Online Internet of Things equipment firmware identification method based on Monte Carlo search tree

Abstract

The invention relates to a firmware identification method of Internet of Things equipment, in particular to an online Internet of Things equipment firmware identification method based on a Monte Carlo search tree. According to the method, on the basis of priori knowledge of a mapping relation from firmware to files, a file which can best distinguish remaining versions is selected by maximizing information gain to serve as a basis for node extension. In each simulation stage, a file request is initiated to a target device only in a roll-out process, a next requested file is selected by adopting a greedy strategy according to response information of the device so as to quickly reduce a version set, and the influence of noise in a single response on an inference result is reduced through multi-round simulation optimization path selection. According to the method, efficient identification can be realized only by providing the mapping relation between the firmware and the webpage without establishing a complex fingerprint database or model training.

Description

Technical Field

[0001] The present invention relates to a firmware identification method for an Internet of Things device, and in particular to an online Internet of Things device firmware identification method based on a Monte Carlo search tree. Background Art

[0002] With the rapid development of the Internet of Things (IoT), a large number of IoT devices are connected to the cyberspace, such as network cameras, routers, switches, printers, PLCs, etc. This has brought convenience as well as serious security risks. Unpatched devices affected by N-day vulnerabilities have triggered serious distributed denial of service (DDoS) attacks, such as Miria's use of this attack to control millions of IoT devices. Security incidents have shown that due to the large number of public technical details of devices such as network cameras and home routers, exploiting known vulnerabilities is usually more direct than exploiting 0-day vulnerabilities.

[0003] Unfortunately, when measuring the large number of unpatched vulnerable IoT devices on the Internet, it is very dependent on the accurate firmware version information of the devices. CVE, NVD, and CPE vulnerability reports show that firmware versions are closely related to firmware vulnerabilities. However, the diversity and distribution of IoT devices make it difficult to directly obtain large-scale IoT device test samples for research. At the same time, it becomes a major challenge to directly extract firmware-related features from the inside of the device without obtaining password login permissions. These limitations make the research methods for firmware identification of IoT devices on the Internet still very limited. Search engines specifically for physical network devices, such as Shodan and Censys, identify devices by scanning IP addresses, different ports and protocols to capture banners. However, considering device security, manufacturers usually do not explicitly display firmware versions in banners and web pages.

[0004] Proof-of-Concept (PoC) tools are the most direct way to check whether there are known vulnerabilities in online devices. However, this PoC checking method faces legality issues and technical challenges. On the one hand, it is very time-consuming to develop corresponding PoC tools for various vulnerabilities that affect various device models and firmware versions. On the other hand, even if the PoC payload is harmless, it is still illegal in most countries and regions to trigger vulnerabilities in real devices without the authorization of the device owner. The fingerprint scanning method does not trigger vulnerabilities and becomes a more legal method to evaluate vulnerable devices on the Internet. Traditional fingerprint scanning methods ignore efficiency issues and usually require hundreds of HTTP requests to identify a single target. This inefficient identification mode seriously hinders its application in large-scale IoT device environments, making the task of real-time identification and potential vulnerability scanning of devices extremely difficult.

[0005] In summary, the defects of the existing technology mainly include: the dedicated IoT search engine based on service slogans has extremely high false positive and false negative rates. The traffic-based fingerprint recognition solution is too coarse-grained and cannot cover the recognition of device firmware versions. Traditional firmware recognition fingerprint solutions are inefficient and prone to DDoS attacks. There is an urgent need to develop more accurate and efficient firmware version recognition technology to improve the accuracy and reliability of IoT device security assessment. Summary of the invention

[0006] Aiming at the problem of low efficiency of traditional firmware identification fingerprint scheme, the present invention provides an online Internet of Things device firmware identification method based on Monte Carlo search tree.

[0007] The present invention is implemented by adopting the following technical scheme: an online IoT device firmware identification method based on Monte Carlo search tree. The method is based on Monte Carlo tree search method, firstly establishes a mapping relationship between the firmware version and the files it contains, and the mapping relationship is used as the input of Monte Carlo tree; the Monte Carlo tree search method specifically includes the following process:

[0008] Initialization phase: Initialize the firmware version set to the set of all firmware versions; Initialize the unrequested file set, merge the file sets corresponding to all firmware versions, this set contains all the files that may need to be requested, and ensure that the same file will not be repeatedly selected during the node expansion process; Tree node initialization: arbitrarily select a file from the file set as the root node;

[0009] Selection stage: The UCB1 algorithm is used to calculate a score for each child node. The formula is: Where S is the number of wins of the child node; v is the number of times the child node is visited; V is the number of times the parent node is visited; c is a constant that adjusts the balance between exploration and development; starting from the root node, along the path of the search tree, select the child node with the highest score layer by layer until you reach a node that is not fully expanded;

[0010] Extension phase: select a file that has not been expanded from all files as a new child node, set the initial state of the new child node to zero, and add the new child node request to the search path. The extension phase introduces new child node requests to provide new exploration directions for subsequent simulation links and expand the search space;

[0011] Simulation phase: In this phase, a greedy strategy is used to select files that can maximize the distinction between firmware version sets for request. After the request, the device's response is recorded. True indicates that the device contains the file, and False indicates that the device does not have the file. The version set local_versions is updated according to the device's response, and only the version that matches the response is retained. Through multiple file requests and response analysis, the version set is continuously reduced until the set size is 1 or the set is no longer searched.

[0012] Backtracking phase: In this phase, starting from the leaf node of the current simulation path, backtracking to the root node layer by layer, updating the number of visits and the number of wins of each node. If the current device firmware version belongs to the version set local_versions of the simulation phase, the number of wins is increased by 1;

[0013] The operation of the Monte Carlo tree search method will terminate when one of the following conditions is met: 1) the version set local_versions is reduced to a unique version, and the firmware version of the device is determined; 2) the version set local_versions is no longer reduced, and the most frequently occurring version set is returned as the inference result;

[0014] Determine the final version: After completing all simulations, the final firmware version needs to be determined based on the inference results of each node in the search tree. First, traverse the entire search tree and count the number of times the infer_versions set of each node appears. By traversing the version_counts dictionary, select the version set with the most appearances as the final inference result.

[0015] In the above-mentioned online IoT device firmware identification method based on Monte Carlo search tree, the mapping relationship between the firmware version and the files it contains is established in the following process: first, the firmware in the supplier's website is collected using a web crawler script, and then the firmware is decompressed using the Binwalk tool. After successful decompression, a complete file system can be obtained; then, the web page name and path in the root folder of the web directory in the firmware file system are saved, and finally, the firmware simulation tool FirmAE is used to realize automatic firmware simulation. Once the firmware simulation is successful, the accessible web pages are collected and a mapping relationship is established using HTTP GET recursive requests based on the saved web page name and path.

[0016] The present invention proposes an online IoT device firmware identification method based on Monte Carlo search tree. The method realizes the firmware identification of online IoT devices by adopting multi-round simulation optimization path selection. Compared with other technologies, the method has the following significant advantages and effects:

[0017] 1. Dynamic adaptability. FIMCTS takes into account uncontrollable factors such as network delay, packet loss, and noise in device communication. It accumulates device response information through multiple rounds of simulation, reduces the impact of single response errors on inference, and ensures stable performance in complex network environments. The algorithm allows the number of simulation rounds to be adjusted according to demand, flexibly balancing accuracy and efficiency to adapt to diverse scenarios.

[0018] 2. Efficient search optimization. The UCB1 strategy is used in the selection phase to balance exploration and development, giving priority to exploring the path with the largest information increment, and quickly reducing the version set. In the simulation phase, the file request that can best distinguish the version set is dynamically selected to reduce unnecessary file access and improve search efficiency. In the backtracking phase, the number of accesses and the number of wins are updated to continuously optimize the search tree and make subsequent simulations more efficient.

[0019] 3. Robustness to deal with the unchanged web directory structure during firmware updates. When some version updates do not change the web directory structure, FIMCTS can return a version set instead of a single version to avoid misjudgment due to indistinguishable file structures. This mechanism enhances the algorithm's ability to identify files that have not changed significantly.

[0020] 4. Universality and extensibility. By inputting different file mapping relationships of the device, FIMCTS can not only identify the firmware version, but also be extended to identify the device model, manufacturer and other information. The algorithm is designed to be universal and suitable for the task of identifying the firmware version of devices of different types, brands and models.

[0021] In the experiment, FIMCTS only needs to provide the mapping relationship between firmware and web pages, without the need to establish a complex fingerprint library or model training, to achieve efficient recognition. Through experimental verification, compared with the default scanning of all web pages under firmware, FIMCTS can improve the efficiency by 141.7 times on average. This shows that FIMCTS can significantly improve the efficiency of firmware recognition for online devices, verifying the effectiveness of the present invention in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a flow chart of the firmware identification method based on Monte Carlo tree search of the present invention.

[0023] Figure 2 Schematic diagram of the FIMCTS algorithm. DETAILED DESCRIPTION

[0024] The present invention proposes a heuristic search algorithm FIMCTS (Firmware Identification with Monte Carlo Tree Search), which establishes a fingerprint based on the mapping information of the device firmware and the embedded network interface directory structure to identify the firmware version running on the online Internet of Things device. Specifically, the firmware in the supplier's website is first collected using a web crawler script. Then the firmware is decompressed using the Binwalk tool, and a complete file system can be obtained after successful decompression. Subsequently, the web page name and path in the root folder of the web page directory in the firmware file system are saved. Finally, the firmware simulation tool FirmAE is used to realize automatic firmware simulation. Once the firmware simulation is successful, the HTTP GET recursive request is used to collect accessible web pages and establish a mapping relationship based on the saved web page name and path. According to the web page mapping relationship established by each firmware, the present invention designs a firmware identification algorithm FIMCTS based on Monte Carlo tree search. Specifically, FIMCTS uses the dual information of the existence and absence of files to narrow the version set, optimizes the path selection through multiple rounds of simulation, and reduces the influence of noise in a single response on the inference result. Specifically, the identification process of FIMCTS is divided into four main stages: selection, expansion, simulation and backtracking. In the selection phase, FIMCTS uses the Upper Confidence Bound 1 (UCB1) strategy to select the optimal path from the nodes of the search tree for exploration to ensure the maximization of information increment. In the expansion phase, nodes are expanded by requesting new files to incorporate more file information into the inference process. In the simulation phase, based on the device response results, FIMCTS uses a greedy strategy to select files that can maximize the difference between version sets and gradually reduce the version set. In the backtracking phase, the number of visits and wins for each node is updated to provide a more optimized path selection basis for subsequent decisions.

[0025] The present invention includes five main phases: initialization phase, selection phase, expansion phase, simulation phase and backtracking phase.

[0026] The input is the mapping relationship F2F from firmware version to files. Each firmware version contains the corresponding file set all_files.

[0027] The output is the final set of possible firmware versions inferred by FIMCTS versions .

[0028] 1. Initialization phase: Initialize the version set V to the set of all firmware versions (i.e., search space); initialize the unrequested file set U, and merge the file sets corresponding to all firmware versions. This set contains all files that may need to be requested, ensuring that the same file will not be repeatedly selected during the node expansion process; tree node initialization: arbitrarily select a file from the file set as the root node.

[0029] 2. Selection phase: FIMCTS uses the UCB1 (Upper Confidence Bound 1) algorithm to balance exploration and exploitation in the selection phase. The goal is to select a node with potential value in the current search tree for expansion. UCB1 is used to calculate a score for each child node (usually composed of the number of visits and the number of wins). The formula is: Where S is the number of wins of the child node; v is the number of times the child node is visited; V is the number of times the parent node is visited; and c is a constant that adjusts the balance between exploration and exploitation. FIMCTS starts from the root node and follows the path of the search tree, selecting the child node with the highest score layer by layer until it reaches a node that is not fully expanded. This stage ensures that the algorithm prioritizes the path with the largest information increment while retaining a certain degree of exploratory nature to discover potential optimal solutions.

[0030] 3. Expansion phase: If the current node has been visited, it enters the expansion phase. FIMCTS selects files that have not been expanded from all files as the corresponding new child nodes, sets the initial state of the new child nodes (number of visits V and number of wins S) to zero, and adds the new child node request to the search path. The introduction of new child node requests in the expansion phase provides new exploration directions for subsequent simulation links and expands the search space.

[0031] 4. Simulation phase: In this phase, FIMCTS uses a greedy strategy to select files that can maximize the distinction between version sets for request. After the request, the device's response result is recorded (True means the device contains the file, False means the device does not have the file), and the version set local_versions is updated according to the device's response, retaining only the version that matches the response. Through multiple file requests and response analysis, the version set is continuously reduced until the set size is 1 (unique version) or the set is no longer searched and terminated. The simulation link is the core of FIMCTS. The greedy strategy is used to maximize the use of device response information and quickly exclude firmware versions that do not meet the conditions.

[0032] 5. Backtracking phase: In this phase, FIMCTS starts from the leaf node of the current simulation path and backtracks to the root node layer by layer. The number of visits V and the number of wins S of each node are updated. If the current device firmware version belongs to the version set local_versions of the simulation result, the number of wins is increased by 1. By backtracking and updating the statistical information of the node, FIMCTS provides an optimization basis for the subsequent selection phase, so that the search tree becomes more and more accurate as the number of simulations increases.

[0033] Termination conditions of FIMCTS: The operation of FIMCTS will terminate when one of the following conditions is met:

[0034] 1) The version set local_version is narrowed down to a single version, which identifies the firmware version of the device.

[0035] 2) The version set local_versions is no longer reduced, and the most frequently occurring version set is returned as the inference result.

[0036] 6. Determine the final version: After completing all simulations, the algorithm needs to determine the final firmware version based on the inference results of each node in the search tree. First, traverse the entire search tree, count the number of times the infer_versions set of each node appears, and traverse the version_counts dictionary to select the version set with the most appearances as the final inference result.

[0037] Attached Figure 1 The entire search process of FIMCTS is shown in the figure. In this process, based on the prior knowledge of the firmware to file (F2F) mapping relationship, FIMCTS selects the file that can best distinguish the remaining versions as the basis for node expansion by maximizing information gain. In each round of simulation, a file request is only initiated to the target device during the rollout process, and a greedy strategy is adopted to select the next requested file based on the device's response information (a correct response is marked as True, and no response is marked as False) to quickly reduce the version set. However, due to external environmental interference such as network fluctuations, the device failed to correctly return the expected response, as shown in the fourth round of simulation in the figure. To resist environmental noise, FIMCTS will record the inference information of each rollout process and count the most frequently appearing version set as the final version decision. This mechanism based on multiple simulation statistics effectively improves the robustness of firmware identification. As shown in the attached Figure 1 It can be seen that the number of file requests is positively correlated with the number of simulated rounds, but in actual applications, there is no need to build a complete search tree. This is because each rollout will give a complete inference process and results. The number of simulated rounds can be set according to the resource constraints of the application scenario or the required recognition accuracy to achieve an effective balance between accuracy and efficiency.

Claims

1. A method for online IoT device firmware identification based on Monte Carlo search tree, characterized in that: This method is based on the Monte Carlo tree search method. First, a mapping relationship between the firmware version and the files it contains is established. The mapping relationship is used as the input of the Monte Carlo tree. The Monte Carlo tree search method specifically includes the following processes: Initialization phase: Initialize the firmware version set to be the set of all firmware versions; Initialize the unrequested file set, merge the file sets corresponding to all firmware versions, and this set contains all the files that may need to be requested, ensuring that the same file will not be repeatedly selected during the node expansion process; Tree node initialization: select any file from the file set as the root node; Selection stage: The UCB1 algorithm is used to calculate a score for each child node. The formula is: Where S is the number of wins of the child node; v is the number of times the child node is visited; V is the number of times the parent node is visited; c is a constant that adjusts the balance between exploration and development; starting from the root node, along the path of the search tree, select the child node with the highest score layer by layer until you reach a node that is not fully expanded; Extension phase: select a file that has not been expanded from all files as a new child node, set the initial state of the new child node to zero, and add the new child node request to the search path. The extension phase introduces new child node requests to provide new exploration directions for subsequent simulation links and expand the search space; Simulation phase: In this phase, a greedy strategy is used to select files that can maximize the distinction between firmware version sets for request. After the request, the device's response is recorded. True indicates that the device contains the file, and False indicates that the device does not have the file. The version set local_versions is updated according to the device's response, and only the version that matches the response is retained. Through multiple file requests and response analysis, the version set is continuously reduced until the set size is 1 or the set is no longer searched. Backtracking phase: In this phase, starting from the leaf node of the current simulation path, backtracking to the root node layer by layer, updating the number of visits and the number of wins of each node. If the current device firmware version belongs to the version set local_versions of the simulation phase, the number of wins is increased by 1; The operation of the Monte Carlo tree search method will terminate when one of the following conditions is met: 1) the version set local_versions is reduced to a unique version, and the firmware version of the device is determined; 2) the version set local_versions is no longer reduced, and the most frequently occurring version set is returned as the inference result; Determine the final version: After completing all simulations, the final firmware version needs to be determined based on the inference results of each node in the search tree. First, traverse the entire search tree and count the number of times the infer_versions set of each node appears. By traversing the versions_counts dictionary, select the version set with the most appearances as the final inference result.

2. The method for online IoT device firmware identification based on Monte Carlo search tree according to claim 1, characterized in that: The mapping relationship between the firmware version and the files it contains is established as follows: first, the firmware on the supplier's website is collected using a web crawler script, and then the firmware is decompressed using the Binwalk tool. After successful decompression, a complete file system can be obtained. Subsequently, the web page name and path in the root folder of the web page directory in the firmware file system are saved. Finally, the firmware simulation tool FirmAE is used to implement automated firmware simulation. Once the firmware simulation is successful, HTTP GET recursive requests are used to collect accessible web pages and establish a mapping relationship based on the saved web page name and path.

Images