Deep learning-based internet of things device firmware vulnerability automatic mining method

Abstract

The application discloses a deep learning-based Internet of Things device firmware vulnerability automatic mining method, comprising the following steps: S1, constructing an interface keyword set; S2, optimizing the interface keyword weight to generate a dynamic weight interface keyword library; S3, analyzing firmware binary files to locate an interface function set; S4, performing static slicing analysis to generate a slicing path set; S5, performing symbolic execution on the slicing path to generate path constraint conditions and solve effective input data; S6, combining historical vulnerability features to determine the vulnerability type and generate a vulnerability type identifier; S7, generating context prompt words according to vulnerability metadata information, inputting a large language model, and generating a vulnerability exploit code PoC; and S8, performing PoC verification to complete the vulnerability automatic mining. The application realizes the improvement of the firmware vulnerability automatic detection efficiency, enhances the vulnerability exploit generation capability, and is suitable for multiple types of Internet of Things device security detection scenes.

Description

Technical Field

[0001] This invention relates to the field of program security technology, and in particular to an automated method for discovering firmware vulnerabilities in Internet of Things (IoT) devices based on deep learning. Background Technology

[0002] With the rapid advancement of IoT technology and the widespread application of intelligent devices, such as routers and switches, these devices have become crucial components of modern communication hubs. While these intelligent IoT devices improve the efficiency of life and work, they also expose numerous security vulnerabilities. Among these vulnerabilities, security vulnerabilities in IoT devices have become new targets for hackers, leading to a series of security problems, including data breaches, remote control attacks, and denial-of-service attacks. Therefore, vulnerability discovery in the firmware of IoT devices has become a research hotspot in the field of cybersecurity.

[0003] In-depth research into the security vulnerabilities of IoT smart devices, and the discovery and patching of these vulnerabilities, are of great significance for ensuring network security and protecting user privacy and data security. Traditional vulnerability discovery methods, such as manual auditing, are inefficient, require significant manpower, and often suffer from low accuracy and high false positive rates. Given the wide variety of IoT smart devices and the complexity of their code, traditional methods cannot efficiently locate the critical code sections requiring analysis.

[0004] Therefore, how to provide an automated method for discovering firmware vulnerabilities in IoT devices based on deep learning is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] To overcome the shortcomings of the existing technologies, this invention provides an innovative method for automated vulnerability discovery in the firmware of IoT devices. The technical solution employed in this invention includes keyword-based entry point location, firmware code slicing analysis, automated triggering of symbolic execution vulnerabilities, fine-tuning of a large language model based on vulnerability metadata, and automated PoC generation based on the large language model.

[0006] For keyword-based entry point location, our analysis of numerous historical vulnerabilities revealed that the entry points for attacks on IoT smart devices are all located in the interfaces of the front-end files. Starting from these interfaces, related functions in the binary files can be executed. Therefore, we propose identifying interface strings in the front-end files to accurately locate key entry point functions in IoT smart devices. Simultaneously, we combine historical vulnerability information with different weights for different keywords to improve the effectiveness of key entry point function extraction. By extracting front-end-related static files from the firmware, we perform simple analysis and extraction of constant strings in these files to identify functional functions related to front-end interface interaction and the actual method names for back-end processing. These method names serve as keywords for subsequent binary file analysis. After obtaining the keywords, we locate specific processing functions in the binary files using these keyword names. Furthermore, we discover existing interface functions by finding the function table in the binary files. To further enhance the completeness of the interface functions, we locate more interface functions by finding functions in the firmware that obtain user input, thus obtaining a complete set of interface functions. This method, which combines historical vulnerability proof-of-concept (PoC) and uses front-end interfaces and parameter names to extract entry functions from different IoT smart devices, can effectively improve the efficiency of vulnerability discovery.

[0007] For firmware code slicing analysis, a slicing analysis method is adopted, starting from the interface function. A series of vulnerability risk functions are specified, and the vulnerability risk functions are used as the final endpoint functions. The forward data flow analysis method is used to determine whether the input variables of the interface function flow into the endpoint function through taint tracing. If they flow into the endpoint function, the interface function is a potential risk function.

[0008] For the automated vulnerability triggering method based on symbolic execution, the method uses the sliced ​​fragments from the previously obtained interface functions to solve the constraint paths in the symbolic execution process. Different vulnerability conditions are constructed for different vulnerabilities, and finally, it checks whether the constraint path satisfies the vulnerability conditions. If the value of the solved vulnerability path satisfies the vulnerability conditions, then the vulnerability in that path is considered to exist. Simultaneously, the path conditions and memory state of the vulnerability risk are saved to obtain vulnerability metadata. Furthermore, based on a large amount of collected historical vulnerability information, the types of historical vulnerabilities, combined with the parameter and function information in the current vulnerability metadata, and different endpoint functions, we automatically determine the potential vulnerability types and construct different constraint conditions accordingly.

[0009] For fine-tuning the large language model, using the collected vulnerability information and vulnerability-related PoC datasets, the original large language model is fine-tuned to obtain a fine-tuned large language model that can accurately generate verification PoCs for new vulnerabilities. Finally, for PoC generation based on the large language model, using the collected vulnerability metadata information, we design specific hint words based on the extracted vulnerability functions, keywords, and vulnerability types obtained through symbolic execution, and transmit them to the fine-tuned large language model to guide it in generating PoC data related to the vulnerability.

[0010] Compared with existing technologies, this invention first collects interface functions with potential vulnerabilities in IoT device firmware through static analysis, further analyzes and collects the information of the interface functions, and transmits the collected information to a large language model to generate a Proof-of-Concept (PoC) that can be used to quickly verify the existence of vulnerabilities, thereby significantly improving the efficiency of vulnerability discovery for IoT device firmware.

[0011] The method for automated vulnerability discovery in IoT device firmware based on deep learning according to embodiments of the present invention includes the following steps:

[0012] S1. Extract static files, perform static analysis on the string information and interface call information in the static files, and construct a set of interface keywords;

[0013] S2. Combining the interface features and vulnerability features in historical vulnerability samples, perform weight optimization on the set of interface keywords to form a dynamic weighted interface keyword library.

[0014] S3. Analyze the device firmware binary file based on the dynamic weighted interface keyword library to locate the set of interface functions;

[0015] S4. For each interface function in the interface function set, perform static slice analysis, select the vulnerability risk function as the endpoint function, extract the control flow path and data flow path that propagates from the input variables of the interface function to the vulnerability risk function, and generate a slice path set.

[0016] S5. Perform symbolic execution analysis on each slice path in the slice path set to generate the corresponding symbolic execution path and path constraints, and solve for the valid input data.

[0017] S6. Based on historical vulnerability sample information, determine the vulnerability type, generate a corresponding vulnerability type identifier, and use symbolic execution path, path constraints, valid input data, interface function, vulnerability risk function, and vulnerability type identifier as vulnerability metadata information.

[0018] S7. Generate a hint word containing path context information based on the vulnerability metadata information, input it into a large language model that has been fine-tuned and trained with historical vulnerability samples, and generate a PoC exploit code targeting the vulnerability metadata information.

[0019] S8. Execute the vulnerability verification process of the PoC code to verify whether the vulnerability can be exploited and complete the automated vulnerability discovery.

[0020] Optionally, the static analysis process in S1 includes: parsing the HTML files, JavaScript files, and ASP files in the front-end static files, extracting the interface names, parameter names, and calling keywords from the files, filtering the extracted interface names, parameter names, and calling keywords, generating a corresponding set of interface calling information, and constructing a set of interface keywords from the set of interface calling information.

[0021] Optionally, S2 specifically includes:

[0022] S21. Perform semantic analysis on the interface call logs, interface definition files and interface call contexts in the historical vulnerability samples, and extract the interface names, parameter names, call keywords and call context fragments to form interface features;

[0023] S22. Perform static analysis and behavioral trajectory analysis on vulnerability reports, exploit code and vulnerability trigger logs in historical vulnerability samples, and extract vulnerability type identifiers, vulnerability trigger conditions, input features and path context information in the exploit code to form vulnerability features;

[0024] S23. For each interface keyword K in the interface keyword set... i Based on the extracted interface features and vulnerability features, calculate the interface keyword K. i initial weights in, Based on the interface keyword K i The severity level of a vulnerability is determined by its frequency of occurrence in historical vulnerability samples and the severity level of the corresponding vulnerability samples.

[0025] S24. Introduce a time decay factor λ, and adjust the initial weights based on the time attributes of historical vulnerability samples. Perform time-weighted calculation to determine the interface keyword K. i Time-weighted weights satisfy

[0026] S25. For all interface keywords K in the interface keyword set... i Time-weighted weights Perform normalization processing to generate normalized weights.

[0027] S26. Based on normalized weights The API keywords are sorted, and those with normalized weights greater than a preset threshold are selected. The selection results are used as a dynamic weighted API keyword library.

[0028] Optionally, the severity level of the corresponding vulnerability sample in step S23 specifically includes: a level identifier determined based on the vulnerability's impact scope, exploitation difficulty, and disclosure time. This level identifier is divided into three levels: high-risk, medium-risk, and low-risk, each corresponding to one of three level coefficients. During the initial weight calculation, the corresponding level coefficient is correlated with the interface keyword K. i The initial weights are obtained by weighting the occurrence frequency of each element.

[0029] Optionally, S4 specifically includes:

[0030] S41. For each interface function F in the set of interface functions... j Extract the set of input variables V of the interface function. in (F j The set of input variables V in (F j This includes interface parameters, global variables, and context variables passed through the call chain;

[0031] S42, using interface function F j Starting from the vulnerability risk function R in the vulnerability risk function set, each vulnerability risk function R... k As the endpoint, a control flow graph (CFG) is constructed for the call paths between interface functions and risk functions. j ,R k ) and data dependency graph DDG(F) j ,R k );

[0032] S43, Based on CFG(F) j ,R k ) and DDG(F j ,R k ), for the set of input variables V in (F j Perform forward data flow analysis to trace variable propagation paths and identify the data passed from input variables to the vulnerability risk function R. k Path nodes;

[0033] S44. Perform synchronous backward data dependency analysis to determine the vulnerability risk function R. k By tracing the dependency path upstream, we can filter out the set of key instruction nodes and their corresponding data stream segments;

[0034] S45. Integrate the results of forward data flow analysis and backward data dependency analysis to generate the interface function F. j To the vulnerability risk function R k slice path P(F) j ,R k ), and all P(F j ,R k The slice paths are composed of a set P.

[0035] Optionally, S5 specifically includes:

[0036] S51. For each static slice path P(F) in the slice path set P, j ,R k Based on the instruction set architecture of IoT device firmware, a symbolic execution environment is established. This environment includes a symbolic variable modeling module, a symbolic memory management module, and a symbolic execution engine. The initialization interface function F... j The set of input variables V in (F j () is a set of symbolic input variables, which is then mapped to the symbolic memory space;

[0037] S52, along the static slice path P(F) j ,R k The corresponding instruction sequence is loaded according to the control flow order. Each instruction is symbolically processed using a symbolic execution engine. This symbolic processing includes converting operands in the instruction into symbolic variable expressions, continuously updating the symbolic memory state in the symbolic memory management module, and gradually generating a complete symbolic execution path (SEP(F)). j ,R k );

[0038] S53, in the execution symbol execution path SEP(F) j ,R k During the process, when a conditional branch instruction is encountered in the instruction stream, the comparison operation in the conditional statement is dynamically parsed, the conditional expression is extracted, and the symbolic variables involved in the conditional expression are used to construct path constraints. All path constraints accumulated during the path execution are combined into a path constraint set C = {C1, C2, ..., C...}. n};

[0039] S54. Input the path constraint set C into the constraint solver. The constraint solver is a solution tool based on SMT theory. It uses a symbolic variable constraint solution algorithm to jointly solve all path conditions in the path constraint set C to obtain valid input data that satisfies the path constraint set C.

[0040] Optionally, the determination of the vulnerability type in S6 specifically includes:

[0041] S61. Extract vulnerability type characteristics from historical vulnerability samples;

[0042] S62. For each symbol execution path, extract the corresponding path features, trigger condition features, and input features;

[0043] S63. Compare the extracted path features, trigger condition features, and input features with the vulnerability type features in the historical vulnerability samples, and calculate the feature similarity score for each.

[0044] S64. Weighted fusion of the similarity scores of various features to calculate the total matching score;

[0045] S65. Based on the total matching score and the preset matching threshold, select the vulnerability type with a matching score higher than the preset threshold as the vulnerability type determination result corresponding to the current symbolic execution path.

[0046] Optionally, S7 specifically includes:

[0047] S71. Extract vulnerability metadata information, which includes symbolic execution path, path constraint set, valid input data set, interface function, vulnerability risk function and vulnerability type identifier;

[0048] S72. Parse the path constraint set in the vulnerability metadata information and extract the path context information, which includes path control flow features, branch condition features and input variable features.

[0049] S73. Combine path context information with vulnerability type identifier to construct a context-aware prompt word template and generate corresponding prompt word text;

[0050] S74. Input the prompt text into the large language model that has been fine-tuned and trained with historical vulnerability samples, and perform the reasoning generation process.

[0051] S75. Generate PoC (Proof of Concept) exploit code targeting vulnerability metadata information from a large language model.

[0052] The beneficial effects of this invention are:

[0053] (1) Improve the accuracy of interface function extraction: This invention integrates historical vulnerability features with the front-end interface features of IoT device firmware to build a dynamic weighted interface keyword library, which improves the ability to locate high-risk interface functions in firmware binary files, significantly reduces false positives and false negatives, and enhances the pre-analysis effect of vulnerability detection.

[0054] (2) Enhance vulnerability path discovery capability: This invention uses static slicing analysis to finely track the propagation path of input variables and combines symbolic execution to generate high-quality path constraints, thereby improving the coverage capability of symbolic execution in complex path scenarios, effectively reducing the path explosion problem, and improving the efficiency and accuracy of vulnerability path discovery.

[0055] (3) Improve the quality of vulnerability exploitation code generation: This invention improves the targeting and trigger success rate of vulnerability exploitation code generation by optimizing the embedding of path context information and vulnerability type characteristics into the input of a large language model through the design of context-aware prompt words, thereby realizing an effective closed loop in the vulnerability exploitation verification stage of the automated vulnerability discovery process. Attached Figure Description

[0056] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0057] Figure 1 This is an overall flowchart of the deep learning-based automated vulnerability discovery method for IoT device firmware proposed in this invention.

[0058] Figure 2 This is a flowchart illustrating the symbolic execution analysis and valid input data solution of the automated vulnerability mining method for IoT device firmware based on deep learning proposed in this invention. Detailed Implementation

[0059] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0060] refer to Figure 1 and Figure 2 A deep learning-based method for automated vulnerability discovery in IoT device firmware includes the following steps:

[0061] S1. Extract static files from the firmware of IoT devices, perform static analysis on the string information and interface call information in the static files, and construct a set of interface keywords;

[0062] S2. Combining the interface features and vulnerability features in historical vulnerability samples, perform weight optimization on the set of interface keywords to form a dynamic weighted interface keyword library.

[0063] S3. Analyze the firmware binary file based on the dynamic weighted interface keyword library to locate the set of interface functions;

[0064] S4. For each interface function in the interface function set, perform static slice analysis, select the vulnerability risk function as the endpoint function, extract the control flow path and data flow path that propagates from the input variables of the interface function to the vulnerability risk function, and generate a slice path set.

[0065] S5. For each slice path in the slice path set, perform symbolic execution analysis to generate the corresponding symbolic execution path and path constraints, and solve to obtain valid input data that can trigger vulnerabilities.

[0066] S6. Based on historical vulnerability sample information, determine the vulnerability type, generate a corresponding vulnerability type identifier, and record the symbolic execution path, path constraints, valid input data, interface functions, vulnerability risk functions, and vulnerability type identifier as vulnerability metadata information.

[0067] S7. Based on the vulnerability metadata information, generate a prompt word containing path context information, input it into a large language model that has been fine-tuned and trained with historical vulnerability samples, and generate a PoC exploit code targeting the vulnerability metadata information.

[0068] S8. Execute the vulnerability verification process of the PoC code to verify whether the vulnerability can be exploited and complete the automated vulnerability discovery.

[0069] This invention establishes a closed-loop process for automated firmware vulnerability discovery by automatically generating vulnerability exploitation code through static file analysis, interface keyword weight optimization, static slice analysis, symbolic execution analysis, and large language models. This improves vulnerability detection efficiency and automatic exploitation capabilities. Compared with existing solutions based on single analysis techniques or manual verification, it has stronger automation capabilities and higher detection accuracy.

[0070] In this embodiment, the static analysis process in S1 includes: parsing the HTML files, JavaScript files, and ASP files in the front-end static files, extracting the interface names, parameter names, and calling keywords from the files, filtering the extracted interface names, parameter names, and calling keywords, generating a corresponding set of interface calling information, and constructing a set of interface keywords from the set of interface calling information.

[0071] This invention extracts front-end interface interaction-related features through fine-grained parsing of interface call information in static files, and optimizes the interface keyword set by combining firmware structural features. Compared with traditional interface extraction methods based on simple disassembly matching, this invention improves the accuracy and coverage of interface function extraction, and enhances the capabilities of the pre-processing stage of firmware vulnerability detection.

[0072] In this embodiment, S2 specifically includes:

[0073] S21. Perform semantic analysis on the interface call logs, interface definition files and interface call contexts in the historical vulnerability samples, and extract the interface names, parameter names, call keywords and call context fragments to form interface features;

[0074] S22. Perform static analysis and behavioral trajectory analysis on vulnerability reports, exploit code and vulnerability trigger logs in historical vulnerability samples, and extract vulnerability type identifiers, vulnerability trigger conditions, input features and path context information in the exploit code to form vulnerability features;

[0075] S23. For each interface keyword K in the interface keyword set... i Based on the extracted interface features and vulnerability features, calculate the interface keyword K. i initial weights in, Based on the interface keyword K i The severity level of a vulnerability is determined by its frequency of occurrence in historical vulnerability samples and the severity level of the corresponding vulnerability samples.

[0076] S24. Introduce a time decay factor λ, and adjust the initial weights based on the time attributes of historical vulnerability samples. Perform time-weighted calculation to determine the interface keyword K. i Time-weighted weights satisfy

[0077] S25. For all interface keywords K in the interface keyword set... i Time-weighted weights Perform normalization processing to generate normalized weights.

[0078] S26. Based on normalized weights The API keywords are sorted, and those with normalized weights greater than a preset threshold are selected. The selection results are used as a dynamic weighted API keyword library.

[0079] This invention uses historical vulnerability sample features to guide the optimization of interface keyword weights, and combines time decay factors to dynamically adjust keyword weights, forming an adaptive interface keyword library. Compared with existing static keyword configuration schemes, it has better robustness and adaptability to different firmware versions and device types, improving the location effect of key interface functions.

[0080] In this embodiment, the severity level of the corresponding vulnerability sample in step S23 specifically includes: a level identifier determined based on the vulnerability's impact scope, exploitation difficulty, and disclosure time. This level identifier is divided into three levels: high-risk, medium-risk, and low-risk, each corresponding to a different level coefficient. During the initial weight calculation, the corresponding level coefficient is correlated with the interface keyword K. i The initial weight W is obtained by weighting the occurrence frequency of each element. i (0) .

[0081] This invention introduces a severity level of vulnerability samples and dynamically adjusts the influence of interface keywords in the weight calculation process. It optimizes the weight of interface keywords for different vulnerability risk levels. Compared with the existing unified weight processing scheme, it effectively improves the priority of locating interfaces related to high-risk vulnerabilities and enhances the risk perception capability of vulnerability detection.

[0082] In this embodiment, S4 specifically includes:

[0083] S41. For each interface function F in the set of interface functions... j Extract the set of input variables V of the interface function. in (F j The set of input variables V in (F j This includes interface parameters, global variables, and context variables passed through the call chain;

[0084] S42, using interface function F j Starting from the vulnerability risk function R in the vulnerability risk function set, each vulnerability risk function R... k As the endpoint, a control flow graph (CFG) is constructed for the call paths between interface functions and risk functions. j ,R k ) and data dependency graph DDG(F) j ,R k );

[0085] S43, Based on CFG(F) j ,R k ) and DDG(F j ,R k ), for the set of input variables V in (F j Perform forward data flow analysis to trace variable propagation paths and identify the data passed from input variables to the vulnerability risk function R. k Path nodes;

[0086] S44. Perform synchronous backward data dependency analysis to determine the vulnerability risk function R. kBy tracing the dependency path upstream, we can filter out the set of key instruction nodes and their corresponding data stream segments;

[0087] S45. Integrate the results of forward data flow analysis and backward data dependency analysis to generate the interface function F. j To the vulnerability risk function R k slice path P(F) j ,R k ), and all P(F j ,R k The slice paths are composed of a set P.

[0088] This invention employs static slice analysis to finely track the propagation path of input variables. It combines control flow graphs and data dependency graphs to generate slice paths, improving the quality of path constraint generation during the symbolic execution phase. Compared to traditional full-path symbolic execution schemes, it reduces the path explosion problem and enhances the efficiency and accuracy of vulnerability path discovery.

[0089] In this embodiment, S5 specifically includes:

[0090] S51. For each static slice path P(F) in the slice path set P, j ,R k Based on the instruction set architecture of IoT device firmware, a symbolic execution environment is established. This environment includes a symbolic variable modeling module, a symbolic memory management module, and a symbolic execution engine. The initialization interface function F... j The set of input variables V in (F j () is a set of symbolic input variables, which is then mapped to the symbolic memory space;

[0091] S52, along the static slice path P(F) j ,R k The corresponding instruction sequence is loaded according to the control flow order. Each instruction is symbolically processed using a symbolic execution engine. This symbolic processing includes converting operands in the instruction into symbolic variable expressions, continuously updating the symbolic memory state in the symbolic memory management module, and gradually generating a complete symbolic execution path (SEP(F)). j ,R k );

[0092] S53, in the execution symbol execution path SEP(F) j ,R k During the process, when a conditional branch instruction is encountered in the instruction stream, the comparison operation in the conditional statement is dynamically parsed, the conditional expression is extracted, and the symbolic variables involved in the conditional expression are used to construct path constraints. All path constraints accumulated during the path execution are combined into a path constraint set C = {C1, C2, ..., C...}.n};

[0093] S54. Input the path constraint set C into the constraint solver. The constraint solver is a solution tool based on SMT theory. It uses a symbolic variable constraint solution algorithm to jointly solve all path conditions in the path constraint set C to obtain valid input data that satisfies the path constraint set C.

[0094] This invention establishes a symbolic execution environment, performs symbolic execution according to the slice path sequence, dynamically constructs path constraints, and uses an SMT solver to accurately solve for valid input data. Compared with existing simple static analysis or full-program symbolic execution schemes, it can quickly locate triggerable vulnerability paths, improve vulnerability discovery efficiency, and reduce analysis costs.

[0095] In this embodiment, the determination of the vulnerability type in S6 specifically includes:

[0096] S61. Extract vulnerability type characteristics from historical vulnerability samples;

[0097] S62. For each symbol execution path, extract the corresponding path features, trigger condition features, and input features;

[0098] S63. Compare the extracted path features, trigger condition features, and input features with the vulnerability type features in the historical vulnerability samples, and calculate the feature similarity score for each.

[0099] S64. Weighted fusion of the similarity scores of various features to calculate the total matching score;

[0100] S65. Based on the total matching score and the preset matching threshold, select the vulnerability type with a matching score higher than the preset threshold as the vulnerability type determination result corresponding to the current symbolic execution path.

[0101] This invention determines vulnerability types by integrating path features, trigger condition features, and input features, combined with features from historical vulnerability samples, and generates accurate vulnerability type identifiers. Compared with existing determination methods based on static rules or simple feature matching, it has higher determination accuracy and type differentiation capabilities, thus improving the effectiveness of vulnerability classification and management.

[0102] In this embodiment, S7 specifically includes:

[0103] S71. Extract vulnerability metadata information, which includes symbolic execution path, path constraint set, valid input data set, interface function, vulnerability risk function and vulnerability type identifier;

[0104] S72. Parse the path constraint set in the vulnerability metadata information and extract the path context information, which includes path control flow features, branch condition features and input variable features.

[0105] S73. Combine path context information with vulnerability type identifier to construct a context-aware prompt word template and generate corresponding prompt word text;

[0106] S74. Input the prompt text into the large language model that has been fine-tuned and trained with historical vulnerability samples, and perform the reasoning generation process.

[0107] S75. Generate PoC (Proof of Concept) exploit code targeting vulnerability metadata information from a large language model.

[0108] This invention analyzes path constraint sets, extracts path context features, designs context-aware prompts, and inputs them into a large language model to generate vulnerability exploitation code. Compared with existing template-based prompt-driven methods, it can better combine vulnerability context information, improve the relevance and trigger success rate of PoC generation by the large language model, and enhance automatic exploitation capabilities.

[0109] Example 1:

[0110] To verify the feasibility of this invention in practice, it was applied to a firmware vulnerability detection project for a smart home control system provided by a large IoT device manufacturer. The system includes various types of terminal devices such as routers, smart cameras, door locks, lighting control modules, and air conditioner controllers, involving ARM Cortex-M series, MIPS architecture, and x86 embedded platforms. The firmware is diverse, with a total of 1783 firmware image versions collected, covering approximately 315 device models. The average size of a single firmware is about 8MB, with a large code size, complex firmware structure, and customization differences between different manufacturers.

[0111] Traditional vulnerability detection methods employ commercial static analysis tools combined with manual symbolic execution, requiring approximately 45 days per round of testing. On average, no more than 20 firmware versions are analyzed daily, resulting in an average false positive rate of 22%. These methods suffer from numerous issues, including inaccurate interface function localization and incomplete path analysis, impacting the efficiency and accuracy of vulnerability remediation. This invention automates the entire vulnerability mining process for the same batch of firmware data. First, it extracts front-end interface features through static file parsing. Then, it integrates historical vulnerability knowledge to optimize interface keyword weights, effectively improving the accuracy of interface function extraction. In actual testing, the accuracy of interface function extraction increased to 96.3%, approximately 12 percentage points higher than traditional methods, while the false negative rate decreased to 2.1%.

[0112] During the vulnerability path discovery phase, static slicing analysis is used to refine the propagation path of input variables. Combined with symbolic execution paths, high-quality path constraints are generated. The SMT solver is then used to solve high-risk paths. Compared with the traditional full-path symbolic execution scheme, the average symbolic execution time is reduced by 38%, and the path coverage rate is increased to 91.7%. For the vulnerability type determination process, dynamic determination is performed by integrating path features, condition features, and historical vulnerability type features to generate accurate vulnerability type identifiers. The determination accuracy rate reaches 94.5%, effectively reducing the need for manual intervention and optimizing the vulnerability classification and management process.

[0113] In the vulnerability exploit code generation stage, a context-aware prompt word input is used to fine-tune the large language model to generate high-quality PoC code. The actual PoC code verification trigger success rate reaches 87.2%, which is 23.6% higher than the traditional template prompt word solution, enhancing the vulnerability exploit verification effect. Through the application of this invention, the overall firmware detection cycle is shortened from 45 days to 12 days, the detection coverage rate is increased from 75.8% to 95.4%, the detection efficiency is improved by about 3.7 times, the vulnerability repair response cycle is shortened by nearly 70%, and the device firmware security management capabilities are greatly optimized.

[0114] The table below shows a comparison of key performance indicators of the method of the present invention in firmware detection of different devices, covering core indicators such as interface function extraction accuracy, path coverage, average symbol execution time, vulnerability type determination accuracy, and PoC generation trigger success rate, demonstrating the practical application effect of the present invention in the scenario of automated firmware vulnerability mining.

[0115] Table 1: Comparison of Core Performance Indicators between the Method of the Invention and Traditional Detection Schemes

[0116]

[0117] Based on the comparison data of the core performance indicators in Table 1 above, the advantages of the method of the present invention in the automated mining of firmware vulnerabilities in IoT devices can be clearly demonstrated from multiple dimensions.

[0118] Regarding the accuracy of interface function extraction, this invention optimizes the weight of interface keywords by leveraging historical vulnerability features and dynamically adjusts the extraction strategy based on firmware structure features. This ensures that the accuracy of interface function extraction for five typical devices—routers, smart cameras, smart door locks, lighting control modules, and air conditioner controllers—remains above 95%, averaging 96.3%. Compared to the traditional detection average of 84.2%, this represents an improvement of over 12%, effectively solving the problems of inaccurate interface location and high false alarm rates in existing technologies.

[0119] In terms of vulnerability path coverage, this invention combines static slicing analysis with forward data flow and backward dependency analysis to track input variable paths with fine granularity, thereby improving the completeness of path generation during the symbolic execution phase. In testing, path coverage for all five device types exceeded 90%, averaging 91.7%, a 16 percentage point improvement compared to the traditional solution's 75.8%, demonstrating that this invention possesses superior vulnerability path discovery capabilities.

[0120] Regarding the average symbol execution time, this invention effectively reduces the symbol execution time to an average of 143 seconds through path pruning optimization and input variable constraint convergence, which is nearly 40% lower than the traditional 235 seconds, thus improving detection efficiency and adapting to the needs of rapid firmware detection in large-scale devices.

[0121] Regarding the accuracy of vulnerability type determination, this invention improves the accuracy to 94.5% by integrating path features, input features, trigger condition features, and historical vulnerability sample features. This is an increase of approximately 13% compared to the traditional 81.6%, significantly reducing the need for manual intervention and enhancing the accuracy and management value of vulnerability classification.

[0122] Regarding the success rate of PoC generation and triggering, this invention designs context-aware prompts to enhance the ability of the large language model to understand the vulnerability context. The success rate of PoC triggering on five types of devices all exceeded 85%, with an average of 87.2%, which is more than 23% higher than the traditional solution of 63.6%. This indicates that this invention has a stronger automatic exploit generation capability in the vulnerability verification stage, and the closed-loop effect is obvious.

[0123] Based on the above data analysis, the solution of this invention is significantly superior to existing detection solutions in core aspects such as interface function extraction, path mining, symbolic execution efficiency, vulnerability type determination, and PoC generation capability. The overall detection cycle is shortened, accuracy is improved, and automation level is significantly enhanced, fully meeting the practical application needs of large-scale automated mining and exploitation verification of firmware vulnerabilities in IoT devices.

[0124] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for automated vulnerability discovery in IoT device firmware based on deep learning, characterized in that, Includes the following steps: S1. Extract static files, perform static analysis on the string information and interface call information in the static files, and construct a set of interface keywords; S2. Combining the interface features and vulnerability features in historical vulnerability samples, perform weight optimization on the set of interface keywords to form a dynamic weighted interface keyword library. S3. Analyze the device firmware binary file based on the dynamic weighted interface keyword library to locate the set of interface functions; S4. For each interface function in the interface function set, perform static slice analysis, select the vulnerability risk function as the endpoint function, extract the control flow path and data flow path that propagates from the input variables of the interface function to the vulnerability risk function, and generate a slice path set. S5. Perform symbolic execution analysis on each slice path in the slice path set to generate the corresponding symbolic execution path and path constraints, and solve for the valid input data. S6. Based on historical vulnerability sample information, determine the vulnerability type, generate a corresponding vulnerability type identifier, and use symbolic execution path, path constraints, valid input data, interface function, vulnerability risk function, and vulnerability type identifier as vulnerability metadata information. S7. Generate a hint word containing path context information based on the vulnerability metadata information, input it into a large language model that has been fine-tuned and trained with historical vulnerability samples, and generate a PoC exploit code targeting the vulnerability metadata information. S8. Execute the vulnerability verification process of the PoC code to verify whether the vulnerability can be exploited and complete the automated vulnerability discovery.

2. The method for automated vulnerability discovery in IoT device firmware based on deep learning according to claim 1, characterized in that, The static analysis process in S1 includes: parsing HTML files, JavaScript files, and ASP files in the front-end static files, extracting interface names, parameter names, and call keywords from the files, filtering the extracted interface names, parameter names, and call keywords, generating a corresponding set of interface call information, and constructing a set of interface keywords from the set of interface call information.

3. The method for automated vulnerability discovery in IoT device firmware based on deep learning according to claim 1, characterized in that, S2 specifically includes: S21. Perform semantic analysis on the interface call logs, interface definition files and interface call contexts in the historical vulnerability samples, and extract the interface names, parameter names, call keywords and call context fragments to form interface features; S22. Perform static analysis and behavioral trajectory analysis on vulnerability reports, exploit code and vulnerability trigger logs in historical vulnerability samples, and extract vulnerability type identifiers, vulnerability trigger conditions, input features and path context information in the exploit code to form vulnerability features; S23. For each interface keyword in the interface keyword set... Based on the extracted interface features and vulnerability features, calculate interface keywords. initial weights ,in, Based on interface keywords The severity level of a vulnerability is determined by its frequency of occurrence in historical vulnerability samples and the severity level of the corresponding vulnerability samples. S24. Introducing a time decay factor The initial weights are adjusted based on the time attributes of historical vulnerability samples. Perform time-weighted calculation of interface keywords Time-weighted weights ,satisfy ; S25. For all interface keywords in the interface keyword set Time-weighted weights Perform normalization processing to generate normalized weights. ; S26. Based on normalized weights The API keywords are sorted, and those with normalized weights greater than a preset threshold are selected. The selection results are used as a dynamic weighted API keyword library.

4. The method for automated vulnerability discovery in IoT device firmware based on deep learning according to claim 3, characterized in that, The severity level of the corresponding vulnerability sample in step S23 specifically includes: a level identifier determined based on the vulnerability's impact scope, exploitation difficulty, and disclosure time. This level identifier is divided into three levels: high-risk, medium-risk, and low-risk, each corresponding to a different level coefficient. The initial weight calculation incorporates the corresponding level coefficient with the interface keywords. The initial weights are obtained by weighting the occurrence frequency of each element. .

5. The method for automated vulnerability discovery in IoT device firmware based on deep learning according to claim 1, characterized in that, S4 specifically includes: S41. For each interface function in the set of interface functions... Extract the set of input variables for the interface function. The set of input variables This includes interface parameters, global variables, and context variables passed through the call chain; S42, using interface functions Starting with the vulnerability risk function set, each vulnerability risk function... As the endpoint, construct a control flow graph for the call paths between interface functions and risk functions. and data dependency graph ; S43, based on and For the set of input variables Perform forward data flow analysis to trace variable propagation paths and identify the data passed from input variables to the vulnerability risk function. Path nodes; S44. Perform synchronous backward data dependency analysis to determine the vulnerability risk function. By tracing the dependency path upstream, we can filter out the set of key instruction nodes and their corresponding data stream segments; S45. Integrate the results of forward data flow analysis and backward data dependency analysis to generate interface functions. To the vulnerability risk function slice path and all Composition of slice path set .

6. The method for automated vulnerability discovery in IoT device firmware based on deep learning according to claim 1, characterized in that, S5 specifically includes: S51, For slice path set Each static slice path in Based on the instruction set architecture of IoT device firmware, a symbolic execution environment is established. This environment includes a symbolic variable modeling module, a symbolic memory management module, and a symbolic execution engine, along with initialization interface functions. input variable set To symbolize the set of input variables, map the set of input variables to the symbolic memory space; S52, along the static slice path The corresponding instruction sequence is loaded according to the control flow order. Each instruction is symbolically processed using a symbolic execution engine. Symbolic processing includes converting operands in the instruction into symbolic variable expressions. The symbolic memory state is continuously updated in the symbolic memory management module, gradually generating a complete symbolic execution path. ; S53, in the execution path of the symbol. During the process, when a conditional branch instruction is encountered in the instruction stream, the comparison operation in the conditional statement is dynamically parsed, the conditional expression is extracted, and the symbolic variables involved in the conditional expression are used to construct path constraints. All path constraints accumulated during the path execution are then combined into a path constraint set. ; S54. Set the path constraints The input is fed into the constraint solver, which is a solution tool based on SMT theory and employs a symbolic variable constraint solving algorithm to solve the path constraint set. Solve all path conditions jointly to obtain the set of path constraints that satisfy the given conditions. Valid input data.

7. The method for automated vulnerability discovery of IoT device firmware based on deep learning according to claim 1, characterized in that, The determination of vulnerability type in S6 specifically includes: S61. Extract vulnerability type characteristics from historical vulnerability samples; S62. For each symbol execution path, extract the corresponding path features, trigger condition features, and input features; S63. Compare the extracted path features, trigger condition features, and input features with the vulnerability type features in the historical vulnerability samples, and calculate the feature similarity score for each. S64. Weighted fusion of the similarity scores of various features to calculate the total matching score; S65. Based on the total matching score and the preset matching threshold, select the vulnerability type with a matching score higher than the preset threshold as the vulnerability type determination result corresponding to the current symbolic execution path.

8. The method for automated vulnerability discovery of IoT device firmware based on deep learning according to claim 1, characterized in that, Specifically, S7 includes: S71. Extract vulnerability metadata information, which includes symbolic execution path, path constraint set, valid input data set, interface function, vulnerability risk function and vulnerability type identifier; S72. Parse the path constraint set in the vulnerability metadata information and extract the path context information, which includes path control flow features, branch condition features and input variable features. S73. Combine path context information with vulnerability type identifier to construct a context-aware prompt word template and generate corresponding prompt word text; S74. Input the prompt text into the large language model that has been fine-tuned and trained with historical vulnerability samples, and perform the reasoning generation process. S75. Generate PoC (Proof of Concept) exploit code targeting vulnerability metadata information from a large language model.

Images