PLC program vulnerability detection method and system, electronic equipment and storage medium

Abstract

The invention discloses a PLC program vulnerability detection method and system, electronic equipment and a storage medium, and the method comprises the steps: obtaining a control program file through the output of a development platform, and obtaining a dangerous function fingerprint database based on the construction of the development platform; decompiling the control program file to obtain a dynamic function library; performing static stain analysis processing on the dynamic function library according to the danger function fingerprint library to obtain a stain variable set; performing symbolic execution processing on the control program file according to the taint variable set, and constructing a data dependency graph according to a symbolic execution result; and performing vulnerability detection processing on the data dependency graph according to a preset detection rule to obtain a detection result. The embodiment of the invention can improve the accuracy of vulnerability detection, and can be widely applied to the technical field of software security.

Description

Technical Field

[0001] The present application relates to the field of software security technology, and in particular to a PLC program vulnerability detection method, system, electronic device, and storage medium. Background Art

[0002] A programmable logic controller (PLC) is a digital computer designed for industrial automation control and can be widely used in various industrial environments, including manufacturing, energy, and transportation. Related technologies exist for detecting vulnerabilities in PLC programs, using code inspection tools or debugging tools to perform vulnerability detection on program execution. However, in actual applications, these methods have been found to misidentify some normal code structures as vulnerabilities when faced with complex logic, resulting in a high false positive rate during vulnerability detection.

[0003] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the Invention

[0004] The main purpose of the embodiments of the present application is to propose a PLC program vulnerability detection method, system, electronic device and storage medium, which can improve the accuracy of vulnerability detection.

[0005] To achieve the above objectives, an embodiment of the present application provides a method for detecting PLC program vulnerabilities, the method comprising:

[0006] Obtaining a control program file through the development platform output, and constructing a dangerous function fingerprint library based on the development platform;

[0007] Decompiling the control program file to obtain a dynamic function library;

[0008] Performing static taint analysis on the dynamic function library according to the dangerous function fingerprint library to obtain a tainted variable set;

[0009] Performing symbolic execution processing on the control program file according to the set of tainted variables, and constructing a data dependency graph according to the symbolic execution result;

[0010] Vulnerability detection is performed on the data dependency graph according to preset detection rules to obtain detection results.

[0011] In some embodiments, the step of constructing a dangerous function fingerprint library based on the development platform includes the following steps:

[0012] Defining string operation functions and memory operation functions in the development platform as dangerous functions;

[0013] Performing assembly instruction extraction processing on the dangerous function to obtain an instruction operator;

[0014] The instruction operator is encrypted to obtain the dangerous function fingerprint library.

[0015] In some embodiments, decompiling the control program file to obtain a dynamic function library includes the following steps:

[0016] Compiling and parsing the control program file to obtain a binary stream;

[0017] Performing assembly instruction comparison processing on the binary stream to obtain a decompiled file;

[0018] Perform function identification processing on the decompiled file to obtain the dynamic function library.

[0019] In some embodiments, performing static taint analysis on the dynamic function library according to the dangerous function fingerprint library to obtain a tainted variable set includes the following steps:

[0020] Performing positioning processing on the dynamic function library according to the dangerous function fingerprint library to obtain an input function;

[0021] Marking the received data of the input function to obtain a taint source;

[0022] Performing taint propagation analysis on the taint source according to the assembly instruction type of the input function to obtain the taint variable set.

[0023] In some embodiments, performing symbolic execution on the control program file according to the set of tainted variables and constructing a data dependency graph according to the symbolic execution results includes the following steps:

[0024] Performing breakpoint setting processing on a symbolic execution engine according to the set of tainted variables, and performing simulation execution processing on the control program file according to the symbolic execution engine to obtain a symbolic execution result;

[0025] Performing breakpoint instruction analysis on the symbolic execution result to obtain memory addresses and memory operations;

[0026] Node construction processing is performed according to the memory address and the memory operation to obtain the data dependency graph.

[0027] In some embodiments, performing vulnerability detection on the data dependency graph according to preset detection rules to obtain detection results includes the following steps:

[0028] Analyzing and processing the control program file to obtain a control program stack;

[0029] Performing node dependency analysis on the data dependency graph according to the control program stack to obtain memory dependency nodes;

[0030] According to preset detection rules, program crash vulnerability analysis and constant modification vulnerability analysis are performed on the memory dependent node to obtain the detection result.

[0031] In some embodiments, performing program crash vulnerability analysis and constant modification vulnerability analysis on the memory-dependent node according to preset detection rules to obtain the detection result includes the following steps:

[0032] Determine a memory modification node according to the memory dependency node;

[0033] When the memory modification node is in the runtime stack, a loop start judgment is performed on the memory modification node to obtain a program crash vulnerability;

[0034] When the memory modification node is separated from the runtime stack, a constant modification judgment is performed on the memory modification node to obtain a constant modification vulnerability;

[0035] The detection result is determined according to the program crash vulnerability and the constant modification vulnerability.

[0036] To achieve the above objectives, another aspect of the present application provides a PLC program vulnerability detection system, the system comprising:

[0037] The first module is used to obtain a control program file through the output of the development platform, and to construct a dangerous function fingerprint library based on the development platform;

[0038] The second module is used to decompile the control program file to obtain a dynamic function library;

[0039] A third module is configured to perform static taint analysis on the dynamic function library according to the dangerous function fingerprint library to obtain a tainted variable set;

[0040] A fourth module is configured to perform symbolic execution processing on the control program file according to the set of tainted variables, and construct a data dependency graph according to the symbolic execution result;

[0041] The fifth module is used to perform vulnerability detection on the data dependency graph according to preset detection rules to obtain detection results.

[0042] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application provides an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-mentioned method when executing the computer program.

[0043] To achieve the above objectives, another aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0044] Embodiments of the present application include at least the following beneficial effects: The present application provides a PLC program vulnerability detection method, system, electronic device, and storage medium. This solution obtains a control program file through the output of a development platform and constructs a dangerous function fingerprint library based on the development platform. This dangerous function fingerprint library can be used to quickly identify vulnerabilities in the control program. Furthermore, this solution decompiles the control program file to obtain a dynamic function library. Based on the dangerous function fingerprint library, this dynamic function library is subjected to static taint analysis to obtain a set of tainted variables. This taint analysis technique can be used to track the impact of input variables on temporary variables to detect buffer overflow vulnerabilities caused by temporary variables, thereby improving vulnerability detection accuracy. Furthermore, this solution performs symbolic execution on the control program file based on the tainted variable set and constructs a data dependency graph based on the symbolic execution results. Vulnerability detection is then performed on the data dependency graph according to preset detection rules to obtain detection results. This detection rule-based traversal of the data dependency graph can be used to assess memory vulnerabilities, thereby improving vulnerability detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a flow chart of a PLC program vulnerability detection method provided by an embodiment of the present application;

[0046] Figure 2 This is a flow chart of a stain analysis provided by an embodiment of the present application;

[0047] Figure 3 This is a flow chart of a PLC program vulnerability detection based on detection rules provided by an embodiment of the present application;

[0048] Figure 4 This is an overall framework diagram of a PLC program vulnerability detection provided by an embodiment of the present application;

[0049] Figure 5 This is a structural diagram of a PLC program vulnerability detection system provided by an embodiment of the present application;

[0050] Figure 6 This is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are merely examples of systems and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.

[0052] It will be understood that the terms "first", "second", etc. used in this application may be used herein to describe various concepts, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0053] The terms "at least one", "plurality", "each", "any", etc. used in this application include "at least one", "two" or more, "plurality" or "each", "any" or "any one", "each" or "any one" as used herein.

[0054] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0055] Before explaining the embodiments of the present application in detail, some of the nouns and terms involved in the embodiments of the present application are first explained. The nouns and terms involved in the embodiments of the present application are subject to the following explanations.

[0056] A programmable logic controller (PLC) is a digital computer designed specifically for industrial automation control. PLCs are widely used in various industrial environments, including manufacturing, energy, and transportation, for automated production lines, machine control, and factory equipment monitoring. Their core functions include logic control, timing, counting, and sequential control. The advantages of PLCs lie in their high reliability, robust interference immunity, ease of programming, and wide adaptability, effectively improving production efficiency and product quality. Security vulnerabilities associated with PLC devices can be categorized into three main categories: network security vulnerabilities, software and programming vulnerabilities, and physical security vulnerabilities.

[0057] In the related art, there is a method of static code analysis, which uses the code checking function provided by specialized PLC programming software, or third-party static analysis tools, to perform syntax and semantic checks on PLC program code. Check whether there are syntax errors, undefined variables, logical conflicts and other problems in the code. For example, in ladder diagram programming, check whether there are unconnected contacts or coils, and whether the logical jumps are reasonable. However, in actual applications, it is found that static analysis cannot detect vulnerabilities that exist in the program during runtime, such as dynamic memory allocation errors, concurrent operation problems, etc.; for complex PLC program logic, static analysis has difficulty in accurately identifying logical vulnerabilities from the code, affecting the accuracy of vulnerability detection.

[0058] For example, because industrial control equipment communication protocols and file formats are mostly proprietary, current PLC vulnerability detection primarily relies on abnormal host computer traffic detection and industrial control protocol fuzz testing. However, vulnerabilities in PLC control programs are often overlooked. Because PLC control application binaries are compiled from high-level PLC programming languages using proprietary compilers, loaded by proprietary runtime software, and executed as a process within the PLC operating system, PLC applications, like common binary programs like PE and ELF, are susceptible to buffer overflow vulnerabilities, which can significantly impact industrial processes.

[0059] In view of this, embodiments of the present application provide a PLC program vulnerability detection method, system, electronic device, and storage medium. This solution obtains a control program file through the output of a development platform and constructs a dangerous function fingerprint library based on the development platform. This dangerous function fingerprint library can be used to quickly identify vulnerabilities in the control program. Furthermore, this solution decompiles the control program file to obtain a dynamic function library. Based on the dangerous function fingerprint library, this dynamic function library is subjected to static taint analysis to obtain a set of tainted variables. This taint analysis technique can be used to track the impact of input variables on temporary variables to detect buffer overflow vulnerabilities caused by temporary variables, thereby improving vulnerability detection accuracy. Furthermore, this solution performs symbolic execution on the control program file based on the tainted variable set and constructs a data dependency graph based on the symbolic execution results. Vulnerability detection is then performed on the data dependency graph according to preset detection rules to obtain detection results. This detection rule-based traversal of the data dependency graph can be used to assess memory vulnerabilities, thereby improving vulnerability detection accuracy.

[0060] The present application provides a method for detecting a PLC program vulnerability, which relates to the field of software security technology. The present application provides a method for detecting a PLC program vulnerability, which can be applied to a PLC control device, or can be software running on the PLC control device. In some embodiments, the PLC control device can be a logic control device, a motion control device, a process control device, etc., and can be used in application scenarios such as production line control, automation control, and transportation control. The software can be an application that implements a method for detecting a PLC program vulnerability, but is not limited to the above forms.

[0061] Figure 1 This is an optional flowchart of a PLC program vulnerability detection method provided by an embodiment of the present application. Figure 1 The method may include but is not limited to steps S101 to S105.

[0062] Step S101: obtaining a control program file through a development platform output, and constructing a dangerous function fingerprint library based on the development platform;

[0063] Step S102, decompiling the control program file to obtain a dynamic function library;

[0064] Step S103, performing static taint analysis on the dynamic function library according to the dangerous function fingerprint library to obtain a tainted variable set;

[0065] Step S104, performing symbolic execution processing on the control program file according to the set of tainted variables, and constructing a data dependency graph according to the symbolic execution result;

[0066] Step S105 , performing vulnerability detection processing on the data dependency graph according to preset detection rules to obtain a detection result.

[0067] In steps S101 to S105 illustrated in the embodiment of this application, a control program file is outputted via a development platform. This development platform is a PLC software editing tool used to create and output a control program file, which is a programming file used to control the PLC. The PLC control application compiled by CODESYS software in this application is an executable file similar to PE and ELF files, with a file extension of PRG. This file cannot be decompiled and debugged using conventional binary file analysis tools such as IDA and GDB. However, this embodiment of the application uses the radare2 framework to decompile the PRG file according to the PRG file format to obtain a dynamic function library. Radare2 is a powerful open-source reverse engineering framework that supports multiple architectures and file formats. Furthermore, this embodiment of the application also constructs a dangerous function fingerprint library based on the development platform. This dangerous function fingerprint library can be used to quickly locate dangerous functions in the control program file, which are prone to vulnerabilities. The dangerous function fingerprint library is then used to perform static taint analysis on the dynamic function library. Static taint analysis techniques are used to locate dangerous functions in the dynamic function library and identify the source of contamination, resulting in a set of tainted variables. The control program file is then symbolically executed based on the set of tainted variables. Based on the symbolic execution results, a data dependency graph is constructed. This data dependency graph is an instruction-memory dependency graph that represents the dependency relationship between instructions and memory. Finally, vulnerability detection is performed on the data dependency graph based on pre-set vulnerability detection rules to obtain the final vulnerability detection results.

[0068] One of the above technical solutions has the following advantages or beneficial effects: the embodiment of the present application can quickly locate functions in control program files that may have vulnerabilities by constructing a dangerous function fingerprint library, providing a basis for subsequent detection. In addition, the embodiment of the present application performs static taint analysis on the dynamic function library through the dangerous function fingerprint library, and can accurately lock the variable set related to the input variable based on the static taint analysis technology, thereby discarding a large amount of irrelevant program logic and variables, simplifying the subsequent symbolic execution work. In addition, the embodiment of the present application can generate a data dependency graph related to instructions and memory by performing symbolic execution processing on the control program file based on the tainted variable set, thereby traversing the data dependency graph according to the preset detection rules to obtain malicious input vulnerabilities, thereby improving the accuracy of vulnerability detection.

[0069] In step S101 of some embodiments, constructing a dangerous function fingerprint library based on the development platform includes the following steps:

[0070] Defining string operation functions and memory operation functions in the development platform as dangerous functions;

[0071] Performing assembly instruction extraction processing on the dangerous function to obtain an instruction operator;

[0072] The instruction operator is encrypted to obtain the dangerous function fingerprint library.

[0073] In an embodiment of the present application, a dangerous function fingerprint library is obtained based on a development platform. Since in industrial control systems, some attacks are caused by exploiting inherent problems (lack of boundary checking) in the system library, which leads to exploitable vulnerabilities in the control application. Such vulnerabilities will not only affect the control binary file itself, but also affect the runtime (i.e. its monitoring software), so identifying these dangerous functions is helpful for vulnerability detection. In an embodiment of the present application, the string operation function and the memory operation function in the development platform are defined as dangerous functions. These string operation functions and the memory operation function do not limit the length of the string when operating the string, which easily leads to buffer overflow vulnerabilities. When developers use these functions, if the data length is not checked, it will cause memory security problems of the PLC and endanger the normal operation of the PLC control application. In an embodiment of the present application, assembly instruction extraction processing is performed on the dangerous function. After the binary program of the dangerous function is compiled by software, the assembly language is obtained by decompiling. The dangerous function at this time is represented in the form of a string of assembly instruction combinations, and then the instruction operators of these assembly instruction combinations are extracted to obtain the instruction operators. The instruction operators are then encrypted. The SHA-256 algorithm can be used to convert the instruction operator sequence into a fixed-length ciphertext, which is used to represent the fingerprint of the dangerous function, thereby establishing a fingerprint library of the dangerous function for locating dangerous functions in binary files.

[0074] One of the above technical solutions has the following advantages or beneficial effects: By constructing a dangerous function fingerprint library, the embodiment of the present application can quickly locate functions in control program files that may have vulnerabilities, providing a basis for subsequent detection.

[0075] In some embodiments, decompiling the control program file to obtain a dynamic function library includes the following steps:

[0076] Compiling and parsing the control program file to obtain a binary stream;

[0077] Performing assembly instruction comparison processing on the binary stream to obtain a decompiled file;

[0078] Perform function identification processing on the decompiled file to obtain the dynamic function library.

[0079] In an embodiment of the present application, a control program file can be compiled and parsed by a compiler to obtain a binary stream. The compiler can be an ARM architecture compiler, which is a 32-bit reduced instruction set processor architecture. The binary stream is then compared with ARM assembly instructions, and the PRG file is decompiled into a more readable assembly language format. By analyzing the function prologue and function epilogue in the decompiled file, the functions in the control program file can be identified. In the PRG file, dynamic library function information exists in the form of a symbol table, which stores the dynamic library function name and offset address. By analyzing the PRG file header, the storage address of the symbol table in the PRG file can be obtained, thereby obtaining the offset information of the dynamic library function. When the PRG file is disassembled, calls to the dynamic library function can be identified. It should be noted that the present application can also perform function identification on the decompiled file to obtain a global variable initialization function, which is used to implement some initialization work of the program. Because the PLC control application executes three steps in a loop: reading data from the sensor, executing the control logic code, and writing data to the actuator.

[0080] Before entering the loop execution, the PLC needs to initialize the global variables first. In the PRG file, the initialization of the variables is completed by the global variable initialization function. The offset of this function in the PRG file is fixed at 0x50 bytes. This function sets constants, global variables and initializes the functions defined in the global variable function of the PLC control application. Since developers usually define program-wide functions related to industrial production scenarios in the global variable initialization function, such as the proportional factor, PID gain and timing constant of the PID feedback function, these parameters directly affect the performance and stability of the system. The code portion that initializes the global variables will include the operation of storing the initial value in the variable storage unit. In the ARM assembly language, the definition of the variable can be traced back from the storage instruction (such as the str instruction). Therefore, the present invention determines the global variables and the address of the global variables in the memory by analyzing the global variable initialization function assembly code, making preliminary preparations for subsequent vulnerability detection.

[0081] One of the above technical solutions has the following advantages or beneficial effects: by constructing a dynamic function library, the embodiment of the present application can use the dynamic library function call as a taint convergence point in subsequent taint analysis, thereby improving the efficiency of taint analysis.

[0082] In some embodiments, performing static taint analysis on the dynamic function library according to the dangerous function fingerprint library to obtain a tainted variable set includes the following steps:

[0083] Performing positioning processing on the dynamic function library according to the dangerous function fingerprint library to obtain an input function;

[0084] Marking the received data of the input function to obtain a taint source;

[0085] Performing taint propagation analysis on the taint source according to the assembly instruction type of the input function to obtain the taint variable set.

[0086] In the embodiments of the present application, taint analysis technology is a technology that tracks and analyzes the flow of taint information in a program. It uses taint analysis technology to mark input data from outside the program. By tracking the information flow of external input data, it is possible to verify whether the external data will affect the normal execution of the program, thereby discovering program vulnerabilities. Static taint analysis refers to tracking the flow of taint sources by analyzing the control flow, grammar, lexicon, and data flow of the program without running the program. Please refer to Figure 2 In this embodiment, a dynamic function library is located based on a dangerous function fingerprint library. Assembly instructions for the functions in the dynamic function library are extracted and encrypted, and then compared with the fingerprints in the dangerous function fingerprint library to locate the input function, which is the located dangerous function. The input function's received data is then marked, and the memory area or register corresponding to the input function's received data is marked as a taint source. Taint propagation analysis is then performed on the taint source based on the input function's assembly instruction type. In a feasible embodiment, each assembly instruction is analyzed starting from the input function according to the assembly instruction type. For data movement instructions (such as mov), if the source operand is tainted data, the destination operand will be marked as tainted. For arithmetic and logical operation instructions (such as add, and, etc.), if there is tainted data in the operands involved in the operation, the operation result is also considered tainted data. For function call instructions, the analysis is based on the transfer of the called function. If tainted data is passed to the function as a parameter, the corresponding parameter is marked as tainted within the function, and the propagation of the taint within the function is further analyzed based on the instructions and logic within the function. For the return value of the function, if the return value is obtained by the operation involving tainted data, the return value is also marked as tainted. The step of taint propagation analysis of the taint source according to the assembly instruction type of the input function is repeated until all input functions are analyzed. The embodiment of the present application provides the generated tainted variable set to the symbolic execution engine. In the subsequent symbolic execution process, only the variables belonging to the tainted variable set are symbolically represented, and constraint solving and path exploration are performed along the execution path of the program, which greatly reduces the number of paths that need to be explored and improves the efficiency of vulnerability mining.

[0087] One of the above-mentioned technical solutions has the following advantages or beneficial effects: By marking the external input data of the PLC control application as a tainted source, the present embodiment can precisely target the set of variables related to the input variables, discarding a large amount of irrelevant program logic and variables, thereby simplifying subsequent symbolic execution. This eliminates the need for symbolic execution to blindly explore the vast state space of the entire program, effectively avoiding the path explosion problem caused by exhaustively enumerating all possible paths, reducing computing resource consumption and analysis time, and facilitating faster vulnerability location.

[0088] In some embodiments, performing symbolic execution on the control program file according to the set of tainted variables and constructing a data dependency graph according to the symbolic execution results includes the following steps:

[0089] Performing breakpoint setting processing on a symbolic execution engine according to the set of tainted variables, and performing simulation execution processing on the control program file according to the symbolic execution engine to obtain a symbolic execution result;

[0090] Performing breakpoint instruction analysis on the symbolic execution result to obtain memory addresses and memory operations;

[0091] Node construction processing is performed according to the memory address and the memory operation to obtain the data dependency graph.

[0092] In an embodiment of the present application, a set of tainted variables can be provided to a symbolic execution engine. During the subsequent symbolic execution process, only variables in the tainted variable set are symbolically represented and corresponding breakpoints are set. In PLC control applications, functions related to string or memory operations are often used when processing input or output variables. If the program does not properly check the length of the variables when processing these variables, the program may be at risk of overflow. For example, if the program does not restrict the length of input variable A, an attacker can construct variable A to overwrite variable B adjacent to variable A, thereby modifying the value of variable B and disrupting the normal operation of the PLC control program. In addition, when writing PLC control applications, engineers often reference external library functions, such as runtime library functions. If the bounds checking of these library functions is unreasonable, then when processing variables larger than the library function bounds, a runtime buffer overflow vulnerability will be triggered, causing more serious damage to industrial sites. To detect vulnerabilities in PLC control applications before they cause physical damage to the environment, an embodiment of the present application uses the angr symbolic execution engine to simulate the execution of a PLC control application binary file. Angr's breakpoint function is then used to set breakpoints at all instructions involving memory operations. When the program reaches a breakpoint, the memory address and memory operations designed for that instruction are recorded to generate an instruction-memory data dependency graph. Finally, starting from the control application stack, the system searches for malicious input vulnerabilities that rely on I / O mapped addresses. Specifically, any vulnerability exploit is based on real memory addresses. To obtain memory address information during normal program execution, the system requires a running memory snapshot of the program at a certain point in time. The memory snapshot contains runtime information about the development platform, the control application, shared database information, and process information. The starting address and related configuration information for the simulated program execution are then set based on the program's data segment and code segment offsets obtained during the preparation phase. Using angr's function to set breakpoints at instructions, when the program reaches a memory read, memory write, or register write operation, execution is halted and a callback function is executed, adding the operations and addresses involved in the instruction to the data dependency graph.

[0093] In PLC control applications, memory locations are used to pass parameters between functions. In the assembly language of the ARM architecture, str and ldr instructions are used to implement storage and download operations. In addition, the control logic may also modify the value loaded into the register, or pass the value to a different register (for example, the addition and subtraction instructions in the assembly language). These operations are usually designed in the boundary check, so the embodiment of the present application divides the nodes of the data dependency graph into four types: read memory operation node R: indicates that the instruction implements the operation of reading data in the memory; write memory operation node W: indicates that the instruction implements the operation of writing a value to the memory; memory node M: indicates the destination memory address for the instruction to write or read; memory modification node T: indicates that the instruction modifies the value of the memory through the register. The data dependency graph is constructed by performing node analysis on the operations and addresses on the memory in the instruction.

[0094] One of the above technical solutions has the following advantages or beneficial effects: the embodiment of the present application constructs a data dependency graph, which can display the operations and addresses of the memory in the instructions, providing a data basis for subsequent vulnerability detection.

[0095] In some embodiments, performing vulnerability detection on the data dependency graph according to preset detection rules to obtain detection results includes the following steps:

[0096] Analyzing and processing the control program file to obtain a control program stack;

[0097] Performing node dependency analysis on the data dependency graph according to the control program stack to obtain memory dependency nodes;

[0098] According to preset detection rules, program crash vulnerability analysis and constant modification vulnerability analysis are performed on the memory dependent node to obtain the detection result.

[0099] In an embodiment of the present application, in order to improve the efficiency of memory access of the PLC program, the program is usually loaded into a fixed address in the memory. For example, when the runtime file of CODESYS is loaded into the memory, its code segment, data segment, etc. are mapped to a fixed memory address. The embodiment of the present application can obtain the user program stack and the starting address of the runtime stack of the PLC program, and this address can be obtained from the configuration file. After obtaining the data dependency graph, the embodiment of the present application will start from the control application stack, traverse each memory node, and infer whether there is a vulnerability based on the dependency relationship between the nodes. In order to improve the accuracy of vulnerability detection, the preset detection rules perform program crash vulnerability analysis and constant modification vulnerability analysis on the memory dependency nodes to obtain detection results.

[0100] One of the above technical solutions has the following advantages or beneficial effects: the embodiment of the present application can evaluate inputs that may lead to malicious operations of the system by performing vulnerability detection on the data dependency graph, thereby improving the accuracy of vulnerability detection.

[0101] In some embodiments, performing program crash vulnerability analysis and constant modification vulnerability analysis on the memory-dependent node according to preset detection rules to obtain the detection result includes the following steps:

[0102] Determine a memory modification node according to the memory dependency node;

[0103] When the memory modification node is in the runtime stack, a loop start judgment is performed on the memory modification node to obtain a program crash vulnerability;

[0104] When the memory modification node is separated from the runtime stack, a constant modification judgment is performed on the memory modification node to obtain a constant modification vulnerability;

[0105] The detection result is determined according to the program crash vulnerability and the constant modification vulnerability.

[0106] In the examples of this application, please refer to Figure 3 The preset detection rules include program crash vulnerability detection and constant modification vulnerability detection. Memory modification nodes can be obtained based on the type of memory dependency nodes. When a memory modification node is on the runtime stack, it is determined whether the memory modification node is at the beginning of a loop function. If so, it is considered a program crash vulnerability. The fingerprint of the loop function is in the dangerous function fingerprint library. If the memory modification node is off the runtime stack, it is determined whether the memory modification node has a write operation on the constant. If so, it is considered a constant modification vulnerability.

[0107] The following is a detailed description of the embodiments of the present application with reference to specific application examples:

[0108] The embodiments of this application can be applied to technical fields such as software security and industrial control security, and can be applied to application scenarios related to the operation security of industrial equipment, such as vulnerability detection of real-time operating systems based on PLC firmware. Figure 4This embodiment of the present application proposes a memory PLC program vulnerability detection method based on reverse engineering of a PLC application control program. This method utilizes taint analysis and symbolic execution techniques to implement a combined static and dynamic framework for vulnerability mining in PLC control applications. First, through reverse analysis of the PLC control application, variable information of the PLC control application is extracted, a control flow graph is established, and a library of dangerous function fingerprints is constructed. Symbolic execution is then used to construct a memory-instruction dependency graph. Combined with vulnerability detection rules, this method detects buffer overflow vulnerabilities in the PLC control application caused by the lack of proper bounds checking. This embodiment of the present application proposes a method that combines static analysis with dynamic debugging to mine buffer overflow vulnerabilities in PLC control applications, improving vulnerability mining accuracy and reducing the difficulty of vulnerability mining in PLC control applications. Furthermore, static taint analysis techniques are used to track the inputs of the PLC control application and generate a set of tainted variables. The method focuses on variables or intermediate variables in the set, improving vulnerability mining efficiency and mitigating the path explosion problem that occurs when symbolic execution of the program is subsequently performed. Furthermore, symbolic execution techniques are used to simulate the running of the PLC control application, inferring the memory addresses involved in the variables, and constructing a dependency graph between assembly instructions and memory addresses. By checking register values and instructions' operations on memory data, we can discover buffer overflow vulnerabilities in PLC control applications and improve the accuracy of vulnerability detection.

[0109] See also Figure 5 The present application also provides a PLC program vulnerability detection system that can implement the above-mentioned PLC program vulnerability detection method. The system includes:

[0110] The first module 501 is configured to obtain a control program file through a development platform output, and to construct a dangerous function fingerprint library based on the development platform;

[0111] The second module 502 is used to decompile the control program file to obtain a dynamic function library;

[0112] The third module 503 is configured to perform static taint analysis on the dynamic function library according to the dangerous function fingerprint library to obtain a tainted variable set;

[0113] The fourth module 504 is configured to perform symbolic execution on the control program file according to the set of tainted variables, and construct a data dependency graph according to the symbolic execution result.

[0114] The fifth module 505 is configured to perform vulnerability detection on the data dependency graph according to a preset detection rule to obtain a detection result.

[0115] It can be understood that the contents of the above method embodiments are applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0116] The present application also provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-described PLC program vulnerability detection method when executing the computer program. The electronic device can be any smart terminal, including a tablet computer and an in-vehicle computer.

[0117] It can be understood that the contents of the above method embodiments are applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0118] See also Figure 6 , Figure 6 The hardware structure of an electronic device according to another embodiment is shown. The electronic device includes:

[0119] The processor 601 may be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0120] The memory 602 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 602 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 602 and is called by the processor 601 to execute the PLC program vulnerability detection method of the embodiments of this application.

[0121] Input / output interface 603, used to implement information input and output;

[0122] Communication interface 604, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0123] Bus 605 , which transmits information between various components of the device (e.g., processor 601 , memory 602 , input / output interface 603 , and communication interface 604 );

[0124] The processor 601 , the memory 602 , the input / output interface 603 and the communication interface 604 are connected to each other in communication within the device via a bus 605 .

[0125] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned PLC program vulnerability detection method is implemented.

[0126] It can be understood that the contents of the above method embodiments are all applicable to the present storage medium embodiment, the functions specifically implemented by the present storage medium embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0127] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0128] The present invention provides a PLC program vulnerability detection method, system, electronic device, and storage medium. This solution obtains a control program file through a development platform output and constructs a dangerous function fingerprint library based on the development platform. This dangerous function fingerprint library can be used to quickly identify vulnerabilities in the control program. Furthermore, this solution decompiles the control program file to obtain a dynamic function library. Based on the dangerous function fingerprint library, this dynamic function library is subjected to static taint analysis to obtain a set of tainted variables. This taint analysis technique can be used to track the impact of input variables on temporary variables to detect buffer overflow vulnerabilities caused by temporary variables, thereby improving vulnerability detection accuracy. Furthermore, this solution performs symbolic execution on the control program file based on the tainted variable set and constructs a data dependency graph based on the symbolic execution results. Vulnerability detection is then performed on the data dependency graph according to preset detection rules to obtain detection results. Memory vulnerabilities can be assessed by traversing the data dependency graph using the detection rules, thereby improving vulnerability detection accuracy.

[0129] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0130] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0131] The system embodiment described above is merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0132] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0133] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0134] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0135] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For example, the division of the above units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0136] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0137] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0138] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: various media that can store programs, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0139] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A PLC program vulnerability detection method, characterized in that: The method comprises the following steps: Obtaining a control program file through the development platform output, and constructing a dangerous function fingerprint library based on the development platform; Decompiling the control program file to obtain a dynamic function library; Performing static taint analysis on the dynamic function library according to the dangerous function fingerprint library to obtain a tainted variable set; Performing symbolic execution processing on the control program file according to the set of tainted variables, and constructing a data dependency graph according to the symbolic execution result; Vulnerability detection is performed on the data dependency graph according to preset detection rules to obtain detection results.

2. The method according to claim 1, characterized in that The method of constructing a dangerous function fingerprint library based on the development platform includes the following steps: Defining string operation functions and memory operation functions in the development platform as dangerous functions; Performing assembly instruction extraction processing on the dangerous function to obtain an instruction operator; The instruction operator is encrypted to obtain the dangerous function fingerprint library.

3. The method according to claim 1, characterized in that Decompiling the control program file to obtain a dynamic function library includes the following steps: Compiling and parsing the control program file to obtain a binary stream; Performing assembly instruction comparison processing on the binary stream to obtain a decompiled file; Perform function identification processing on the decompiled file to obtain the dynamic function library.

4. The method according to claim 1, wherein The step of performing static taint analysis on the dynamic function library according to the dangerous function fingerprint library to obtain a tainted variable set includes the following steps: Performing positioning processing on the dynamic function library according to the dangerous function fingerprint library to obtain an input function; Marking the received data of the input function to obtain a taint source; Performing taint propagation analysis on the taint source according to the assembly instruction type of the input function to obtain the taint variable set.

5. The method according to claim 1, wherein The performing symbolic execution processing on the control program file according to the set of tainted variables and constructing a data dependency graph according to the symbolic execution result includes the following steps: Performing breakpoint setting processing on a symbolic execution engine according to the set of tainted variables, and performing simulation execution processing on the control program file according to the symbolic execution engine to obtain a symbolic execution result; Performing breakpoint instruction analysis on the symbolic execution result to obtain memory addresses and memory operations; Node construction processing is performed according to the memory address and the memory operation to obtain the data dependency graph.

6. The method according to claim 1, characterized in that The process of performing vulnerability detection on the data dependency graph according to the preset detection rules to obtain the detection results includes the following steps: Analyzing and processing the control program file to obtain a control program stack; Performing node dependency analysis on the data dependency graph according to the control program stack to obtain memory dependency nodes; According to preset detection rules, program crash vulnerability analysis and constant modification vulnerability analysis are performed on the memory dependent node to obtain the detection result.

7. The method according to claim 6, characterized in that The performing program crash vulnerability analysis and constant modification vulnerability analysis on the memory-dependent node according to the preset detection rules to obtain the detection result includes the following steps: Determine a memory modification node according to the memory dependency node; When the memory modification node is in the runtime stack, a loop start judgment is performed on the memory modification node to obtain a program crash vulnerability; When the memory modification node is separated from the runtime stack, a constant modification judgment is performed on the memory modification node to obtain a constant modification vulnerability; The detection result is determined according to the program crash vulnerability and the constant modification vulnerability.

8. A PLC program vulnerability detection system, characterized in that: The system comprises: The first module is used to obtain a control program file through the output of the development platform, and to construct a dangerous function fingerprint library based on the development platform; The second module is used to decompile the control program file to obtain a dynamic function library; A third module is configured to perform static taint analysis on the dynamic function library according to the dangerous function fingerprint library to obtain a tainted variable set; A fourth module is configured to perform symbolic execution processing on the control program file according to the set of tainted variables, and construct a data dependency graph according to the symbolic execution result; The fifth module is used to perform vulnerability detection on the data dependency graph according to preset detection rules to obtain detection results.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images