Security analysis method and device of Internet of Things equipment, and storage medium

Abstract

The invention relates to the field of Internet of Things equipment security, in particular to a security analysis method and device for Internet of Things equipment and a storage medium, and the method mainly comprises the steps: obtaining a firmware file of the Internet of Things equipment, unpacking the firmware file, and extracting a binary file and a configuration file in firmware; performing decompilation processing on the binary file, and performing pattern matching on the configuration file to obtain to-be-analyzed data; performing static analysis on the to-be-analyzed data by using a multi-thread technology, and identifying a potential security problem to obtain a static analysis result; and inputting the static analysis result into a large language model, and generating a risk assessment and safety analysis report. According to the invention, the efficiency and accuracy of Internet of Things equipment security analysis can be improved.

Description

Technical Field

[0001] The present application relates to the field of Internet of Things device security, and in particular to a security analysis method, device and storage medium for Internet of Things devices. Background Art

[0002] With the rapid development of IoT technology, smart devices and sensors are widely used in various fields, but these devices face severe security challenges due to factors such as limited resources, diverse hardware architectures, and inconsistent development standards. For example, due to the strong heterogeneity of devices and inconsistent development standards, various security vulnerabilities are prone to occur in software development.

[0003] Traditional security analysis technologies, such as static analysis, dynamic analysis, and signature-based malware detection, all have limitations and are difficult to meet the needs of IoT device security analysis. Specifically, the accuracy of static analysis technology is limited by the complexity of the code and the accuracy of the analysis rules; the application scope of dynamic analysis technology is limited due to the limited resources of IoT devices; and signature-based malware detection can only identify known threats and lacks the ability to respond to new and variant malware. Summary of the invention

[0004] The present application provides a security analysis method for an IoT device, which can improve the efficiency and accuracy of security analysis of an IoT device.

[0005] In order to achieve the above object, the present invention adopts the following technical scheme:

[0006] In a first aspect, the present invention provides a security analysis method for an Internet of Things device, the method comprising:

[0007] Obtain a firmware file of the IoT device, unpack the firmware file, and extract binary files and configuration files in the firmware;

[0008] Decompiling the binary file, performing pattern matching on the configuration file, and obtaining data to be analyzed;

[0009] Using multi-threading technology to perform static analysis on the data to be analyzed, identify potential security issues, and obtain static analysis results;

[0010] The static analysis results are input into a large language model to generate a risk assessment and security analysis report.

[0011] In a preferred example of the present application, it can be further configured that the risk assessment and safety analysis report presents the analysis results in a visual manner, and the visual manner includes a risk distribution map, a risk assessment result table or a repair suggestion list.

[0012] In a preferred example of the present application, it can be further configured that the static analysis result is input into a large language model to generate a risk assessment and security analysis report, including:

[0013] Inputting the static analysis results into a large language model, and identifying risks existing in the firmware based on the large language model;

[0014] If the risk is identified, the type and location of the identified risk are determined, the severity, impact scope and possible attack methods of the risk are evaluated, the large language model provides corresponding repair suggestions based on the evaluation results, and generates a risk assessment and security analysis report containing the repair suggestions;

[0015] If the risk is not identified, generate a risk assessment and safety analysis report.

[0016] In a preferred example of the present application, it can be further configured that the step of obtaining the firmware file of the IoT device includes:

[0017] Get the firmware file from the IoT device's storage device or network server.

[0018] In a preferred example of the present application, it can be further configured that the large language model analysis is combined with the transfer learning technology of IoT devices that adapt to different hardware architectures and operating systems when analyzing the static analysis results.

[0019] In a preferred example of the present application, it can be further configured that the large language model combines the heterogeneity and resource-constrained characteristics of IoT devices to generate a risk assessment and security analysis report, and provides security risk analysis and mitigation measures for different IoT devices in the report.

[0020] In a second aspect, the present application provides a security analysis device for an Internet of Things device, the device comprising:

[0021] A data acquisition module, used to obtain the firmware file of the IoT device, unpack the firmware file and extract the binary file and configuration file in the firmware;

[0022] The static analysis module is used to decompile the binary file, perform pattern matching on the configuration file, and obtain the data to be analyzed; perform static analysis on the data to be analyzed using multi-threading technology, identify potential security issues, and obtain static analysis results;

[0023] The report generation module is used to input the static analysis results into the large language model to generate risk assessment and security analysis reports.

[0024] In a third aspect, the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the security analysis method for an Internet of Things device as described in any one of the above items are implemented.

[0025] In a fourth aspect, the present application provides a computer-readable storage medium, on which a program is stored, wherein when the program is executed by a processor, a security analysis method for an Internet of Things device as described in any one of the above items is implemented.

[0026] In a fifth aspect, the present application provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of the security analysis method for an Internet of Things device as described in any one of the above items.

[0027] In summary, compared with the prior art, the technical solution provided in the embodiment of the present application has at least the following beneficial effects:

[0028] 1. This application improves the analysis speed of firmware files by combining multi-threading technology and large language models, enabling the system to process a large number of firmware files of IoT devices.

[0029] 2. This application uses a large language model to perform deep semantic analysis on the data of firmware files, significantly reducing the false positive and false negative rates of risks and improving the accuracy of security analysis of IoT devices.

[0030] 3. The large language model provides intelligent vulnerability assessment and repair suggestions to help users solve security problems faster. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A flowchart of a security analysis method for an Internet of Things device provided by one embodiment of the present application.

[0032] Figure 2 A structural diagram of a security analysis device for an Internet of Things device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0034] In one embodiment of the present application, a security analysis method for an IoT device is provided. Figure 1 As shown, the method includes:

[0035] S100: Obtain a firmware file of the IoT device, unpack the firmware file, and extract binary files and configuration files in the firmware;

[0036] Specifically, the firmware file is unpacked to extract the binary files and configuration files in the firmware, and then some processing is performed, such as using a decompiler to decompile the binary files into pseudo code and performing preliminary pattern matching on the configuration files. These data are provided as input data to subsequent steps to further identify potential security issues.

[0037] S200: Decompile the binary file and perform pattern matching on the configuration file to obtain data to be analyzed;

[0038] S300: Performing static analysis on the data to be analyzed by using multi-threading technology to identify potential security issues and obtain static analysis results;

[0039] Specifically, this step performs preliminary static analysis on the firmware, source code, or binary files of IoT devices to identify potential security issues. This step uses multi-threading technology to process the code in parallel to increase the analysis speed, and uses specific algorithms to identify and track interactions between multiple threads.

[0040] After static analysis, the data obtained mainly includes the following: preliminary identification of security vulnerabilities, such as potential code defects, weak passwords, unprotected sensitive data, etc.; information on multi-threaded interaction points, used to identify possible race conditions and resource contention issues; contextual information of code snippets, such as function call graphs and data flow paths.

[0041] The output data of these static analyses will be passed as input to the large language model for deeper understanding and risk assessment. In order to input the large language model, the static analysis results will be encoded into a text representation suitable for natural language processing, retaining the context of the code, the identified risk information and the associated code lines.

[0042] S400: Input the static analysis results into a large language model to generate a risk assessment and security analysis report.

[0043] Specifically, this step is divided into two sub-steps. The first step is to further use the large language model to deeply understand and secondary analyze the analysis results based on static analysis. Specifically, due to the particularity of IoT devices, the present invention makes the following adaptive improvements based on the characteristics of IoT data when using the large language model for analysis: the large language model is combined with transfer learning technology to enable adaptive analysis for different hardware architectures and operating systems; considering the problem of limited resources of IoT devices, high-energy-consuming operations are avoided as much as possible in model analysis, and lightweight feature extraction and static pattern matching are used for initial risk screening; multi-threaded environment support: based on static analysis, the model will pay special attention to multi-threaded interaction points and detect possible complex problems such as deadlocks or race conditions; before applying the large model, use the training data we have sorted for fine-tuning, and use appropriate prompt words when using the large language model for analysis.

[0044] The large language model semantically understands the data obtained by the static analysis module, and performs reasoning based on its rich code corpus and the training data and prompt words we provide to complete the following tasks: Analyze the code context to determine whether the identified risks actually exist and reduce the false alarm rate; Combine the specific programming patterns and logic of the code to identify potential security issues, such as unvalidated input, injection attack risks, etc.; Provide corresponding confidence scores for different types of vulnerabilities to classify and sort risks; If there is a risk, automatically generate repair suggestions for each vulnerability based on the training data and prompt words we provide. The generation process of repair suggestions combines the characteristics of code context, vulnerability type and target programming language, and automatically generates them by integrating the knowledge and context analysis capabilities of the large language model to ensure that the repair measures for the vulnerabilities meet security standards and development specifications.

[0045] Through the model's semantic understanding and reasoning capabilities, the model will identify data as risky or non-risky based on the severity and degree of harm of the vulnerability, provide intelligent judgment of potential risks, and output detailed vulnerability descriptions and repair suggestions.

[0046] Next, based on the preliminary risks obtained by static analysis, the large language model will conduct further semantic analysis and intelligent judgment. The final comprehensive analysis module combines the low-level vulnerabilities identified by static analysis with the high-level risk descriptions obtained by the large language model analysis to generate a comprehensive risk assessment and security analysis report.

[0047] Due to the particularity of IoT devices, the report will also reflect: Device heterogeneity risks: The report will list the specific security issues that exist in different types of hardware platforms, such as the buffer overflow risk unique to a certain type of processor architecture; Security risks of resource-constrained devices: For devices that require low resource consumption, the report will specifically mark which vulnerabilities require fewer resources to fix and which require high computing power support; Multi-threaded and network interaction analysis: IoT devices often involve multi-threaded and network communications. The report will specifically point out the security risks of these interactions and provide detailed mitigation measures; The report not only includes the discovered vulnerabilities and risks, but also provides repair suggestions and priority sorting to help users quickly fix high-risk vulnerabilities.

[0048] In this embodiment, the beneficial effects include at least:

[0049] 1. This application improves the analysis speed of firmware files by combining multi-threading technology and large language models, enabling the system to process a large number of firmware files for IoT devices. The large language model has strong context understanding capabilities, can quickly identify potential security risks, and reduce the time for manual review.

[0050] 2. This application uses a large language model to perform deep semantic analysis on the data of firmware files, significantly reducing the false positive and false negative rates of risks and improving the accuracy of security analysis of IoT devices.

[0051] 3. The large language model provides intelligent vulnerability assessment and repair suggestions to help users solve security problems faster.

[0052] In some embodiments, the risk assessment and safety analysis report presents the analysis results in a visual manner, and the visual manner includes a risk distribution map, a risk assessment result table, or a repair suggestion list.

[0053] In this embodiment, the readability of the risk assessment and safety analysis report is improved.

[0054] In some embodiments, the static analysis results are input into a large language model to generate a risk assessment and security analysis report, including:

[0055] Inputting the static analysis results into a large language model, and identifying risks existing in the firmware based on the large language model;

[0056] If the risk is identified, the type and location of the identified risk are determined, the severity, impact scope and possible attack methods of the risk are evaluated, the large language model provides corresponding repair suggestions based on the evaluation results, and generates a risk assessment and security analysis report containing the repair suggestions;

[0057] If the risk is not identified, generate a risk assessment and safety analysis report.

[0058] In this embodiment, the large language model provides intelligent vulnerability assessment and repair suggestions, which can help users solve security problems more quickly.

[0059] In this embodiment, the step of obtaining the firmware file of the IoT device includes:

[0060] Get the firmware file from the IoT device's storage device or network server.

[0061] In this embodiment, the speed and convenience of obtaining the firmware file are improved.

[0062] In some embodiments, the large language model analysis is combined with transfer learning technology for IoT devices that are adapted to different hardware architectures and operating systems when analyzing the static analysis results.

[0063] In this embodiment, the large language model can be enabled to perform adaptability analysis for different hardware architectures and operating systems.

[0064] In some embodiments, the large language model generates a risk assessment and security analysis report in combination with the heterogeneity and resource-constrained characteristics of IoT devices, and provides security risk analysis and mitigation measures for different IoT devices in the report.

[0065] In this embodiment, the large language model can be used to perform adaptive analysis on the security risks of different IoT devices and their corresponding mitigation measures.

[0066] This application also provides a security analysis device for IoT devices, see Figure 2 As shown, the device comprises:

[0067] The data acquisition module 100 is used to obtain the firmware file of the IoT device, unpack the firmware file and extract the binary file and configuration file in the firmware;

[0068] The static analysis module 200 is used to decompile the binary file, perform pattern matching on the configuration file, and obtain the data to be analyzed; perform static analysis on the data to be analyzed using multi-threading technology, identify potential security issues, and obtain static analysis results;

[0069] The report generation module 300 is used to input the static analysis results into the large language model to generate a risk assessment and security analysis report.

[0070] The functional implementation of each module in the security analysis device of the above-mentioned Internet of Things device corresponds to the steps in the embodiment of the security analysis method of the above-mentioned Internet of Things device, and its functions and implementation processes will not be repeated here one by one.

[0071] The present application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the security analysis method for an Internet of Things device as described in any of the above embodiments are implemented.

[0072] The present application also provides a computer-readable storage medium, on which a program is stored, wherein the computer-readable storage medium refers to a carrier for storing data, which may include but is not limited to a floppy disk, an optical disk, a hard disk, a flash memory, a USB flash drive, and / or a memory stick, etc., and the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The working process, working details, and technical effects of the computer-readable storage medium provided in this embodiment can be found in the above embodiment of a security analysis method for an Internet of Things device, which will not be repeated here.

[0073] The application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the security analysis method for an Internet of Things device as described in any of the above embodiments.

[0074] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0075] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. The above-mentioned embodiments only express several implementation methods of the present application, and their descriptions are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that for ordinary technicians in this field, without departing from the concept of the present application, several deformations and improvements can be made, which all belong to the protection scope of the present application. Therefore, the protection scope of the patent of this application shall be based on the attached claims.

Claims

1. A security analysis method for an Internet of Things device, characterized in that: include: Obtain a firmware file of the IoT device, unpack the firmware file, and extract binary files and configuration files in the firmware; Decompiling the binary file and performing pattern matching on the configuration file to obtain data to be analyzed; Using multi-threading technology to perform static analysis on the data to be analyzed, identify potential security issues, and obtain static analysis results; The static analysis results are input into a large language model to generate a risk assessment and security analysis report.

2. The security analysis method for an Internet of Things device according to claim 1, characterized in that: The risk assessment and safety analysis report presents the analysis results in a visual manner, and the visual manner includes a risk distribution map, a risk assessment result table or a repair suggestion list.

3. The security analysis method for an Internet of Things device according to claim 1, characterized in that: The static analysis results are input into the large language model to generate a risk assessment and security analysis report, including: Inputting the static analysis results into a large language model, and identifying risks existing in the firmware based on the large language model; If the risk is identified, the type and location of the identified risk are determined, the severity, impact scope and possible attack methods of the risk are evaluated, the large language model provides corresponding repair suggestions based on the evaluation results, and generates a risk assessment and security analysis report containing the repair suggestions; If the risk is not identified, generate a risk assessment and safety analysis report.

4. The security analysis method for an Internet of Things device according to claim 3, characterized in that: The step of obtaining the firmware file of the IoT device includes: Get the firmware file from the IoT device's storage device or network server.

5. The security analysis method for an Internet of Things device according to claim 4, characterized in that: The large language model analysis is combined with the transfer learning technology of IoT devices that are adapted to different hardware architectures and operating systems when analyzing the static analysis results.

6. The security analysis method for an Internet of Things device according to claim 5, characterized in that: The large language model combines the heterogeneity and resource-constrained characteristics of IoT devices to generate a risk assessment and security analysis report, and provides security risk analysis and mitigation measures for different IoT devices in the report.

7. A security analysis device for an Internet of Things device, characterized in that: include: A data acquisition module, used to obtain the firmware file of the IoT device, unpack the firmware file and extract the binary file and configuration file in the firmware; The static analysis module is used to decompile the binary file, perform pattern matching on the configuration file, and obtain the data to be analyzed; perform static analysis on the data to be analyzed using multi-threading technology, identify potential security issues, and obtain static analysis results; The report generation module is used to input the static analysis results into the large language model to generate risk assessment and security analysis reports.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the security analysis method for an Internet of Things device according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program, wherein when the program is executed by the processor, the security analysis method for the Internet of Things device according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising computer instructions, characterized in that: When executed by a processor, the computer instructions implement the steps of the security analysis method for an Internet of Things device as described in claims 1 to 6.

Images