Method and system for detecting highly available vulnerabilities in Internet of Things equipment firmware

Abstract

The invention provides a method and a system for detecting highly available vulnerabilities in Internet of Things equipment firmware. The method comprises the following steps: unpacking the firmware of the Internet of Things equipment to obtain a file system of the firmware of the Internet of Things equipment, and selecting a target binary program from the file system; identifying potential network analytic functions in a target binary program by using a network analytic function detector, and recovering a function call graph of the potential network analytic functions, thereby determining an accessible function set in the target binary program according to the function call graph, and collecting sensitive pollution convergent points in the accessible function set; and carrying out backtracking analysis from the convergent point to a source point on the collected sensitive pollution convergent point, and marking the sensitive pollution convergent point as an alarm if the analysis shows that the source value of the sensitive pollution convergent point is from the user input and / or the external environment. According to the method, the network analytic function is used as the entry point of vulnerability analysis, so that the overall efficiency and accuracy of vulnerability detection can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of firmware reverse engineering and security analysis, and in particular to a method and system for detecting highly exploitable vulnerabilities in Linux-based Internet of Things device firmware. Background Art

[0002] At present, although the research on vulnerability detection methods has made certain progress, these methods still have certain limitations: (1) Low vulnerability analysis efficiency. For example, Karonte uses unsupervised clustering to identify boundary programs, identifies the receiving traditional pollution sources in the boundary programs, and realizes the detection of taint vulnerabilities by marking the variables and parameters of the pollution sources. However, this method requires marking a large number of taint propagation paths during the path exploration process, which is prone to path explosion problems, resulting in a significant decrease in analysis efficiency. FITS infers intermediate pollution sources through behavioral clustering and similarity scoring, but due to the low inference efficiency of intermediate pollution sources, the overall vulnerability detection efficiency is difficult to meet the needs of large-scale firmware analysis. (2) There are many false positives in vulnerability detection. For example, Mango performs a comprehensive analysis of each executable program in the firmware. Although its analysis efficiency is 27 times that of SaTC, due to the large number of binary programs analyzed, the number of generated alerts increases sharply, and the vulnerabilities of many binary programs cannot actually be triggered. Summary of the Invention

[0003] To address the low analysis efficiency and accuracy of existing firmware vulnerability detection methods, the present invention provides a method and system for detecting highly exploitable vulnerabilities in IoT firmware. By focusing on network parsing functions as the entry point for vulnerability analysis, the present invention significantly reduces the scope of analysis, avoiding unnecessary path exploration and contamination source inference. This allows for the precise location of highly exploitable vulnerabilities within a limited timeframe, improving the overall efficiency and accuracy of vulnerability detection.

[0004] In a first aspect, the present invention provides a method for detecting highly exploitable vulnerabilities in IoT device firmware, comprising: Unpacking the IoT device firmware to obtain a file system of the IoT device firmware, and selecting a target binary program from the file system; Identifying potential network resolution functions in the target binary program using a network resolution function detector, and restoring a function call graph of the potential network resolution function, thereby determining an accessible function set in the target binary program based on the function call graph, and collecting sensitive contamination convergence points in the accessible function set; A backtracking analysis is performed on the collected sensitive pollution sinks from the sink to the source. If the analysis shows that the source value of the sensitive pollution sink comes from user input and / or the external environment, the sensitive pollution sink is marked as an alarm.

[0005] Furthermore, it also includes constructing the network parsing function detector, which specifically includes: Constructing a network parsing function library and a non-network parsing function library, performing feature extraction on the functions in the two function libraries to obtain a feature vector of each function, and assigning a label to the feature vector; the label is used to indicate whether the corresponding function is a network parsing function; All labeled feature vectors are used to train the preset machine learning model to obtain a network parsing function detector.

[0006] Furthermore, the feature extraction of the functions in the two function libraries specifically includes: Extract the structural features, behavioral features and semantic features of the network parsing function; the structural features include the number of basic blocks and the number of branches; the behavioral features include the number of network communication-related APIs, the number of standard I / O-related APIs, the number of environment-related APIs, the number of string comparison APIs, the number of string operation APIs, the number of string search APIs and the number of string conversion APIs; the semantic features include the number of authentication and authorization-related strings, the number of HTTP connection request-related strings, the number of MQTT connection request-related strings and the number of client and server connection request-related strings.

[0007] Furthermore, the machine learning model adopts a random forest model.

[0008] Furthermore, the function call graph of the potential network parsing function is restored, specifically including: Queue all potential network resolution functions; A potential network resolution function is taken out from the queue, and the following analysis process is performed on all functions called by it: the calling relationship from the potential network resolution function to the called function is recorded, and the reachable path starting from the potential network resolution function is gradually explored; during the exploration process, the sensitive pollution convergence points encountered are marked; the new potential network resolution functions discovered during the exploration process are added to the queue; and the analyzed called functions are marked to avoid repeated analysis.

[0009] Furthermore, the backtracking analysis from the collected sensitive pollution convergence points to the source points specifically includes: Starting from the collected sensitive pollution convergence point, trace its call chain backward until all call points are covered, and finally obtain the call relationship of the sensitive pollution convergence point; Based on the obtained calling relationship, a flow-sensitive coarse-grained value dependency analysis is performed on each calling site and called site to obtain an analysis state, wherein the analysis state includes restored parameter calling conventions, prototypes, and accessed global variables; Based on the obtained analysis status, the parameter call relationship of the sensitive pollution convergence point is analyzed to obtain the source value that the parameter of the sensitive pollution convergence point ultimately depends on and the source of the source value.

[0010] In a second aspect, the present invention provides a system for detecting highly exploitable vulnerabilities in IoT device firmware, comprising: a preprocessing module, configured to unpack the IoT device firmware, obtain a file system of the IoT device firmware, and select a target binary program from the file system; a pollution convergence point collection module, configured to use a network resolution function detector to identify potential network resolution functions in the target binary program and restore a function call graph of the potential network resolution function, thereby determining an accessible function set in the target binary program based on the function call graph and collecting sensitive pollution convergence points in the accessible function set; The vulnerability detection module is used to perform a retrospective analysis from the collected sensitive pollution sinks to the source points. If the analysis shows that the source value of the sensitive pollution sink comes from user input and / or the external environment, the sensitive pollution sink will be marked as an alarm.

[0011] In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect when executing the program.

[0012] In a fourth aspect, the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in the first aspect.

[0013] The beneficial effects of the present invention are: The method and system for detecting highly exploitable vulnerabilities in IoT device firmware provided by the present invention focus vulnerability analysis on the network parsing function call chain, thereby reducing the workload of analysts, improving vulnerability detection efficiency and accuracy, and providing an efficient and reliable solution for security analysis of IoT device firmware. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 A flowchart of a method for detecting highly exploitable vulnerabilities in IoT device firmware provided by an embodiment of the present invention; Figure 2 A schematic diagram of the architecture of a system for detecting highly exploitable vulnerabilities in IoT device firmware provided by an embodiment of the present invention; Figure 3 This is a structural block diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0015] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0016] The network parsing function is a critical node in the data flow from external input sources to sensitive contamination convergence points in the binary firmware of an IoT device. It is responsible for processing received user input and then passing the processed data to subsequent functions for further operation. In other words, the network parsing functions in the binary firmware of an IoT device play a core role in processing and parsing external input data. These functions are key functions for the firmware binary to communicate with the outside world. Furthermore, because the function call chain of the network parsing function often involves sensitive firmware operations such as authentication and data transmission, vulnerabilities existing in these function call chains are highly exploitable. Sensitive contamination convergence points on these critical paths are more likely to pose security risks. Therefore, vulnerabilities existing in these critical paths are called highly exploitable vulnerabilities.

[0017] In view of this, an embodiment of the present invention provides a method for detecting highly exploitable vulnerabilities in IoT device firmware, comprising the following steps: S101: Unpacking the IoT device firmware to obtain a file system of the IoT device firmware, and selecting a target binary program from the file system; Specifically, since IoT device firmware is typically packaged in compressed files (such as .bin or .img formats), we use the unpacking tool (Binwalk) to unpack the firmware, extract the firmware's file system (such as JFFS2 and SquashFS file systems), filter out all executable binaries from the file system, and then select the binaries responsible for network communication (such as httpd and minihttpd) as target binaries from all executable binaries, i.e., the targets for detecting highly exploitable vulnerabilities. Specifically, we use the -Me parameter of the binwalk unpacking tool to recursively unpack the IoT device firmware to be analyzed.

[0018] S102: using a network resolution function detector to identify potential network resolution functions in the target binary program, and recovering a function call graph of the potential network resolution function, thereby determining an accessible function set in the target binary program according to the function call graph, and collecting sensitive contamination convergence points in the accessible function set; Specifically, starting from the identified potential network resolution function, the breadth-first search (BFS) algorithm is run with the help of the binary program analysis tool Angr to recover the function call graph of the potential network resolution function, thereby determining the set of all accessible functions in the target binary program and collecting all sensitive pollution convergence points in all accessible functions.

[0019] S103: Perform sink-to-source backtracking analysis on the collected sensitive pollution sinks. If the analysis shows that the source value of the sensitive pollution sink is derived from user input and / or the external environment, the sensitive pollution sink is marked as an alarm.

[0020] Specifically, based on the sensitive contamination sinks obtained in step S102, a sink-to-source backtracking analysis is performed to explore the value dependencies from the collected sensitive contamination sinks to their call points until the top-level source point is traced back. During this analysis, if the source value of a sensitive contamination sink comes from user input and / or the external environment, the sensitive contamination sink is marked as an alarm, i.e., a security risk point.

[0021] The method for detecting highly exploitable vulnerabilities in IoT device firmware provided in this embodiment focuses vulnerability analysis on the network parsing function call chain, thereby reducing the workload of analysts, improving vulnerability detection capabilities, and providing an efficient and reliable solution for security analysis of IoT device firmware.

[0022] It is understandable that there are many methods for identifying network parsing functions. For example, Redini et al. used a heuristic method based on function features to identify network parsing functions; Liu et al. inferred intermediate pollution sources through behavior clustering and similarity scoring; and Ye et al. used a large language model to identify potential receiving library functions (slf) in dynamic link library functions (dllf). In the above embodiment, the above-mentioned existing network parsing function identification methods can be directly adopted. However, these existing function identification methods also have certain limitations. For example, the recognition accuracy of the method proposed by Redini et al. needs to be improved, the analysis efficiency of the method proposed by Liu et al. needs to be improved, and the stability of the method proposed by Ye et al. needs to be improved.

[0023] Therefore, in one embodiment, the present invention designs a new network parsing function detector, the construction process of which specifically includes the following steps: A network parsing function library and a non-network parsing function library are constructed, and features are extracted from the functions in the two function libraries to obtain feature vectors of each function, and labels are assigned to the feature vectors; the labels are used to indicate whether the corresponding function is a network parsing function; all feature vectors with labels are used to train a preset machine learning model to obtain a network parsing function detector.

[0024] Specifically, this embodiment collects 1,307 network parsing functions and 5,814 non-network parsing functions from a large number of firmware binary programs to form a network parsing function library and a non-network parsing function library. Static binary program analysis techniques (such as the open source binary program analysis tool Radare2) are used to extract feature vectors of network parsing functions and non-network parsing functions.

[0025] As an implementable embodiment, for the network parsing function, the extracted feature vector includes the structural features, behavioral features and semantic features of the network parsing function; the structural features include the number of basic blocks and the number of branches; the behavioral features include the number of network communication-related APIs, the number of standard I / O-related APIs, the number of environment-related APIs, the number of string comparison APIs, the number of string operation APIs, the number of string search APIs and the number of string conversion APIs; the semantic features include the number of authentication and authorization-related strings, the number of HTTP connection request-related strings, the number of MQTT connection request-related strings and the number of client and server connection request-related strings.

[0026] After obtaining all the labeled feature vectors, a feature vector set is formed; a ten-fold cross-validation is performed on the feature vector set using a classic supervised learning method; through comparison, it is found that among the AdaBoost, Decision tree, LightGBM, CatBoot and Random Forest models, the Random Forest model performs best in various performance indicators. Therefore, this embodiment selects the Random Forest model; 80% of the positive samples and 80% of the negative samples are selected as the training set, and the remaining samples are used as the validation set. The number of decision trees in the random forest is 100, and the network parsing function detector is trained to generate.

[0027] The network parsing function detector provided by the embodiment of the present invention can automatically and efficiently identify network parsing functions within a limited time, thereby improving the recognition efficiency and accuracy of network parsing functions. On this basis, it ultimately reduces the false positive rate of highly exploitable vulnerability detection and improves the overall vulnerability detection efficiency.

[0028] In one embodiment, the function call graph of the potential network parsing function restored in step S102 specifically includes the following steps: Queue all potential network resolution functions; A potential network resolution function is taken out from the queue, and the following analysis process is performed on all functions called by it: the calling relationship from the potential network resolution function to the called function is recorded, and the reachable path starting from the potential network resolution function is gradually explored; during the exploration process, the sensitive pollution convergence points encountered are marked; the new potential network resolution functions discovered during the exploration process are added to the queue; the analyzed called functions are marked to avoid repeated analysis and improve analysis efficiency.

[0029] Specifically, by analyzing the called functions of each potential network resolution function, after the analysis, all functions on the function call chain closely related to the network resolution function are explored, and all sensitive pollution convergence points are collected from the call graph accessible to the network resolution function.

[0030] In one embodiment, the backtracking analysis in step S103 specifically includes the following steps: Starting from the collected sensitive pollution convergence point, trace its call chain backward, that is, analyze the control flow call relationship of the function until all call points are covered, and finally obtain the call relationship of the sensitive pollution convergence point; Based on the obtained calling relationship, a flow-sensitive coarse-grained value dependency analysis is performed on each calling site and called site to obtain an analysis state, wherein the analysis state includes restored parameter calling conventions, prototypes, and accessed global variables; Based on the obtained analysis status, the parameter call relationship of the sensitive pollution convergence point is analyzed to obtain the source value that the parameter of the sensitive pollution convergence point ultimately depends on and the source of the source value.

[0031] Specifically, within a function (i.e., a call site or a callee site), the usage of each variable is tracked, and a separate analysis state record is kept for each program location where the variable is defined. Between functions (i.e., between a call site and a callee site where a call relationship exists), the current analysis state is copied, and a new stack frame is created based on the copy of the analysis state to simulate the function call process, that is, the analysis continues based on the analysis state of the previous function.

[0032] Based on the same inventive concept, Figure 2 As shown, an embodiment of the present invention provides a highly exploitable vulnerability detection system in IoT device firmware, including a preprocessing module, a contamination convergence point collection module, and a vulnerability detection module.

[0033] Specifically, the preprocessing module is used to unpack the IoT device firmware, obtain the file system of the IoT device firmware, and select the target binary program from the file system. The contaminated convergence point collection module is used to use the network resolution function detector to identify the potential network resolution function in the target binary program, and restore the function call graph of the potential network resolution function, thereby determining the accessible function set in the target binary program based on the function call graph, and collecting sensitive contaminated convergence points in the accessible function set. The vulnerability detection module is used to perform a backtracking analysis from the convergence point to the source point on the collected sensitive contaminated convergence points. If the analysis shows that the source value of the sensitive contaminated convergence point comes from user input and / or the external environment, the sensitive contaminated convergence point is marked as an alarm.

[0034] In one embodiment, the highly exploitable vulnerability detection system in the firmware of an IoT device provided in this embodiment also includes a network parsing function detector construction module, which is used to construct a network parsing function library and a non-network parsing function library, perform feature extraction on the functions in the two function libraries, obtain a feature vector of each function, and assign a label to the feature vector; the label is used to indicate whether the corresponding function is a network parsing function; all feature vectors with labels are used to train a preset machine learning model to obtain a network parsing function detector.

[0035] It should be noted that the highly exploitable vulnerability detection system in IoT device firmware provided by the embodiments of the present invention is intended to implement the above-mentioned method. Its specific functions can be found in the above-mentioned method embodiments and will not be described in detail here.

[0036] Figure 3 An example of a physical structure diagram of an electronic device is shown below. Figure 3As shown, the electronic device may include: a processor 301, a communications interface 302, a memory 303, and a communications bus 304, wherein the processor 301, the communications interface 302, and the memory 303 communicate with each other via the communications bus 304. The processor 301 may call logic instructions in the memory 303 to execute a method for detecting highly exploitable vulnerabilities in IoT device firmware. The method includes: unpacking the IoT device firmware to obtain a file system of the IoT device firmware, selecting a target binary program from the file system; using a network parsing function detector to identify potential network parsing functions in the target binary program, and restoring a function call graph of the potential network parsing functions, thereby determining a set of accessible functions in the target binary program based on the function call graph, and collecting sensitive contamination sinks from the accessible function set; performing a backtracking analysis on the collected sensitive contamination sinks from the sink to the source, and if the analysis indicates that the source value of the sensitive contamination sink is derived from user input and / or the external environment, marking the sensitive contamination sink as an alarm.

[0037] In addition, when the logic instructions in the above-mentioned memory 303 are implemented in the form of a software functional unit and sold or used as an independent product, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0038] An embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the highly exploitable vulnerability detection method in the firmware of an Internet of Things device provided by the above-mentioned method embodiments.

[0039] An embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for detecting highly exploitable vulnerabilities in IoT device firmware provided by the above-mentioned method embodiments is implemented.

[0040] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0041] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for detecting highly exploitable vulnerabilities in IoT device firmware, characterized in that: include: Unpacking the IoT device firmware to obtain a file system of the IoT device firmware, and selecting a target binary program from the file system; Identifying potential network resolution functions in the target binary program using a network resolution function detector, and restoring a function call graph of the potential network resolution function, thereby determining an accessible function set in the target binary program based on the function call graph, and collecting sensitive contamination convergence points in the accessible function set; A backtracking analysis is performed on the collected sensitive pollution sinks from the sink to the source. If the analysis shows that the source value of the sensitive pollution sink comes from user input and / or the external environment, the sensitive pollution sink is marked as an alarm.

2. The method for detecting highly exploitable vulnerabilities in IoT device firmware according to claim 1, wherein: It also includes constructing the network parsing function detector, specifically including: Constructing a network parsing function library and a non-network parsing function library, performing feature extraction on the functions in the two function libraries to obtain a feature vector of each function, and assigning a label to the feature vector; the label is used to indicate whether the corresponding function is a network parsing function; All labeled feature vectors are used to train the preset machine learning model to obtain a network parsing function detector.

3. The method for detecting highly exploitable vulnerabilities in IoT device firmware according to claim 2, wherein: The feature extraction of the functions in the two function libraries specifically includes: Extract the structural features, behavioral features and semantic features of the network parsing function; the structural features include the number of basic blocks and the number of branches; the behavioral features include the number of network communication-related APIs, the number of standard I / O-related APIs, the number of environment-related APIs, the number of string comparison APIs, the number of string operation APIs, the number of string search APIs and the number of string conversion APIs; the semantic features include the number of authentication and authorization-related strings, the number of HTTP connection request-related strings, the number of MQTT connection request-related strings and the number of client and server connection request-related strings.

4. The method for detecting highly exploitable vulnerabilities in IoT device firmware according to claim 2, wherein: The machine learning model adopts a random forest model.

5. The method for detecting highly exploitable vulnerabilities in IoT device firmware according to claim 1, wherein: The function call graph of restoring the potential network parsing function specifically includes: Queue all potential network resolution functions; A potential network resolution function is taken out from the queue, and the following analysis process is performed on all functions called by it: the calling relationship from the potential network resolution function to the called function is recorded, and the reachable path starting from the potential network resolution function is gradually explored; during the exploration process, the sensitive pollution convergence points encountered are marked; the new potential network resolution functions discovered during the exploration process are added to the queue; and the analyzed called functions are marked to avoid repeated analysis.

6. The method for detecting highly exploitable vulnerabilities in IoT device firmware according to claim 1, wherein: The aforementioned retrospective analysis of the collected sensitive pollution convergence points from the convergence point to the source point specifically includes: Starting from the collected sensitive pollution convergence point, trace its call chain backward until all call points are covered, and finally obtain the call relationship of the sensitive pollution convergence point; Based on the obtained calling relationship, a flow-sensitive coarse-grained value dependency analysis is performed on each calling site and called site to obtain an analysis state, wherein the analysis state includes restored parameter calling conventions, prototypes, and accessed global variables; Based on the obtained analysis status, the parameter call relationship of the sensitive pollution convergence point is analyzed to obtain the source value that the parameter of the sensitive pollution convergence point ultimately depends on and the source of the source value.

7. A highly exploitable vulnerability detection system in IoT device firmware, characterized by: include: a preprocessing module, configured to unpack the IoT device firmware, obtain a file system of the IoT device firmware, and select a target binary program from the file system; a pollution convergence point collection module, configured to use a network resolution function detector to identify potential network resolution functions in the target binary program and restore a function call graph of the potential network resolution function, thereby determining an accessible function set in the target binary program based on the function call graph and collecting sensitive pollution convergence points in the accessible function set; The vulnerability detection module is used to perform a retrospective analysis from the collected sensitive pollution sinks to the source points. If the analysis shows that the source value of the sensitive pollution sink comes from user input and / or the external environment, the sensitive pollution sink will be marked as an alarm.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images