Abnormal firmware identification method and device, equipment, storage medium and program product

Abstract

The embodiment of the invention provides an abnormal firmware identification method and device, equipment, a storage medium and a program product. The method comprises the following steps: acquiring an identifier and equipment information of target firmware sent by a client; matching the identifier of the target firmware based on a dynamic information base to obtain a matching result, the dynamic information base comprising a plurality of firmware identifiers appearing in a historical duration closest to the current moment; under the condition that the matching result is that matching fails, the identification of the target firmware is added into the dynamic information base, the first occurrence frequency of the identification of the target firmware in the first time period is obtained, the starting moment of the first time period is the current moment, and the duration is the first duration; and under the condition that the first occurrence frequency is smaller than or equal to a first frequency threshold value, determining whether the target firmware is abnormal firmware or not according to the configuration information and the equipment information. The method is used for achieving the effect of improving the accuracy of abnormal firmware recognition.

Description

Technical Field

[0001] The application relates to the field of computer technology, and in particular to an abnormal firmware identification method, device, device, storage medium and program product. Background Art

[0002] Firmware is software written into a hardware device, usually stored in an Electrically Erasable Programmable Read-Only Memory (EEPROM) or flash memory (FLASH) chip in the device. Firmware can be used to control applications and system functions in real time to ensure the normal operation of the device. If there is a problem with the device's firmware (for example, the firmware information has been tampered with), the security of the device cannot be guaranteed.

[0003] At present, the servers of each device provider need to promptly identify the client's abnormal firmware to avoid the security problems caused by these abnormal firmware to the device.

[0004] However, the methods in the related art have less accuracy when identifying abnormal firmware. Summary of the invention

[0005] The embodiments of the present application provide abnormal firmware identification methods, devices, equipment, storage media and program products to achieve the effect of improving the accuracy of abnormal firmware identification.

[0006] First aspect, the embodiment of the present application provides an abnormal firmware recognition method, the method comprising:

[0007] Get the identification and device information of the target firmware sent by the client;

[0008] Based on the dynamic information database, the target firmware identification is matched to obtain the matching result, and the dynamic information database includes multiple firmware identifications that appear within the historical time that are closest to the current time;

[0009] In the case where the matching result is a match failure, adding the identifier of the target firmware to the dynamic information library, and obtaining a first occurrence frequency of the identifier of the target firmware in a first time period, wherein the start time of the first time period is the current time and the duration is a first duration;

[0010] When the first occurrence frequency is less than or equal to the first frequency threshold, it is determined whether the target firmware is an abnormal firmware based on the configuration information and the device information.

[0011] In one possible implementation, based on configuration information and device information, it is determined whether the target firmware is abnormal firmware, including:

[0012] According to at least one field, at least one sub-information is determined in the device information;

[0013] In the configuration information, a filtering rule corresponding to each field is determined;

[0014] For any field, the filtering result of the field is determined based on the sub-information and filtering rules corresponding to the field;

[0015] Determine whether the target firmware is an abnormal firmware based on the filtering result of the at least one field.

[0016] In one possible embodiment, the number of the at least one field is a plurality; determining whether the target firmware is an abnormal firmware based on the filtering result of the at least one field, including:

[0017] If the filtering result of each field in multiple fields is passed, it is determined that the target firmware is normal firmware;

[0018] If the filtering result of at least one of the multiple fields is that the filtering fails, it is determined that the target firmware is abnormal firmware.

[0019] In a possible implementation, the method further includes:

[0020] When the first occurrence frequency is less than or equal to the first frequency threshold, obtaining a second occurrence frequency of the target firmware identifier in a second time period, where the start time of the second time period is the current time and the duration is a second duration, and the second duration is greater than the first duration;

[0021] If the second occurrence frequency is less than or equal to the second frequency threshold, it is determined whether the target firmware is abnormal firmware based on the configuration information and the device information;

[0022] If the second occurrence frequency is greater than the second frequency threshold, the target firmware is determined to be normal firmware.

[0023] In a possible implementation, the method further includes:

[0024] When it is determined that the target firmware is an abnormal firmware, an alarm information is generated, and the alarm information is used to indicate that the user is an abnormal firmware;

[0025] Send the warning information to the client.

[0026] In one possible embodiment, the dynamic information library further comprises historical matching records of the plurality of firmware identifications; the method further comprises:

[0027] When the matching result is a successful match, based on the identifier of the target firmware, obtaining a historical matching record of the target firmware in the dynamic information library;

[0028] The historical matching record of the target firmware is updated.

[0029] In a possible implementation manner, the dynamic information library further includes historical matching records of the multiple firmware identifiers; and the method further includes:

[0030] In the dynamic information base, determining the latest matching time of each firmware identifier;

[0031] For any moment, determining a candidate firmware identifier from the multiple firmware identifiers according to the latest matching moment of each firmware identifier and the moment, wherein the duration between the latest matching moment of the candidate firmware identifier and the moment is greater than the historical duration;

[0032] The to-be-selected firmware identifier and the historical matching record of the to-be-selected firmware identifier are deleted from the dynamic information library.

[0033] In a second aspect, an embodiment of the present application provides an abnormal firmware identification device, including:

[0034] The transceiver module is used to obtain the target firmware identification and device information sent by the client;

[0035] A processing module, configured to perform matching processing on the identification of the target firmware based on a dynamic information library to obtain a matching result, wherein the dynamic information library includes a plurality of firmware identifications that appear within a historical time period closest to a current moment;

[0036] The processing module is further configured to, when the matching result is a matching failure, add the identifier of the target firmware to the dynamic information library and obtain a first occurrence frequency of the identifier of the target firmware within a first time period, wherein the start time of the first time period is the current time and the duration is a first duration;

[0037] The processing module is further configured to determine whether the target firmware is abnormal firmware according to the configuration information and the device information when the first occurrence frequency is less than or equal to a first frequency threshold.

[0038] In a possible implementation manner, the processing module is specifically used to:

[0039] determining at least one sub-information in the device information according to at least one field;

[0040] In the configuration information, determine the screening rule corresponding to each field;

[0041] For any field, determine the screening result of the field according to the sub-information and screening rules corresponding to the field;

[0042] It is determined whether the target firmware is abnormal firmware based on the screening result of the at least one field.

[0043] In a possible implementation manner, the at least one field is multiple in number; and the processing module is further configured to:

[0044] If the screening result of each field in the plurality of fields is that the screening is passed, it is determined that the target firmware is a normal firmware;

[0045] If the screening result of at least one field among the multiple fields is that the screening fails, it is determined that the target firmware is abnormal firmware.

[0046] In a possible implementation manner, the processing module is further configured to:

[0047] When the first occurrence frequency is less than or equal to the first frequency threshold, obtaining a second occurrence frequency of the target firmware identifier in a second time period, where the start time of the second time period is the current time and the duration is a second duration, and the second duration is greater than the first duration;

[0048] If the second occurrence frequency is less than or equal to a second frequency threshold, determining whether the target firmware is abnormal firmware based on the configuration information and the device information;

[0049] If the second occurrence frequency is greater than the second frequency threshold, the target firmware is determined to be normal firmware.

[0050] In a possible implementation manner, the processing module is further configured to, when determining that the target firmware is abnormal firmware, generate warning information, wherein the warning information is used to indicate to a user that the target firmware is abnormal firmware;

[0051] The transceiver module is also used to send the alarm information to the client.

[0052] In a possible implementation manner, the dynamic information library further includes historical matching records of the multiple firmware identifiers; and the processing module is further specifically configured to:

[0053] When the matching result is a successful match, based on the identifier of the target firmware, obtaining a historical matching record of the target firmware in the dynamic information library;

[0054] The historical matching record of the target firmware is updated.

[0055] In a possible implementation manner, the dynamic information library further includes historical matching records of the multiple firmware identifiers; and the processing module is further specifically configured to:

[0056] In the dynamic information base, determining the latest matching time of each firmware identifier;

[0057] For any moment, determining a candidate firmware identifier from the multiple firmware identifiers according to the latest matching moment of each firmware identifier and the moment, wherein the duration between the latest matching moment of the candidate firmware identifier and the moment is greater than the historical duration;

[0058] The to-be-selected firmware identifier and the historical matching record of the to-be-selected firmware identifier are deleted from the dynamic information library.

[0059] In a third aspect, an embodiment of the present application provides an abnormal firmware identification device, including: a memory, a processor;

[0060] The memory stores computer-executable instructions;

[0061] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0062] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0063] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0064] The abnormal firmware identification method, device, equipment, storage medium and program product provided by the embodiment of the present application obtain the identification and equipment information of the target firmware sent by the client, and match the identification of the target firmware with multiple firmware identifications in the dynamic information library to obtain a matching result; when the matching result is a matching failure, the identification of the target firmware can be added to the dynamic information library, and the first occurrence frequency of the identification of the target firmware in the first time period can be obtained, and when the first occurrence frequency is less than or equal to the first frequency threshold, it is determined whether the target firmware is abnormal firmware according to the configuration information and the equipment information. In the above process, the identification of the target firmware can be matched through the dynamic information library, which is conducive to reducing the number of matches of the identification of the target firmware and improving the matching efficiency of the target firmware; by screening the target firmware step by step through the dynamic information library, the first frequency threshold and the configuration information, it is possible to accurately identify whether the target firmware is abnormal firmware, which is conducive to improving the accuracy of abnormal firmware identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0066] Figure 1 A schematic diagram of a scenario provided for this application;

[0067] Figure 2 One of the flowcharts of the abnormal firmware identification method provided in the embodiment of the present application;

[0068] Figure 3 A second flowchart of the abnormal firmware identification method provided in an embodiment of the present application;

[0069] Figure 4 The third flowchart of the abnormal firmware identification method provided in the embodiment of the present application;

[0070] Figure 5 A fourth flowchart of the abnormal firmware identification method provided in an embodiment of the present application;

[0071] Figure 6 A schematic diagram of the structure of an abnormal firmware identification device provided in an embodiment of the present application;

[0072] Figure 7 This is a schematic diagram of the structure of the abnormal firmware identification device provided in this application.

[0073] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0074] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0075] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0076] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and corresponding operation entrances shall be provided for users to choose to authorize or refuse.

[0077] First, the terms involved in this application are explained:

[0078] Abnormal firmware: refers to firmware that has security issues itself, or firmware that may cause security issues to mobile devices due to the security issues of the firmware itself.

[0079] Read-Only Memory Identifier (ROMID): The identifier of the firmware, like the "ID card" of the firmware, can be used to accurately identify the identity and version of the firmware.

[0080] Dynamic information library: It can be used to dynamically save the information of firmware ROMID that appeared in a certain period of time in the past. In some examples, the dynamic information library can also be called "firmware ROMID dynamic time interval information library". For example, the dynamic information library can be used to save the firmware ROMID information of the past six months.

[0081] Figure 1 A schematic diagram of a scenario provided for this application, such as Figure 1As shown, an application scenario of the present application may be: the abnormal firmware identification device may store multiple normal firmware identifiers in the information base in advance, and after the abnormal firmware identification device receives the identifier of the target firmware sent by the client, it may determine whether the identifier of the target firmware exists in the information base. If the identifier of the target firmware does not exist in the information base, the target firmware is determined to be abnormal firmware; if the identifier of the target firmware exists in the information base, it may be determined that the target firmware is normal firmware.

[0082] In combination with the above scenario, it can be seen that when the number of firmware identifiers stored in the information library is large, the speed of matching the target firmware based on the information library will be slow, reducing the matching processing efficiency of the target firmware; and for some correct firmware identifiers that are not stored in the information library in time, when the identifier of the target firmware is identified based on the information library, the normal target firmware may be identified as abnormal firmware, resulting in low accuracy in identifying the abnormal firmware.

[0083] The abnormal firmware identification method provided by the present application can match the target firmware's identifier through a dynamic information library, and the dynamic information library can be used to store multiple firmware identifiers that appear in the historical time period closest to the current moment, which is beneficial to reducing the number of matches of the target firmware's identifier and improving the matching efficiency of the target firmware; and after the identifier match of the target firmware based on the dynamic information library fails, the first occurrence frequency of the target firmware's identifier in the first time period can also be obtained, and based on the frequency threshold and the first occurrence frequency, further identify whether the target firmware is abnormal firmware; when the first occurrence frequency is less than or equal to the first frequency threshold, the target firmware can also be further identified based on the configuration information and the device information of the target firmware. The method also screens the target firmware step by step through the dynamic information library, the first frequency threshold and the configuration information to accurately identify whether the target firmware is abnormal firmware, which is beneficial to improve the accuracy of abnormal firmware identification.

[0084] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0085] Figure 2 One of the flow charts of the abnormal firmware identification method provided in the embodiment of the present application is as follows: Figure 2 As shown, the method includes:

[0086] S201. Obtain the target firmware identifier and device information sent by the client.

[0087] The identifier of the target firmware may be used to accurately identify the target firmware. For example, the identifier of the target firmware may be a ROMID.

[0088] The device information may include but is not limited to at least one of the following: the name, version number, device model, release time, update time of the target firmware, or the information of the device vendor corresponding to the target firmware. The device vendor information may include the name, enterprise code and address of the device vendor that released or manufactured the target firmware.

[0089] It is understandable that the number of clients may be one or more, and the abnormal firmware identification device may simultaneously receive firmware identifications and device information sent by multiple clients.

[0090] S202: Perform matching processing on the identification of the target firmware based on the dynamic information library to obtain a matching result.

[0091] The dynamic information library may include multiple firmware identifiers that appear within a recent historical period.

[0092] In some embodiments, the dynamic information library may also include historical matching records of multiple firmware identifiers. The historical matching records may include the historical matching times, initial matching time, and latest matching time of the firmware identifier, wherein the historical matching times may be the total number of matching times of the firmware identifier within the historical time length, the initial matching time refers to the time when the firmware identifier performs matching processing for the first time, and the latest matching time is the time when the matching processing is performed most recently from the current time.

[0093] In some embodiments, the current time may be the time when the abnormal firmware identification device calls the dynamic information library; the current time may also be the time when the abnormal firmware identification device receives the identifier and device information of the target firmware sent by the client.

[0094] In some embodiments, the user can determine the history duration based on the firmware identification update duration and / or storage requirements. It is understandable that the history duration can be set according to the firmware identification update duration. For example, if the firmware identification update duration is 6 months, the history duration can be set to 6 months. In the case of a small storage capacity of the device, the history duration can be set shorter, for example, the history duration can be set to 3 months.

[0095] For example, the current time is 15:00 on December 1, 2024, and the historical period is 6 months. The dynamic information library can store multiple firmware identifiers that appeared between 15:00 on June 1, 2024 and 15:00 on December 1, 2024, and the historical matching records corresponding to each firmware identifier.

[0096] The matching result can be a successful match or a failed match.

[0097] S203: When the matching result is a match failure, add the identifier of the target firmware to the dynamic information library, and obtain the first occurrence frequency of the identifier of the target firmware in the first time period.

[0098] It is understandable that if the matching result is a match failure, it means that the identifier of the target firmware is not stored in the dynamic information library. In this case, the target firmware may be abnormal firmware, or it may be normal firmware newly released or updated by the equipment manufacturer that has not yet been stored in the dynamic information library. If the target firmware is normal firmware newly released or updated by the equipment manufacturer, the identifier of the target firmware may be repeatedly recognized by the abnormal firmware identification device in a short period of time. In view of this feature, the abnormal firmware identification device can add the identifier of the target firmware to the dynamic information library and continue to monitor the first occurrence frequency of the identifier of the target firmware within the first period of time to further determine whether the target firmware is abnormal firmware.

[0099] The starting time of the first time period is the current time, and the duration is the first duration.

[0100] The user can set the first duration based on business needs. For example, in some scenarios where higher business security levels are required, the first duration can be set shorter to avoid a significant impact on business security when the target firmware is abnormal firmware.

[0101] Exemplarily, the first duration may be 1 hour.

[0102] In some embodiments, if the matching result is a match failure, a matching record of the target firmware identifier may also be stored in the dynamic information library. For example, the initial matching time and the latest matching time of the target firmware identifier may be determined at the current time, and the number of historical matches may be recorded as 1.

[0103] S204: When the first occurrence frequency is less than or equal to the first frequency threshold, determine whether the target firmware is abnormal firmware according to the configuration information and the device information.

[0104] The configuration information may include a screening rule corresponding to at least one field. Exemplarily, the at least one field may include at least one of the following: the name, version number, device model, release time, update time of the target firmware, or information of the device vendor corresponding to the target firmware.

[0105] For any field, the filter rule corresponding to the field can be used to indicate the standard value corresponding to the field.

[0106] The user can set the first frequency threshold based on historical data and / or security usage policy. Assuming that the target firmware is a newly updated firmware by the equipment manufacturer, if the historical usage scope of the target firmware is large, the identification of the target firmware may be easily recognized by the abnormal firmware identification device within the first period of time. In this case, the first frequency threshold can be set larger. If the historical usage scope of the target firmware is small, the identification of the target firmware may not be easily recognized by the abnormal firmware identification device within the first period of time. In this case, the first frequency threshold can be set smaller.

[0107] In some embodiments, when the first occurrence frequency is less than or equal to the first frequency threshold, the second occurrence frequency of the target firmware identification within the second time period is obtained; if the second occurrence frequency is less than or equal to the second frequency threshold, it is determined whether the target firmware is abnormal firmware based on the configuration information and the device information; if the second occurrence frequency is greater than the second frequency threshold, it is determined that the target firmware is normal firmware.

[0108] The start time of the second time period is the current time, the duration is the second duration, and the second duration is greater than the first duration.

[0109] The process of determining the second frequency threshold may refer to the process of determining the first frequency threshold, which will not be described in detail here.

[0110] In order to ensure accurate identification of abnormal firmware, the method may also use a second time period with a longer duration to continue monitoring the second occurrence frequency of the target firmware's identification when the first occurrence frequency is less than the first frequency threshold. When the first occurrence frequency is greater than the first frequency threshold or the second occurrence frequency is greater than the second frequency threshold, it can be determined that the target firmware may be newly released or updated firmware by the equipment manufacturer, so that the client can update the information of the target firmware in batches. In this case, the target firmware can be determined as normal firmware.

[0111] It should be noted that the process of determining whether the target firmware is abnormal firmware based on the configuration information and device information will be described in Figure 3 The details are described in the examples.

[0112] The abnormal firmware identification method provided by the present application can match the identification of the target firmware through a dynamic information library. The dynamic information library can be used to store multiple firmware identifications that appear within the historical time period closest to the current moment, which is beneficial to reducing the number of matches of the identification of the target firmware and improving the matching efficiency of the target firmware; and the method also screens the target firmware step by step through the dynamic information library, frequency threshold and configuration information to accurately identify whether the target firmware is abnormal firmware, which is beneficial to improving the accuracy of identifying abnormal firmware.

[0113] The above embodiment relates to a process of determining whether the target firmware is abnormal firmware according to configuration information and device information. Figure 3 The process is described in detail in the following embodiments.

[0114] Figure 3 This is a flowchart of the abnormal firmware identification method provided in the embodiment of the present application. Figure 3 In this embodiment, Figure 2 Based on the embodiment, a method for identifying abnormal firmware is described in detail, and the method includes:

[0115] S301. Determine at least one sub-information in device information according to at least one field.

[0116] It should be noted that, in this embodiment, at least one includes one or more, and a plurality includes 2 or more.

[0117] Exemplarily, the at least one field may include at least one of the following: the name, version number, device model, release time, update time of the target firmware, or information of the device vendor corresponding to the target firmware.

[0118] In some embodiments, sub-information corresponding to each field may be extracted from the device information based on a keyword extraction method.

[0119] For example, if the field is a version number, the sub-information may be version 1.

[0120] S302: Determine the screening rule corresponding to each field in the configuration information.

[0121] In some embodiments, the user can formulate screening rules corresponding to each field based on the firmware knowledge base and security policy to ensure the security of the firmware and the device.

[0122] Optionally, the filtering rule may be used to indicate a standard value corresponding to a field, and the filtering rule may also be used to indicate a filtering condition for the standard value.

[0123] For example, if the field is a version number and the standard value can be version 4, the filtering rule can be: version 4; the filtering rule can also be: any version between version 2 and version 4.

[0124] S303: For any field, determine the screening result of the field according to the sub-information and screening rules corresponding to the field.

[0125] The screening result can be either passed or failed.

[0126] In some embodiments, if the sub-information corresponding to the field is the same as the standard value in the filtering rule, or the sub-information corresponding to the field meets the filtering conditions of the standard value in the filtering rule, the filtering result is determined to be passed; if the sub-information corresponding to the field is different from the standard value in the filtering rule, or the sub-information corresponding to the field does not meet the filtering conditions of the standard value in the filtering rule, the filtering result is determined to be failed.

[0127] S304: Determine whether the target firmware is abnormal firmware based on the screening result of at least one field.

[0128] In some embodiments, if the number of at least one field is multiple, the following method can be used to determine whether the target firmware is abnormal firmware: if the screening result of each field in the multiple fields is that the screening is passed, the target firmware is determined to be normal firmware; if the screening result of at least one field in the multiple fields is that the screening is not passed, the target firmware is determined to be abnormal firmware.

[0129] It can be understood that when the screening result of each field is passed, the target firmware may be normal firmware that has not yet been stored in the dynamic information library, newly released or updated by the equipment manufacturer, and no processing is required; when the screening result of at least one field is failed, the target firmware may be abnormal and needs to be processed as soon as possible to avoid security issues caused by the target firmware.

[0130] The abnormal firmware identification method provided in the embodiment of the present application can accurately identify whether the target firmware is abnormal firmware based on device information and configuration information, which is conducive to improving the accuracy of abnormal firmware identification.

[0131] Figure 4 This is a flowchart of the abnormal firmware identification method provided in the embodiment of the present application. Figure 4 In this embodiment, Figure 2 Based on the embodiment, a method for identifying abnormal firmware is described in detail, and the method includes:

[0132] S401: Obtain the target firmware identifier and device information sent by the client.

[0133] S402: Perform matching processing on the identification of the target firmware based on the dynamic information library to obtain a matching result.

[0134] The dynamic information library may include multiple firmware identifiers that appear within a recent historical period.

[0135] S403: When the matching result is a matching failure, add the identifier of the target firmware to the dynamic information library.

[0136] It should be noted that the specific execution process of steps S401 to S403 may refer to the specific execution process of steps S201 to S203, which will not be described in detail here.

[0137] S404: When the matching result is a successful match, based on the identifier of the target firmware, obtain the historical matching record of the target firmware in the dynamic information library, and update the historical matching record of the target firmware.

[0138] Optionally, if the matching result is a successful match, the historical matching record of the target firmware may be updated in the following manner: updating the historical matching times of the target firmware's identifier; determining the current time as the latest matching time of the target firmware's identifier.

[0139] S405: Obtain a first occurrence frequency of the target firmware identifier within a first period of time.

[0140] The abnormal firmware identification device may be provided with a counting module, and the first occurrence frequency of the identifier of each target firmware may be recorded by the counting module.

[0141] The starting time of the first time period is the current time, and the duration is the first duration.

[0142] The first time period may be a time period within one hour after the current time. For example, the current time is 15:00, the first time period is 1 hour, and the first time period may be 15:00-16:00.

[0143] S406: When the first occurrence frequency is greater than a first frequency threshold, determine the target firmware as normal firmware.

[0144] It can be understood that when the first occurrence frequency is greater than the first frequency threshold, it can be determined that the target firmware may be newly released or updated firmware by the equipment manufacturer, so that the client updates the information of the target firmware in batches. In this case, the target firmware can be determined as normal firmware.

[0145] S407: When the first occurrence frequency is less than or equal to the first frequency threshold, determine whether the target firmware is abnormal firmware according to the configuration information and the device information.

[0146] It should be noted that the process of determining whether the target firmware is abnormal firmware according to the configuration information and the device information can refer to the specific execution process of steps S301 to S304, which will not be repeated here.

[0147] S408: When it is determined that the target firmware is abnormal firmware, generate alarm information.

[0148] The warning information may be used to indicate that the target firmware is abnormal firmware.

[0149] The warning information may include an identifier of the target firmware and / or an identifier of a device where the target firmware is located.

[0150] S409: Send warning information to the client.

[0151] The method sends an alarm message to the client so that the client can process the target firmware in time to ensure the security of the client's device.

[0152] In some scenarios, some users perform some non-compliant operations through the target firmware. The abnormal firmware identification device can send an alarm message to the client in time when it identifies that the target firmware is abnormal firmware, so that the client can intercept and process the operations corresponding to the target firmware in time to avoid the abnormal firmware from having an adverse effect on the client's device.

[0153] It is understandable that the client can be a client corresponding to the staff of the security technology center, for example, the client can be the mobile phone or computer of the staff. The abnormal firmware identification device can push the alarm information to the mobile phone or computer of the staff, so that the staff can find the abnormality of the target firmware in time. The staff can further manually check the target firmware. If the target firmware is still determined to be abnormal firmware after manual check, the target firmware can be disabled.

[0154] The abnormal firmware identification method provided by the present application can match the identification of the target firmware through a dynamic information library. The dynamic information library can be used to store multiple firmware identifications that appear within the historical time period closest to the current moment, which is beneficial to reducing the number of matches of the identification of the target firmware and improving the matching efficiency of the target firmware; and the method also screens the target firmware step by step through the dynamic information library, frequency threshold and configuration information to accurately identify whether the target firmware is abnormal firmware, which is beneficial to improving the accuracy of identifying abnormal firmware.

[0155] In some embodiments, the abnormal firmware identification method provided in the embodiment of the present application can also update the dynamic information library. Figure 5 Describes in detail the process of updating the dynamic information base.

[0156] Figure 5 This is a flowchart of the abnormal firmware identification method provided in the embodiment of the present application. Figure 5 , the method comprising:

[0157] S501: Determine the latest matching time of each firmware identifier in a dynamic information library.

[0158] The abnormal firmware identification device can determine the latest matching time of each firmware identifier according to the historical matching record of each firmware identifier.

[0159] S502: For any time, determine a firmware identifier to be selected from multiple firmware identifiers according to the latest matching time and time of each firmware identifier.

[0160] The duration between the latest matching time and the time of the candidate firmware identifier is greater than the historical duration.

[0161] The number of firmware identifiers to be selected may be 0, 1 or more. It is understandable that, when the number of firmware identifiers to be selected is 0, it means that the firmware identifiers in the dynamic information library are firmware identifiers that are still in use within the historical period, and steps S501 and S502 may be repeatedly performed until the number of firmware identifiers to be selected is greater than or equal to 1; when the number of firmware identifiers to be selected is 1 or more, step S503 may be performed.

[0162] It should be noted that the anomaly identification device can update the dynamic information library in real time, and the moment can be any moment in the real-time update process; the anomaly identification device can also periodically update the dynamic information library, and the moment can be any update moment in the periodic update process.

[0163] S503: Delete the identifier of the firmware to be selected and the historical matching record of the identifier of the firmware to be selected in the dynamic information library.

[0164] In some embodiments, when the number of candidate firmware identifiers reaches a threshold, the abnormal firmware identification device may perform a batch deletion operation to delete the candidate firmware identifiers and the historical matching records of the candidate firmware identifiers; the abnormal firmware identification device may also delete the candidate firmware identifiers in real time.

[0165] The abnormal firmware identification method provided in the embodiment of the present application can update the dynamic information library to promptly delete some firmware identifiers that have not been used for a long time in the dynamic information library, thereby reducing the number of firmware identifiers stored in the dynamic information library, thereby helping to reduce the number of matches of the abnormal firmware identification device for the target firmware identifier based on the dynamic information library, and improving the matching efficiency of the target firmware.

[0166] Figure 6 This is a schematic diagram of the structure of an abnormal firmware identification device provided in an embodiment of the present application. Figure 6 , the abnormal firmware identification device 60 may include:

[0167] The transceiver module 61 is used to obtain the target firmware identification and device information sent by the client;

[0168] A processing module 62 is used to perform matching processing on the identifier of the target firmware based on a dynamic information library to obtain a matching result, wherein the dynamic information library includes multiple firmware identifiers that appear within a historical time period closest to the current moment;

[0169] The processing module 62 is further configured to, when the matching result is a matching failure, add the identifier of the target firmware to the dynamic information library and obtain a first occurrence frequency of the identifier of the target firmware within a first time period, wherein the start time of the first time period is the current time and the duration is a first duration;

[0170] The processing module 62 is further configured to determine whether the target firmware is abnormal firmware according to the configuration information and the device information when the first occurrence frequency is less than or equal to a first frequency threshold.

[0171] In a possible implementation manner, the processing module 62 is specifically configured to:

[0172] determining at least one sub-information in the device information according to at least one field;

[0173] In the configuration information, determine the screening rule corresponding to each field;

[0174] For any field, determine the screening result of the field according to the sub-information and screening rules corresponding to the field;

[0175] It is determined whether the target firmware is abnormal firmware based on the screening result of the at least one field.

[0176] In a possible implementation manner, the at least one field is multiple; the processing module 62 is further configured to:

[0177] If the screening result of each field in the plurality of fields is that the screening is passed, it is determined that the target firmware is a normal firmware;

[0178] If the screening result of at least one field among the multiple fields is that the screening fails, it is determined that the target firmware is abnormal firmware.

[0179] In a possible implementation manner, the processing module 62 is further configured to:

[0180] When the first occurrence frequency is less than or equal to the first frequency threshold, obtaining a second occurrence frequency of the target firmware identifier in a second time period, where the start time of the second time period is the current time and the duration is a second duration, and the second duration is greater than the first duration;

[0181] If the second occurrence frequency is less than or equal to a second frequency threshold, determining whether the target firmware is abnormal firmware based on the configuration information and the device information;

[0182] If the second occurrence frequency is greater than the second frequency threshold, the target firmware is determined to be normal firmware.

[0183] In a possible implementation manner, the processing module 62 is further configured to, when determining that the target firmware is abnormal firmware, generate warning information, wherein the warning information is used to indicate to a user that the target firmware is abnormal firmware;

[0184] The transceiver module 61 is further used to send the alarm information to the client.

[0185] In a possible implementation manner, the dynamic information library further includes historical matching records of the multiple firmware identifiers; and the processing module 62 is further specifically configured to:

[0186] When the matching result is a successful match, based on the identifier of the target firmware, obtaining a historical matching record of the target firmware in the dynamic information library;

[0187] The historical matching record of the target firmware is updated.

[0188] In a possible implementation manner, the dynamic information library further includes historical matching records of the multiple firmware identifiers; and the processing module 62 is further specifically configured to:

[0189] In the dynamic information base, determining the latest matching time of each firmware identifier;

[0190] For any moment, determining a candidate firmware identifier from the multiple firmware identifiers according to the latest matching moment of each firmware identifier and the moment, wherein the duration between the latest matching moment of the candidate firmware identifier and the moment is greater than the historical duration;

[0191] The to-be-selected firmware identifier and the historical matching record of the to-be-selected firmware identifier are deleted from the dynamic information library.

[0192] The abnormal firmware identification device provided in this embodiment can execute the method provided in the above method embodiment, and its implementation principle and technical effect are similar, which will not be described in detail in this embodiment.

[0193] Figure 7 This is a schematic diagram of the structure of the abnormal firmware identification device provided by this application. Figure 7As shown, the abnormal firmware identification device 70 provided in this embodiment includes: at least one processor 701 and a memory 702. Optionally, the abnormal firmware identification device 70 also includes a communication component 703. The processor 701, the memory 702 and the communication component 703 are connected via a bus 704.

[0194] In a specific implementation process, at least one processor 701 executes the computer-executable instructions stored in the memory 702, so that at least one processor 701 executes the above method.

[0195] The specific implementation process of the processor 701 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0196] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.

[0197] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0198] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0199] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0200] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0201] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0202] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0203] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0204] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0205] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0206] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0207] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0208] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for identifying abnormal firmware, characterized in that: The method comprises: Get the target firmware identification and device information sent by the client; Performing matching processing on the identification of the target firmware based on a dynamic information library to obtain a matching result, wherein the dynamic information library includes multiple firmware identifications that appear within a historical time period closest to a current moment; When the matching result is a match failure, adding the identifier of the target firmware to the dynamic information library, and obtaining a first occurrence frequency of the identifier of the target firmware in a first time period, wherein the start time of the first time period is the current time and the duration is a first duration; When the first occurrence frequency is less than or equal to a first frequency threshold, it is determined whether the target firmware is abnormal firmware according to the configuration information and the device information.

2. The method according to claim 1, characterized in that Determining whether the target firmware is abnormal firmware according to the configuration information and the device information includes: determining at least one sub-information in the device information according to at least one field; In the configuration information, determine the screening rule corresponding to each field; For any field, determine the screening result of the field according to the sub-information and screening rules corresponding to the field; It is determined whether the target firmware is abnormal firmware based on the screening result of the at least one field.

3. The method according to claim 2, characterized in that The number of the at least one field is multiple; determining whether the target firmware is an abnormal firmware based on the screening result of the at least one field includes: If the screening result of each field in the plurality of fields is that the screening is passed, it is determined that the target firmware is a normal firmware; If the screening result of at least one field among the multiple fields is that the screening fails, it is determined that the target firmware is abnormal firmware.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: When the first occurrence frequency is less than or equal to the first frequency threshold, obtaining a second occurrence frequency of the target firmware identifier in a second time period, where the start time of the second time period is the current time and the duration is a second duration, and the second duration is greater than the first duration; If the second occurrence frequency is less than or equal to a second frequency threshold, determining whether the target firmware is abnormal firmware based on the configuration information and the device information; If the second occurrence frequency is greater than the second frequency threshold, the target firmware is determined to be normal firmware.

5. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: In the case where it is determined that the target firmware is abnormal firmware, generating alarm information, wherein the alarm information is used to indicate to a user that the target firmware is abnormal firmware; Send the warning information to the client.

6. The method according to any one of claims 1 to 3, characterized in that: The dynamic information library also includes historical matching records of the multiple firmware identifiers; the method also includes: When the matching result is a successful match, based on the identifier of the target firmware, obtaining a historical matching record of the target firmware in the dynamic information library; The historical matching record of the target firmware is updated.

7. The method according to any one of claims 1 to 3, characterized in that: The dynamic information library also includes historical matching records of the multiple firmware identifiers; the method also includes: In the dynamic information base, determining the latest matching time of each firmware identifier; For any moment, determining a candidate firmware identifier from the multiple firmware identifiers according to the latest matching moment of each firmware identifier and the moment, wherein the duration between the latest matching moment of the candidate firmware identifier and the moment is greater than the historical duration; The to-be-selected firmware identifier and the historical matching record of the to-be-selected firmware identifier are deleted from the dynamic information library.

8. An abnormal firmware identification device, characterized in that: include: The transceiver module is used to obtain the target firmware identification and device information sent by the client; A processing module, configured to perform matching processing on the identification of the target firmware based on a dynamic information library to obtain a matching result, wherein the dynamic information library includes a plurality of firmware identifications that appear within a historical time period closest to a current moment; The processing module is further configured to, when the matching result is a matching failure, add the identifier of the target firmware to the dynamic information library and obtain a first occurrence frequency of the identifier of the target firmware within a first time period, wherein the start time of the first time period is the current time and the duration is a first duration; The processing module is further configured to determine whether the target firmware is abnormal firmware according to the configuration information and the device information when the first occurrence frequency is less than or equal to a first frequency threshold.

9. An abnormal firmware identification device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

11. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 7 when being executed by a processor.

Images