodiment of the present invention. Figure 2As shown, the automated security vulnerability detection system for multiple types of scripts in an embedded system provided by the present invention includes a firmware parsing module 110, which is configured to unpack and analyze the firmware of the embedded system to be detected to identify the script files and template files in the firmware; a dependency and data flow reconstruction module 120, which is configured to identify the dependency between the script file and the template file and the interaction and dependency between different types of script files, and based on the dependency between the script file and the template file and the interaction and dependency between different types of script files, mark the script file and the template file. The sensitive input source points and potential vulnerability sinks in the control flow graph are identified, and a context-sensitive control flow analysis algorithm is used to generate a control flow graph and an abstract syntax tree; a data flow constraint relationship analysis module 130 is configured to construct a power set lattice according to the assignment statements in the control flow graph, and use a fixed point algorithm to perform data flow analysis to obtain the data flow constraint relationship between each node in the control flow graph; and a taint analysis module 140 is configured to perform taint analysis based on the control flow graph, the abstract syntax tree and the data flow constraint relationship to identify all dangerous execution paths from the sensitive input source points to the potential vulnerability sinks, thereby obtaining security vulnerability detection results.

[0053] It should be noted that the automated security vulnerability detection system for multiple types of scripts in an embedded system provided by the present invention can be used to execute the automated security vulnerability detection method for multiple types of scripts in an embedded system described above. The technical principles, technical problems solved and technical effects produced by the two are similar. Technical personnel in this technical field can clearly understand that for the convenience and conciseness of description, for more content about the automated security vulnerability detection system for multiple types of scripts in an embedded system provided by the present invention, refer to the content described above about the automated security vulnerability detection method for multiple types of scripts in an embedded system provided by the present invention, and no further details will be given here.

[0054] Based on the same inventive concept, the present invention also provides an electronic device, please refer to Figure 3 , which is a structural block diagram of an electronic device provided by an embodiment of the present invention. Figure 3As shown, the electronic device includes a processor 210 and a memory 230, and a computer program is stored on the memory 230. When the computer program is executed by the processor 210, the above-mentioned automated security vulnerability detection method for multiple types of scripts in an embedded system is implemented. Since the electronic device provided by the present invention and the automated security vulnerability detection method for multiple types of scripts in an embedded system provided by the present invention belong to the same inventive concept, the electronic device provided by the present invention at least has all the beneficial effects of the automated security vulnerability detection method for multiple types of scripts in an embedded system provided by the present invention. Therefore, the beneficial effects of the electronic device provided by the present invention can refer to the above description of the beneficial effects of the automated security vulnerability detection method for multiple types of scripts in an embedded system provided by the present invention, and will not be repeated here one by one.

[0055] Please continue to refer to Figure 3 ,like Figure 3 As shown, the electronic device also includes a communication interface 220 and a communication bus 240, wherein the processor 210, the communication interface 220, and the memory 230 communicate with each other through the communication bus 240. The communication bus 240 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus 240 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The communication interface 220 is used for communication between the above-mentioned electronic device and other devices.

[0056] It should be noted that the processor 210 referred to in the present invention may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor 210 is the control center of the electronic device, and uses various interfaces and lines to connect various parts of the entire electronic device.

[0057] It should also be noted that the processor 210 implements various functions of the electronic device by running or executing a computer program stored in the memory 230 and calling data stored in the memory 230. The memory 230 may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable memory (PROM), electrically programmable memory (EPROM), electrically erasable programmable memory (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, random access memory is available in many forms, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous random access memory (SDRAM), double data rate synchronous random access memory (DDRSDRAM), enhanced synchronous random access memory (ESDRAM), synchronous link (Synchlink) dynamic random access memory (SLDRAM), memory bus (Rambus) direct random access memory (RDRAM), direct memory bus dynamic random access memory (DRDRAM), and memory bus dynamic random access memory (RDRAM).

[0058] The present invention also provides a readable storage medium, wherein a computer program is stored in the readable storage medium, and when the computer program is executed by a processor, the above-mentioned method for automated security vulnerability detection of multiple types of scripts in an embedded system can be implemented. Since the readable storage medium provided by the present invention and the method for automated security vulnerability detection of multiple types of scripts in an embedded system provided by the present invention belong to the same inventive concept, the readable storage medium provided by the present invention at least has all the beneficial effects of the method for automated security vulnerability detection of multiple types of scripts in an embedded system provided by the present invention. Therefore, the beneficial effects of the readable storage medium provided by the present invention can refer to the above description of the beneficial effects of the method for automated security vulnerability detection of multiple types of scripts in an embedded system provided by the present invention, and will not be repeated here one by one.

[0059] In summary, compared with the prior art, the automated security vulnerability detection method, system, electronic device and readable storage medium for multi-type scripts in embedded systems provided by the present invention have the following beneficial effects: the present invention can comprehensively cover multi-type scripts in embedded systems and identify potential security risks, avoiding the risk of missing vulnerabilities. In addition, the present invention can effectively capture static vulnerabilities and dynamic vulnerabilities by adopting context-sensitive control flow analysis algorithms and accurate data flow modeling and tracking, thereby improving the accuracy and comprehensiveness of vulnerability detection. Unlike the existing static analysis methods, the taint analysis technology in the present invention can automatically identify dangerous execution paths from sensitive input source points to potential vulnerability sinks, significantly improving the efficiency of vulnerability analysis. At the same time, the present invention can cross the interactions between different types of scripts, dig out complex vulnerability risks, and solve the problem that vulnerability detection in the prior art has certain limitations. In addition, the present invention has efficient cross-script type vulnerability detection capabilities, is easy to deploy and expand, can be quickly integrated into existing development and testing processes, reduces labor costs and improves adaptability. In summary, it can be seen that the present invention can automatically identify script security vulnerabilities and significantly improve the effect of embedded system security vulnerability detection, thereby effectively improving the security of the embedded system during script execution, effectively preventing potential security threats, and providing a strong guarantee for the security of the embedded system.

[0060] It should be noted that the above description is only a description of the preferred embodiment of the present invention, and is not any limitation on the scope of the present invention. Any changes and modifications made by a person skilled in the art in the field of the present invention based on the above disclosure are within the scope of protection of the present invention. Obviously, a person skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations fall within the scope of the present invention and its equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. An automated security vulnerability detection method for multiple types of scripts in embedded systems, characterized in that: include: Unpacking and analyzing the firmware of the embedded system to be detected to identify the script files and template files in the firmware; Identify the dependency relationship between the script file and the template file, as well as the interaction and dependency relationship between different types of script files, and based on the dependency relationship between the script file and the template file, as well as the interaction and dependency relationship between different types of script files, mark sensitive input source points and potential vulnerability sink points in the script file and the template file, and use a context-sensitive control flow analysis algorithm to generate a control flow graph and an abstract syntax tree; Constructing a power set lattice according to the assignment statements in the control flow graph, and performing data flow analysis using a fixed point algorithm to obtain a data flow constraint relationship between nodes in the control flow graph; Based on the control flow graph, the abstract syntax tree and the data flow constraint relationship, taint analysis is performed to identify all dangerous execution paths from the sensitive input source point to the potential vulnerability sink point, thereby obtaining security vulnerability detection results.

2. The method for automatic security vulnerability detection of multiple types of scripts in embedded systems according to claim 1, characterized in that: The unpacking and analyzing of the firmware of the embedded system to be detected to identify the script files and template files in the firmware includes: Scan and parse the firmware image of the embedded system to be detected using a firmware analysis tool to extract the file system in the firmware, and use directory scanning and file suffix matching technology to identify the script files and template files in the file system; Use dynamic behavior simulation algorithm to analyze files dynamically loaded in firmware to identify script files; The identifying the dependency relationship between the script file and the template file and the interaction and dependency relationship between different types of script files includes: Based on a multi-dimensional collaborative analysis mechanism, dynamically reconstruct the dependency relationship between the script file and the template file; For different types of script files, a unified syntax and execution semantics model is constructed to identify the interactions and dependencies between the different types of script files.

3. The method for automatic security vulnerability detection of multiple types of scripts in embedded systems according to claim 1, characterized in that: The sensitive input sources include external input data, API interface parameters and environment variables.

4. The method for automatic security vulnerability detection of multiple types of scripts in embedded systems according to claim 1, characterized in that: The context-sensitive control flow analysis algorithm is used to generate a control flow graph and an abstract syntax tree, including: Performing lexical analysis and grammatical analysis on the script file to generate an abstract syntax tree; The abstract syntax tree is traversed to extract all function calls, and for each function call, a context-sensitive control flow analysis algorithm is used to create an independent function call copy for it, thereby generating a control flow graph.

5. The method for automatic security vulnerability detection of multiple types of scripts in embedded systems according to claim 1, characterized in that: The method of using a fixed point algorithm to perform data flow analysis to obtain a data flow constraint relationship between nodes in the control flow graph includes: Using data flow constraint equations to describe the data transfer relationship between nodes in the control flow graph; According to the data transfer relationship between the nodes in the control flow graph, a fixed point algorithm is used to perform iterative calculations until the data flow constraint relationship converges.

6. The method for automatic security vulnerability detection of multiple types of scripts in embedded systems according to claim 1, characterized in that: The taint analysis is performed based on the control flow graph, the abstract syntax tree and the data flow constraint relationship to identify all dangerous execution paths from the sensitive input source point to the potential vulnerability sink point, including: Based on the control flow graph and the abstract syntax tree, describe the code structure and execution path; The data propagated by the sensitive input source point is tracked according to the data flow constraint relationship to identify all dangerous execution paths from the sensitive input source point to the potential vulnerability sink point.

7. The method for automatic security vulnerability detection of multiple types of scripts in embedded systems according to claim 1, characterized in that: The security vulnerability detection result includes the vulnerability occurrence time, taint source, taint convergence point and related data flow path; The method further comprises: The vulnerability occurrence time, taint source, taint convergence point and related data flow paths in the security vulnerability detection results are organized into entry forms and displayed on the front-end interface.

8. An automated security vulnerability detection system for multiple types of scripts in embedded systems, characterized in that: include: A firmware parsing module, configured to unpack and analyze the firmware of the embedded system to be detected, so as to identify script files and template files in the firmware; A dependency and data flow reconstruction module, configured to identify the dependency between the script file and the template file and the interaction and dependency between different types of the script files, and based on the dependency between the script file and the template file and the interaction and dependency between different types of the script files, mark sensitive input source points and potential vulnerability sink points in the script file and the template file, and generate a control flow graph and an abstract syntax tree using a context-sensitive control flow analysis algorithm; A data flow constraint relationship analysis module is configured to construct a power set lattice according to the assignment statements in the control flow graph, and perform data flow analysis using a fixed point algorithm to obtain a data flow constraint relationship between nodes in the control flow graph; as well as The taint analysis module is configured to perform taint analysis based on the control flow graph, the abstract syntax tree and the data flow constraint relationship to identify all dangerous execution paths from the sensitive input source point to the potential vulnerability sink point, thereby obtaining security vulnerability detection results.

9. An electronic device, characterized in that: The invention comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the method for detecting automatic security vulnerabilities of multiple types of scripts in an embedded system according to any one of claims 1 to 7 is implemented.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for automatically detecting security vulnerabilities of multiple types of scripts in an embedded system according to any one of claims 1 to 7 is implemented.

Images