Network printer vulnerability detection method based on logic and expert model multilayer fusion

Abstract

The invention is applicable to the technical field of network information security, and provides a network printer vulnerability detection method based on logic and expert model multi-layer fusion, which comprises the following steps: dividing a network data stream received by a printer into a plurality of stream fragments; counting a plurality of pieces of feature information of the network data flow; the multiple pieces of feature information are input into multiple different pre-sensing expert models to detect whether the received feature information is normal or not, and the parameter quantities of the pre-sensing expert models are 1-3k; when the abnormal feature information exists, determining a target concentration model based on the abnormal feature information; the parameter quantity of the target concentration model is 1-3M; and detecting the plurality of streaming fragments by using the target concentration model, when detecting that the network data stream has a target vulnerability, performing vulnerability rule detection on the plurality of streaming fragments based on the target vulnerability, and determining a vulnerability detection result based on a detection result. According to the method and the device, the vulnerability detection model can be deployed on the printer, and the detection interpretability description is provided.

Description

Technical Field

[0001] This application belongs to the field of network information security technology, and in particular relates to a network printer vulnerability detection method based on the multi-layer fusion of logic and expert models. Background Technology

[0002] With the development of machine learning and large language models, research and applications of using machine learning or large language models for vulnerability detection in Internet of Things (IoT) devices and source code are increasing. However, these detection methods generally suffer from two major problems. First, they are resource-intensive. Training a large language model can cost millions or even billions of dollars, limiting its availability to a few companies (such as OpenAI, an open AI research and deployment company). Even the deployment of some open-source models requires high-end commercial or consumer graphics cards, which makes vulnerability detection, especially in the IoT industry, even more difficult.

[0003] Intrusion Prevention Systems (IPS) and Intrusion Detection Systems (IDS) based on network monitoring have limited computing power, while printer jobs generate large amounts of data (including file information) with high real-time response requirements. Users cannot afford to wait for the device to perform logical reasoning for extended periods. This is even more true for printer-based inherent security protections, where the device's computing power is extremely limited, making it impossible to deploy vulnerability detection models. Another significant issue is the interpretability of large models. In traditional domains or language domains, even black-box information can be analyzed and deduced based on experience. However, in the IoT domain, especially in relatively closed and specialized IoT areas like printers, the lack of interpretability makes the vulnerabilities derived from the model difficult to handle and understand. Engineers cannot fix these vulnerabilities based on the results, significantly reducing the practical value of vulnerability discovery.

[0004] In summary, it is currently not possible to deploy vulnerability detection models on printers, and it is not possible to provide interpretability documentation for the detection. Summary of the Invention

[0005] This application provides a network printer vulnerability detection method based on a multi-layer fusion of logic and expert models, which can solve the problems of not being able to deploy vulnerability detection models on printers and not being able to provide interpretable descriptions of the detection.

[0006] This application provides a network printer vulnerability detection method based on a multi-layer fusion of logic and expert models, including:

[0007] The network data stream received by the printer is divided into multiple streaming segments;

[0008] Based on multiple streaming segments, statistical analysis is conducted on multiple characteristic information of the network data stream.

[0009] Multiple feature information is input into multiple different premonition expert models; the premonition expert models are used to detect whether the received feature information is normal, and the number of parameters of the premonition expert models is 1 to 3k.

[0010] When the detection results output by multiple premonition expert models indicate the presence of anomalous features among multiple feature information, a target focus model is determined based on the anomalous feature information; the number of parameters in the target focus model ranges from 1 to 3M.

[0011] The target-focused model is used to perform vulnerability detection on multiple streaming segments to obtain preliminary vulnerability detection results for network data streams;

[0012] When preliminary vulnerability detection results indicate that a target vulnerability exists in the network data stream, vulnerability rule detection is performed on multiple streaming segments based on the target vulnerability, and the vulnerability detection result of the network data stream is determined based on the vulnerability rule detection results.

[0013] Optionally, multiple feature information includes the call frequency of a specific call, the frequency of a specific command, the connection order of a specific command, the length of a specific data, the sensitivity of a specific data, message header features, and device status features.

[0014] Optionally, based on multiple streaming segments, statistical analysis of several characteristic features of the network data stream can be performed, including:

[0015] For each streaming segment, multiple feature information in the streaming segment is statistically analyzed;

[0016] For each of the multiple feature information, the feature information statistically obtained from multiple streaming segments is summarized to obtain multiple feature information of the network data stream.

[0017] Optionally, a target focus model can be determined based on anomaly feature information, including:

[0018] Determine the anomaly type to which the anomaly feature information belongs, and determine the target focus model corresponding to the anomaly type through the model selector;

[0019] The model selector pre-stores the correspondence between multiple exception types and multiple focus models.

[0020] Optionally, based on the target vulnerability, vulnerability rule detection is performed on multiple streaming segments, including:

[0021] Determine whether multiple streaming segments meet the criteria for the target vulnerability;

[0022] If the conditions are met, the vulnerability rule detection result indicates that the network data stream contains the target vulnerability;

[0023] Otherwise, the vulnerability rule detection result indicates that the target vulnerability does not exist in the network data stream.

[0024] Optionally, the vulnerability detection results of network data streams are determined based on the vulnerability rule detection results, including:

[0025] The vulnerability rule detection results are used as the vulnerability detection results for network data streams.

[0026] Optionally, the vulnerability detection results of network data streams are determined based on the vulnerability rule detection results, including:

[0027] The detection results, preliminary vulnerability detection results, and vulnerability rule detection results from multiple predictive expert models are input into the vulnerability detection model to perform vulnerability detection, thereby obtaining the vulnerability detection results of the network data stream; the number of parameters in the vulnerability detection model is 10 to 20M.

[0028] Optionally, network printer vulnerability detection methods also include:

[0029] When the detection results output by multiple premonition expert models indicate that multiple feature information is normal, it is determined that there are no vulnerabilities in the network data stream.

[0030] Optionally, network printer vulnerability detection methods also include:

[0031] If the initial vulnerability detection results indicate that there are no vulnerabilities in the network data, then it is determined that there are no vulnerabilities in the network data stream.

[0032] The above-mentioned solution in this application has the following beneficial effects:

[0033] In the embodiments of this application, a lightweight, function-specific predictive expert model is used to perform preliminary detection on the network data stream received by the printer. When an anomaly is detected, a lightweight focused model is further used to perform vulnerability detection on the network data stream. When a vulnerability is detected in the network data stream, vulnerability rule detection is performed on the network data stream to determine whether the network data stream meets the corresponding vulnerability conditions, thereby analyzing the cause of the vulnerability and providing an interpretability explanation for the detection. Furthermore, since the predictive expert model and the focused model have extremely small parameter counts compared to traditional large models, their inference speed is extremely fast and their computational overhead is extremely low. For specific tasks such as printing, which involve interruptions in processes like paper feeding, halftone algorithms, paper output, and fixing, the millisecond-level inference time of the predictive expert model and the focused model does not affect the normal operation of the task. Therefore, this application can deploy a vulnerability detection model on the printer without affecting the printer's normal printing tasks.

[0034] Other beneficial effects of this application will be described in detail in the following detailed description section. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 A flowchart of a network printer vulnerability detection method based on multi-layer fusion of logic and expert models provided in an embodiment of this application. Detailed Implementation

[0037] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0038] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0039] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0040] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0041] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0042] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0043] To address the current limitations of deploying vulnerability detection models on printers and providing interpretable explanations for detection methods, this application provides a network printer vulnerability detection method based on a multi-layered fusion of logic and expert models. This method uses a lightweight, function-specific predictive expert model to perform preliminary detection on the network data stream received by the printer. When an anomaly is detected, a lightweight focused model further performs vulnerability detection on the network data stream. If a vulnerability is detected, vulnerability rule detection is performed on the network data stream to determine if it meets the corresponding vulnerability conditions, thereby analyzing the cause of the vulnerability and providing interpretable explanations for the detection. Furthermore, since the predictive expert model and the focused model have extremely small parameter counts compared to traditional large models, their inference speed is extremely fast and their computational overhead is extremely low. For specific tasks like printing, which involve interruptions in paper feeding, halftone algorithms, paper output, and fixing processes, the millisecond-level inference time of the predictive expert model and the focused model does not affect the normal operation of the task. Therefore, this application can deploy a vulnerability detection model on the printer without affecting the printer's normal printing operations.

[0044] The following is an exemplary description of the network printer vulnerability detection method based on the multi-layer fusion of logic and expert models provided in this application, with reference to specific embodiments.

[0045] like Figure 1 As shown in the embodiments of this application, the network printer vulnerability detection method based on multi-layer fusion of logic and expert models includes the following steps:

[0046] Step 11: Divide the network data stream received by the printer into multiple streaming segments.

[0047] The aforementioned network data streams are sent by terminal devices (such as computers, smartphones, etc.) connected to the printer. Specifically, they can be printer status query data streams used to check printer status (such as whether it is online, whether it is out of paper, etc.), printer parameter setting data streams used to set printer parameters (such as resolution, paper tray selection, etc.), and print job data streams used to print data (such as text, images, etc.). It should be noted that the aforementioned printer can be an inkjet printer or a laser printer; in this embodiment, the type of printer is not limited.

[0048] In some embodiments of this application, the network data stream can be in the form of streaming protocol data, such as streaming Printer Job Language (PJL) data or IPP data.

[0049] In some optional embodiments, the network data stream received by the printer is divided into multiple streaming segments. Specifically, the network data stream can be segmented into syntactic blocks based on the protocol syntax. This is because the printer uses streaming printing and cannot wait for all data to be processed, while each syntactic clause and statement in the protocol has its own expressive meaning. It is worth noting that this segmentation also includes parts of the Page Description Language (PJL), because some data in the printing protocol, such as PJL, are inseparable from the PJL. It is understood that if the network data stream is streaming PJL data, then the protocol syntax is PJL syntax.

[0050] Step 12: Based on multiple streaming segments, statistically analyze multiple feature information of the network data stream.

[0051] In some embodiments of this application, the aforementioned multiple feature information includes the call frequency of a specific call, the frequency of a specific command, the connection order of a specific command, the length of a specific data, the sensitivity of a specific data, message header features, and device status features.

[0052] The call frequency of the aforementioned specific calls refers to the call frequency of network printing commands issued by the terminal device for the printer; the frequency of the aforementioned specific commands refers to the frequency of commands of particular interest, in addition to the call frequency, such as commands that retrieve the printer catalog. These commands are counted separately because they are related to device security; the order of the aforementioned specific commands refers to the semantics represented by multiple commands combined, such as: retrieve printer capabilities -> retrieve printer status -> print -> retrieve task results. This is the command order; the specific data length refers to the length of data in the command, such as PC name, document name, etc., because some memory overflow vulnerabilities are caused by excessively long data; the sensitivity of specific data refers to specific symbols in the data, such as those stored in strings (such as usernames or document names). Strings such as / and '' may introduce vulnerabilities (bugs); the message header refers to the message header structure information, generally defined by a standardized Request for Comment (RFC) document, used to specify the structural specifications of the response protocol, including a set of header fields that identify the start of the message, describe message attributes, and control the transmission process. Message header features refer to the structured information extracted after structuring the message header according to rules, that is, structuring the streaming message header content into structured data with message characteristics; the extraction of device state features is based on finite state machine theory, using the device (i.e., printer) state set to construct a finite state machine, which includes the device state and the process of device state transition. During feature extraction, the transition conditions are ignored, and the structured data of the device state transition process within a certain time window is retained.

[0053] In some embodiments of this application, multiple feature information in each streaming segment can be statistically analyzed; then, for each of the multiple feature information, the feature information statistically analyzed from the multiple streaming segments can be summarized to obtain multiple feature information of the network data stream.

[0054] Specifically, for each streaming segment, the call frequency of a specific call, the frequency of a specific command, the connection order of a specific command, the length of a specific data segment, and the sensitivity of a specific data segment must be statistically analyzed. If a certain feature is not present in a streaming segment, that feature is recorded as 0. For example, if a specific call is not present in a streaming segment, the call frequency of that specific call is 0. As a preferred example, a statistical analyzer can be used to analyze the feature information of each streaming segment. This statistical analyzer can be a commonly used calculation module, equivalent to logging, that is, during parsing, it counts the key content to be analyzed. The difference between a log and a statistical analyzer is that a log only records data, while a statistical analyzer updates the data over a period of time. For example, in the statistical analyzer's function of counting the number of characters, each time a character is received, the count field of the received characters is incremented by 1. Therefore, for the above features, the statistical analyzer can be used to perform statistical calculations separately.

[0055] Understandably, after statistically analyzing multiple features of each streaming segment, these features can be summarized according to their type. For example, the statistically analyzed features of the same type can be organized into a vector / sequence, and this organized vector / sequence can be used as a feature of the network data stream. For instance, the call frequencies of specific calls statistically analyzed from multiple streaming segments can be organized into a vector / sequence, and this organized vector / sequence can be used as the call frequencies of specific calls in the network data stream.

[0056] Step 13: Input multiple feature information into multiple different premonition expert models; the premonition expert models are used to detect whether the received feature information is normal, and the number of parameters of the premonition expert models is 1 to 3k.

[0057] In some embodiments of this application, the aforementioned multiple premonition expert models are pre-trained models, all of which are lightweight models with extremely fast derivation and inference times. Their inference time on a motherboard with a graphics acceleration chip is less than 0.1ms, and their inference time on a motherboard dominated by a central processing unit (CPU) is still <1ms. Each premonition expert model has a specific function, used only to identify a specific pattern or threat type, that is, only to detect one type of special information to determine whether that special information is normal.

[0058] Corresponding to the above-mentioned special information, multiple predictive expert models include call frequency expert model, IPP protocol judgment expert model, PJL syntax rule judgment expert model, data length expert model, instruction expert model, call order expert model, response information expert model, and device status change expert model.

[0059] The aforementioned expert models can all be obtained by training a lightweight binary classifier. The binary classifier can use the Naive Bayes algorithm because it has high computational efficiency, low resource consumption, and is suitable for fast binary classification tasks.

[0060] Call frequency expert models are used to monitor the call frequency of device interfaces, specific functions, or APIs, aiming to detect abnormally high-frequency calls within a short period, such as DDoS attacks and brute-force attacks. In practical applications, the call frequency of a specific call or the frequency of a specific command can be input into the model for processing, outputting whether the call frequency of the specific call or the frequency of the specific command is normal or abnormal. To train the call frequency expert model, features can be extracted from the timestamps and function call records in the system logs and network packet capture data of the device (i.e., the printer) during operation to obtain the corresponding call frequency features. A time window-based labeling method is used: for historical normal data, the call frequency within all time windows is labeled as "normal"; for attack simulation data, the corresponding time window is labeled as "abnormal". These labeled data are then used to train a binary classifier to obtain the call frequency expert model.

[0061] The IPP protocol judgment expert model is used to quickly determine whether incoming IPP packets conform to the protocol specifications, filtering out malformed or forged IPP requests. In practical applications, packet header features can be input into the model for processing, outputting whether the packet header features are normal or abnormal. To train the IPP protocol judgment expert model, a positive sample library can be built based on IPP traffic from interactions between Microsoft systems (Windows), Apple systems (macOS), Linus Torvalds' open-source system (Linux), and Android systems and printers. A negative sample library is constructed using attack traffic from tools such as fuzz testing and PRET (a toolkit for hijacking printers and printing illegal content). These positive and negative samples are then used to train a binary classifier to obtain the IPP protocol judgment expert model.

[0062] The PJL syntax rule judgment expert model is used to verify the syntax of PJL commands to prevent the execution of unexpected operations by constructing malicious PJL commands. In practical applications, message header features can be input into this model for processing, and the output will indicate whether the message header features are normal or abnormal. To train the PJL syntax rule judgment expert model, corresponding positive samples can be extracted based on printer job log data, negative samples can be generated using fuzz testing, and these positive and negative samples can be used to train a binary classifier to obtain the PJL syntax rule judgment expert model.

[0063] Data length expert models are used to detect anomalies in data length within a specific context to uncover potential buffer overflow attack attempts. In practical applications, a specific data length can be input into the model for processing, and the output will indicate whether the data length is normal or abnormal. To train the data length expert model, the data length distribution for each instruction type (such as JOBNAME in PJL and document-name-supplied in IPP) can be statistically analyzed based on historical logs. Negative samples are generated using fuzz testing, and these positive and negative samples are used to train a binary classifier to obtain the data length expert model.

[0064] Command expert models are used to quickly determine whether a received command is a legitimate command supported by the device. In practical applications, specific data sensitivity can be input into the model for processing, and the output will indicate whether the specific data sensitivity is normal or abnormal. To train the command expert model, positive samples can be constructed based on a detailed "legitimate command whitelist" built by manufacturer experts, negative samples can be generated using fuzz testing, and these positive and negative samples can be used to train a binary classifier to obtain the command expert model.

[0065] Call sequence expert models are used to identify illogical or abnormal operation sequences by analyzing patterns in instruction sequences. In practical applications, a specific command sequence can be input into the model for processing, and the model will output whether the command sequence is normal or abnormal. To train a call sequence expert model, instruction call sequences can be extracted from long-term operation logs under normal usage scenarios to construct positive samples. Negative samples are generated using fuzz testing, and these positive and negative samples are used to train a binary classifier to obtain the call sequence expert model.

[0066] The response information expert model is used to identify whether a serious error code is returned under normal requests or excessive debugging information is leaked. In practical applications, specific data sensitivity can be input into the model for processing, and the output will indicate whether the specific data sensitivity is normal or abnormal. To train the response information expert model, response information from devices (i.e., printers) under various normal interactions can be captured and recorded to form a "normal response library." Abnormal responses include known error codes, special responses triggered by security scanning tools, and responses that leak sensitive information observed in penetration testing. The features of these normal and abnormal responses are used to train a binary classifier to obtain the response information expert model.

[0067] Equipment state change expert models are used to transform equipment states into Markov chains and learn normal state transition paths. In practical applications, equipment state characteristics can be input into this model for processing, and the output can indicate whether the equipment state characteristics are normal or abnormal. To train the equipment state change expert model, the equipment state can be continuously monitored through network management traps (SNMP traps), the device's web interface, or logs, recording state change sequences, constructing positive samples, generating negative samples using fuzz testing, and using these positive and negative samples to train a binary classifier to obtain the equipment state change expert model.

[0068] Step 14: When the detection results output by multiple premonition expert models indicate that there are abnormal feature information among multiple feature information, determine the target focus model based on the abnormal feature information; the number of parameters of the target focus model is 1 to 3M.

[0069] When multiple expert models output detection results indicating that multiple feature information are normal, it is determined that there are no vulnerabilities in the network data stream. At this point, the printer will execute the operations corresponding to the network data stream normally.

[0070] That is, in some embodiments of this application, if the detection result output by a premonition expert model shows that the detected feature information is abnormal (i.e., abnormal feature information), then it is necessary to determine the target focus model in order to perform further vulnerability detection on the network data stream.

[0071] Specifically, in some embodiments of this application, the anomaly type to which the anomaly feature information belongs can be determined first, and then the target focus model corresponding to the anomaly type can be determined through a model selector. The model selector pre-stores the correspondence between multiple anomaly types and multiple focus models.

[0072] It should be noted that the exception type to which the exception feature information belongs is determined based on the exception feature information itself. That is, the exception type corresponding to the feature described by the exception feature information is the exception of that feature. For example, if the exception feature information is the call frequency of a specific call, then the exception type to which the call frequency of a specific call belongs is a call exception; if the exception feature information is the frequency of a specific command, then the exception type to which the frequency of a specific command belongs is a command exception; if the exception feature information is the connection order of a specific command, then the exception type to which the connection order of a specific command belongs is a command connection order exception; if the exception feature information is a specific data length, then the exception type to which the specific data length belongs is a data length exception; if the exception feature information is a specific data sensitivity, then the exception type to which the specific data sensitivity belongs is a data sensitivity exception.

[0073] In some embodiments of this application, the aforementioned focus models are pre-trained models, all of which are lightweight models with extremely fast derivation and inference times. Their inference time on a motherboard with a graphics acceleration chip is approximately 0.5ms, while on a CPU-dominated motherboard, the inference time is 1–20ms. Because the focus models have 10 times more parameters than the intuition expert models, they can perform lightweight convolutional neural network (CNN) convolution calculations, lightweight transformer models, and fully connected neural networks, possessing the ability to understand context and classify. Therefore, these experts are mainly used for further understanding the semantics of print job language, further identifying abnormal traffic and junk data, judging the legality of print data such as PCL and PS (both PCL and PS are page description languages), and classifying suspicious content using a Common Defective List (CWE).

[0074] Specifically, the aforementioned focused models include: CWE type judgment expert model, time series-based traffic anomaly detection expert model, semantic recognition expert model, printed data content recognition expert model, and spam data detection expert model.

[0075] The aforementioned focused models can all be obtained by training a Transformer. To avoid affecting the printer's printing task execution, the Transformer can be designed with 8 layers, with a hidden layer size of 128 units. Because a fully connected layer is used, the number of parameters = (number of input units + 1) × number of output units, which is approximately 1.1M. The specific configuration can be adjusted according to the device performance, such as 7 layers, 6 layers, or reducing the number of units to 124 or 120.

[0076] The aforementioned focus models are all used to perform in-depth analysis on multiple streaming segments. If multiple streaming segments have vulnerabilities, the output will indicate the possible existence of target vulnerabilities. If multiple streaming segments do not have vulnerabilities, the output will indicate the absence of vulnerabilities.

[0077] The CWE type judgment expert model can be trained on the Transformer using NIST SARD (Software Assurance Reference Dataset) and publicly available PoC code for printing devices as training data. The time-series-based traffic anomaly detection expert model can be trained on the Transformer using publicly available time-series datasets and internally collected anomaly samples as training data. The semantic recognition expert model can be constructed based on accumulated experience, defining intents and corresponding instruction sets to train the Transformer. The print data content recognition expert model can be trained on the Transformer using Printer Command Language Version 5 (PCL5), Printer Command Language Version 6 (PCL6), PostScript traffic data, and negative samples constructed from relevant publicly available common vulnerability disclosures (CVEs). The spam detection expert model can be trained on the Transformer using negative samples generated by fuzz testing.

[0078] It should be noted that the CWE type judgment expert model can output specific Common Vulnerability Enumeration (CWE) categories. The time-series-based traffic anomaly detection expert model can model network traffic data over longer time spans and with more dimensions to discover more complex and patterned abnormal traffic that the "premonition expert model" cannot capture, outputting traffic-related vulnerability results. The semantic recognition expert model can distinguish tools that "set the job name to 'Test'", outputting semantically related vulnerability results. The print data content recognition expert model can output vulnerability results related to print data content. The spam data detection expert model can distinguish between normal, structured data and completely random, meaningless entropy-increasing data streams, outputting spam data-related vulnerability results.

[0079] Step 15: Use the target focus model to perform vulnerability detection on multiple streaming segments to obtain preliminary vulnerability detection results for the network data stream.

[0080] In some embodiments of this application, after determining the target-focused model, multiple streaming segments are input into the target-focused model for vulnerability detection to obtain preliminary vulnerability detection results. It is understood that if there are multiple target-focused models, multiple streaming segments need to be input into each target-focused model so that each model can perform targeted vulnerability detection, and finally, the vulnerability detection results output by all target-focused models are used as the preliminary vulnerability detection results.

[0081] Step 16: When the preliminary vulnerability detection results indicate that there is a target vulnerability in the network data stream, vulnerability rule detection is performed on multiple streaming segments based on the target vulnerability, and the vulnerability detection result of the network data stream is determined based on the vulnerability rule detection results.

[0082] If the initial vulnerability detection results indicate that there are no vulnerabilities in the network data, it is determined that the network data stream is not vulnerable. At this point, the printer will execute the operations corresponding to the network data stream normally.

[0083] That is, when the initial vulnerability detection results indicate that there is a target vulnerability in the network data stream, it is also necessary to perform vulnerability rule detection on the network data stream to determine whether the network data stream meets the corresponding vulnerability conditions, thereby analyzing the cause of the vulnerability and providing an interpretability explanation for the detection.

[0084] Specifically, the implementation of vulnerability rule detection for multiple streaming segments based on a target vulnerability can be as follows: determine whether multiple streaming segments meet the conditions of the target vulnerability; if they do, determine that the vulnerability rule detection result indicates the presence of a target vulnerability in the network data stream; otherwise, determine that the vulnerability rule detection result indicates the absence of a target vulnerability in the network data stream. It is understandable that if there are multiple target vulnerabilities, vulnerability rule detection needs to be performed on multiple streaming segments separately for each target vulnerability.

[0085] To facilitate vulnerability rule detection, a rule engine can be used to pre-store the conditions (generally necessary and sufficient conditions) for each potential vulnerability in a printer. Specifically, the conditions for each vulnerability can be compiled and stored based on the experience of cybersecurity and printer industry experts, CVE vulnerabilities, printer manufacturer vulnerabilities, and printer language specifications. In actual storage, a rule for each vulnerability can be stored, containing "rule name: rule number: rule condition (if): rule conclusion (then)". Rule conditions can use AND, OR, and NOT for logical judgments, and other rules can be referenced within the conditions to implement nested rule logic.

[0086] Each rule represents the necessary and sufficient conditions for a known vulnerability. For example, "Electric shock rule: 0001: Touching the wire & the wire is connected to the power source: Electric shock", where '&' represents 'and'.

[0087] Specifically, the rules are parsed by the rule engine's scheduling application programming interface (API). External code calls the API to input parameters and execute the rules. The rule engine then returns the execution results along with an explanatory string. Therefore, the rule engine can perform logical judgments based on traditional experience and provide reasonable explanations for specific code.

[0088] In some embodiments of this application, there are three ways to determine the vulnerability detection result of the network data stream based on the vulnerability rule detection result after obtaining the vulnerability rule detection result.

[0089] The first type is the strict mode: the vulnerability rule detection results are directly used as the vulnerability detection results of the network data stream.

[0090] The second type is the intelligent mode: the detection results, preliminary vulnerability detection results and vulnerability rule detection results output by multiple predictive expert models are input into the vulnerability detection model to perform vulnerability detection, and the vulnerability detection results of the network data stream are obtained; the number of parameters of the vulnerability detection model is 10 to 20M.

[0091] The vulnerability detection model described above is a pre-trained model with an estimated inference time of 100–500ms. Because the model parameters have been further expanded, it can perform intent recognition, prediction of critical system API calls, and PJL semantic analysis. A comprehensive judgment is then made based on this model to arrive at the final decision. Note that the inference at this point has a segment delay of 500ms; consecutive segments can cause printing stutters. However, since this is a high-risk scenario, slight stuttering is acceptable. Furthermore, because most printers use a minimum task per page approach, the stuttering is mainly concentrated at page transitions and has no impact on single-page printing. Paper jams or ink leaks will not occur due to stuttering during single-page printing.

[0092] As an optional example, the vulnerability detection model described above can be trained on a Transformer to integrate the outputs of the intuition and focus models with printer status data to determine whether an anomaly is detected. In practical applications, it can be trained using a large number of training samples, where each training sample contains the detection results output by multiple intuition expert models, preliminary vulnerability detection results, and vulnerability rule detection results, and each training sample has a corresponding label (normal or abnormal).

[0093] The third type is the normal mode: relevant personnel make vulnerability judgments based on vulnerability rule detection results and experience.

[0094] In summary, this application solves the problems of not being able to deploy vulnerability detection models on printers and not being able to provide interpretable descriptions of the detection by combining multiple lightweight machine learning expert models with a set of experience-based logical judgment rule bases. It achieves high-efficiency detection, high-accuracy detection, and provides interpretable descriptions of the detection, enabling efficient detection and defense against security vulnerabilities targeting Page Description Language (PDL).

[0095] The above description is the preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principles described in this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A network printer vulnerability detection method based on multi-layer fusion of logic and expert models, characterized in that, include: The network data stream received by the printer is divided into multiple streaming segments; Based on the multiple streaming segments, statistical analysis is performed on multiple characteristic information of the network data stream; The multiple feature information is input into multiple different premonition expert models; the premonition expert models are used to detect whether the received feature information is normal, and the number of parameters of the premonition expert models is 1 to 3k. When the detection results output by multiple premonition expert models indicate the presence of abnormal feature information among the multiple feature information, a target focus model is determined based on the abnormal feature information; the number of parameters of the target focus model is 1 to 3M. The target-focused model is used to perform vulnerability detection on the multiple streaming segments to obtain preliminary vulnerability detection results for the network data stream; When the preliminary vulnerability detection results indicate that the network data stream contains a target vulnerability, vulnerability rule detection is performed on the multiple streaming segments based on the target vulnerability, and the vulnerability detection result of the network data stream is determined based on the vulnerability rule detection results.

2. The network printer vulnerability detection method according to claim 1, characterized in that, Multiple characteristic information includes the call frequency of a specific call, the frequency of a specific command, the connection order of a specific command, the length of a specific data, the sensitivity of a specific data, message header characteristics, and device status characteristics.

3. The network printer vulnerability detection method according to claim 1, characterized in that, The step of statistically analyzing multiple feature information of the network data stream based on the multiple streaming segments includes: For each of the streaming segments, the plurality of feature information in the streaming segment is statistically analyzed; For each of the multiple feature information, the feature information statistically obtained from the multiple streaming segments is summarized to obtain multiple feature information of the network data stream.

4. The network printer vulnerability detection method according to claim 1, characterized in that, The method for determining the target focus model based on the abnormal feature information includes: Determine the anomaly type to which the anomaly feature information belongs, and determine the target focus model corresponding to the anomaly type through a model selector; The model selector pre-stores the correspondence between multiple exception types and multiple focus models.

5. The network printer vulnerability detection method according to claim 1, characterized in that, The step of performing vulnerability rule detection on the multiple streaming segments based on the target vulnerability includes: Determine whether the multiple streaming segments meet the conditions of the target vulnerability; If the conditions are met, the vulnerability rule detection result indicates that the target vulnerability exists in the network data stream; Otherwise, the vulnerability rule detection result is determined to be that the target vulnerability does not exist in the network data stream.

6. The network printer vulnerability detection method according to claim 1, characterized in that, The determination of the vulnerability detection result of the network data stream based on the vulnerability rule detection result includes: The vulnerability rule detection results are used as the vulnerability detection results of the network data stream.

7. The network printer vulnerability detection method according to claim 1, characterized in that, The determination of the vulnerability detection result of the network data stream based on the vulnerability rule detection result includes: The detection results output by multiple premonition expert models, the preliminary vulnerability detection results, and the vulnerability rule detection results are input into the vulnerability detection model for vulnerability detection to obtain the vulnerability detection results of the network data stream; the number of parameters of the vulnerability detection model is 10 to 20M.

8. The network printer vulnerability detection method according to claim 1, characterized in that, The network printer vulnerability detection method also includes: When the detection results output by multiple premonition expert models indicate that all the multiple feature information are normal feature information, it is determined that there are no vulnerabilities in the network data stream.

9. The network printer vulnerability detection method according to claim 1, characterized in that, The network printer vulnerability detection method also includes: When the preliminary vulnerability detection results indicate that the network data does not have any vulnerabilities, it is determined that the network data stream does not have any vulnerabilities.

Images