Industrial equipment firmware security risk assessment method and system based on high-risk function detection

Abstract

The invention discloses an industrial equipment firmware risk assessment method and system based on high-risk function detection, and the method comprises the steps: firstly, converting target firmware into unified intermediate representation through a firmware analysis module, and carrying out the targeted processing of encrypted or obfuscated codes; secondly, fusing static features and dynamic simulation execution features through a function feature extraction module; then, calculating the matching degree of the function and the vulnerability mode through a high-risk feature library matching module; and finally, through a risk assessment and dynamic verification module, based on a multi-factor model fusing a matching degree, a false alarm suppression factor, a calling frequency, a module influence factor and a dynamic verification weight, calculating a comprehensive risk score and outputting a visual result. Through closed-loop cooperation of all the modules, automatic and precise detection and risk assessment of the high-risk function are achieved, the problems that in the prior art, the false alarm rate is high, the missing report rate is high, and the result interpretability is poor are effectively solved, and the efficiency and reliability of large-scale firmware security analysis are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of industrial equipment firmware security, and specifically to a method and system for assessing industrial equipment firmware security risks based on high-risk function detection. Background Technology

[0002] With the widespread application of industrial equipment and embedded systems in critical infrastructure and smart manufacturing, firmware security has become a core challenge for industrial cybersecurity. In 2024, high-risk functions (such as buffer overflows and command injection) remained the primary attack targets in industrial equipment firmware vulnerabilities. However, existing firmware analysis techniques have significant shortcomings, such as static feature matching (overly sensitive matching, rigid rule matching, and lack of dynamic context verification) and dynamic symbolic execution (requiring customized simulation environments to adapt to hardware, resulting in high costs and low coverage).

[0003] Chinese patent application number 202311042643.8 discloses an iPCM firmware function vulnerability similarity detection method based on convolutional neural networks, which optimizes the shortcomings of existing firmware function vulnerability detection methods. First, a BiLSTM-based method is used to address the shortcomings of the original method in not considering the impact of inter-instruction interactions on feature learning, thereby improving the model's cross-platform vulnerability detection capability. Second, a main neighborhood aggregation network method is used to change the original single aggregator to a multi-neighborhood aggregator, fully learning graph embedding features to improve vulnerability detection performance. Finally, a convolutional neural network based on a parameterless attention mechanism is introduced to enhance feature representation, further improving the vulnerability similarity detection model's capabilities. This technology is based on convolutional neural networks (CNN) and BiLSTM for code feature extraction, but it only relies on static graph embedding features (such as control flow graph structure) and does not integrate dynamic code behavior (such as taint propagation paths or real vulnerability triggering conditions). This results in a high false negative rate for variant vulnerabilities (such as instruction reordering and obfuscated code). Furthermore, the black-box nature of this deep learning model (such as CNN) makes the detection results lack interpretability and cannot provide visual evidence of vulnerability triggering paths (such as call chains or data flow graphs), making it difficult to assist in manual verification.

[0004] Chinese patent application number 202211710995.1 discloses a method for firmware function risk classification and assessment based on a two-stage risk index. This method includes a data preprocessing model, a correlation coefficient calculation model, a firmware function risk level classification calculation model, and a firmware function risk assessment model. Data is segmented and applied to the correlation coefficient calculation model to indicate the correlation between firmware functions and known vulnerable functions. Then, a feature distance calculation method is used to calculate the feature distance between the firmware function and the most likely closest known vulnerable function. Euclidean distance and Manhattan distance, combined with the correlation coefficient, are used as important bases for firmware function risk classification. The feature coefficients calculated in the first two stages are used as the firmware function risk coefficients. However, this method only relies on static feature distances (Euclidean distance, Manhattan distance) and correlation coefficients for risk assessment, resulting in a high false positive rate. Furthermore, it does not incorporate dynamic execution verification (such as fuzzing or symbolic execution), making it impossible to confirm whether a vulnerability is truly triggerable. Summary of the Invention

[0005] To address the aforementioned issues, this invention proposes a method and system for assessing the security risks of industrial equipment firmware based on high-risk function detection. It integrates quantitative assessment methods such as dynamic verification weights, false alarm suppression factors, and module impact factors, which greatly reduces the false alarm rate of automated high-risk function judgment.

[0006] Technical solution:

[0007] A method for risk assessment of industrial equipment firmware based on high-risk function detection includes the following steps:

[0008] S1, Firmware parsing: Convert the target firmware into a unified intermediate representation, restore the control flow of the obfuscated code in the firmware, and decrypt the encrypted firmware.

[0009] S2, Extract function features: Based on the intermediate representation, extract the features of the functions in the firmware, including static features and dynamic features obtained based on simulated execution;

[0010] S3, High-risk feature database matching: Perform graph matching between the extracted features and the preset high-risk feature database, and calculate the matching degree between the objective function and the high-risk vulnerability pattern;

[0011] S4, Risk Assessment and Dynamic Verification: Based on the matching degree, combined with the false alarm suppression factor, function call frequency, the influence factor of the module where the function is located, and the dynamic verification weight, the comprehensive risk score of the target function is calculated through the risk scoring model, and the risk level of the target function is classified according to the comprehensive risk score; wherein, the dynamic verification weight is determined after the target function is dynamically verified by the simulation execution engine.

[0012] Preferably, in step S1, control flow recovery is performed on the obfuscated code, which specifically includes: extracting the branch conditions of the basic blocks, parsing the jump logic based on the constraint solver to generate the original control flow graph; prioritizing the paths in the control flow graph by combining static pattern matching and dynamic execution frequency analysis; removing dead code blocks and invalid branches in the control flow graph, and retaining the core data flow paths.

[0013] Preferably, in step S1, the encrypted firmware is decrypted, specifically using a segmented symbolic execution method, including: locating the encrypted area through firmware header features and triggering the decryption function using symbolic execution; performing intermediate representation conversion on the decrypted code fragments and caching the path constraints of the decryption function.

[0014] Preferably, in step S2, the extracted dynamic features include tainted data propagation paths and function permission markers; the extraction of tainted data propagation paths is achieved by instrumenting the parameters of high-risk functions in the simulation execution engine and monitoring the propagation of tainted data; the function permission markers are determined by statically analyzing the symbol table and memory permission rules, combined with monitoring privileged instruction calls in the simulation execution engine.

[0015] Preferably, in step S3, a feature library is first constructed, vulnerability patterns are extracted from the CWE database and converted into a graph structure; instruction variants are mapped to unified operations through semantic normalization; then graph matching is performed, which adopts a hierarchical matching strategy, uses the VF3 algorithm to prioritize matching high-risk feature nodes, and assigns weights to different nodes; the graph structure is compressed, irrelevant nodes are removed, and critical paths are retained.

[0016] Preferably, in step S3, the matching degree is expressed as:

[0017] .

[0018] As a preferred option, the calculation formula for the risk scoring model is:

[0019]

[0020] Where α, β, and γ are weighting coefficients, MatchScore is the matching degree, lg(N false positives) is the false positive suppression factor, calculated based on the historical false positive count N of high-risk vulnerability patterns; CallFrequency is the function call frequency; and ImpactFactor is the module impact factor. To dynamically verify the weights, the objective function is determined by performing lightweight dynamic verification through a simulation execution engine.

[0021] Preferably, based on the risk assessment results, an interactive call chain graph of the target function is generated and output, and the graph highlights the data flow path of high-risk functions.

[0022] This invention also discloses an industrial equipment firmware risk assessment system based on high-risk function detection, used to implement the above-mentioned assessment method, including:

[0023] The firmware parsing module is configured to convert the target firmware into a unified intermediate representation, restore the control flow of obfuscated code in the firmware, and decrypt encrypted firmware.

[0024] A function feature extraction module is configured to extract static and dynamic features of functions in the firmware based on the intermediate representation.

[0025] The high-risk feature library construction and matching module is configured to store high-risk vulnerability patterns, and performs graph matching between the extracted function features and the high-risk feature library to calculate the matching degree between the target function and the high-risk vulnerability pattern.

[0026] The risk assessment and dynamic verification module is configured to calculate the comprehensive risk score of the objective function based on the matching degree, combined with the false alarm suppression factor, function call frequency, module impact factor and dynamic verification weight, through a risk scoring model, and output the risk assessment result.

[0027] Preferably, the risk assessment and dynamic verification module is also configured to generate an interactive call chain graph of the target function, which visually displays the data flow path of the high-risk function.

[0028] Preferably, the function feature extraction module integrates a simulation execution engine, which is used to obtain dynamic features and perform the lightweight dynamic verification by simulating the execution of the target function code.

[0029] The beneficial effects of this invention are:

[0030] 1. This invention proposes a multi-factor firmware high-risk function risk scoring model, which integrates dynamic verification weight W (dynamic verification), false alarm suppression factor lg(N false alarms), and module impact factor (ImpactFactor) and other quantitative evaluation methods, greatly reducing the false alarm rate of automated high-risk function judgment.

[0031] 2. By employing a snapshot mechanism based on the Unicorn engine and a targeted selective taint data tracking strategy, this invention significantly reduces memory usage and storage overhead during simulation execution, thereby improving the feasibility and efficiency of analyzing large-scale firmware.

[0032] 3. This invention integrates a feature library based on CWE standards and custom rules, and introduces dynamic verification results as a key weight factor in the risk scoring model, thus constructing a dual verification mechanism that combines static and dynamic methods. This effectively identifies false alarms generated by static analysis, thereby significantly reducing the overall false alarm rate.

[0033] 4. This invention combines quantitative multi-factor risk scoring with a visualized function call chain graph, providing a clear data flow path context and risk assessment basis for the detection results. This greatly assists security analysts in quickly locating and manually verifying high-risk functions, thus improving analysis efficiency.

[0034] 5. This invention automates the risk scoring and priority ranking of high-risk functions in firmware, providing security personnel with a clear order of remediation guidance. This system can efficiently and accurately address the security vulnerability detection needs of large-scale firmware, possessing significant practical value and broad applicability.

[0035] 6. This invention designs an industrial equipment firmware risk assessment system based on high-risk function detection, comprising a firmware parsing module, a function feature extraction module, a high-risk feature library construction and matching module, and a risk assessment and dynamic verification module. These modules work closely together to form a closed-loop analysis system, enabling automated detection, evaluation, and ranking of the risks of high-risk functions. This can greatly reduce the false alarm rate. Several zero-day vulnerabilities have already been discovered in the firmware of several well-known products both domestically and internationally, which is beneficial for security vulnerability detection in large-scale firmware. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below.

[0037] Figure 1 This is a schematic diagram of the structure of an industrial equipment firmware risk assessment system based on high-risk function detection according to an embodiment of the present invention;

[0038] Figure 2 This is a schematic diagram of the firmware parsing module structure according to an embodiment of the present invention;

[0039] Figure 3 This is a schematic diagram of the function feature extraction module structure according to an embodiment of the present invention;

[0040] Figure 4 This is a schematic diagram of the high-risk feature database construction and matching module according to an embodiment of the present invention;

[0041] Figure 5 This is a schematic diagram of the risk assessment and dynamic verification module structure according to an embodiment of the present invention. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this invention clearer, the following detailed description, in conjunction with the accompanying drawings and embodiments, further illustrates the invention. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of the invention.

[0043] Example 1

[0044] like Figure 1 As shown, this invention discloses a method for assessing the firmware risk of industrial equipment based on high-risk function detection, comprising the following steps:

[0045] S1, Firmware Parsing: Convert the target firmware into a unified intermediate representation, restore the control flow of the obfuscated code in the firmware, and decrypt the encrypted firmware. Specifically, such as... Figure 2 As shown,

[0046] The input raw firmware file first enters the readability assessment module for preliminary static analysis and feature scanning, detecting the presence of encrypted areas and whether the firmware code employs code obfuscation techniques (such as control flow flattening). If encryption is present, the process proceeds to the decryption module; if obfuscation is present, the process proceeds to the deobfuscation module. The code after decryption and deobfuscation is routed to the intermediate representation conversion module. If the firmware is plaintext and unobfuscated, it is directly routed to the intermediate representation conversion module.

[0047] In this embodiment, LLVM IR is used as the unified intermediate representation (IR). The instructions of different processor architectures, including but not limited to ARM, Thumb, x86, MIPS or RISC-V instructions, are converted into the unified intermediate representation LLVM IR through an open-source disassembler toolchain.

[0048] Processing of encrypted firmware:

[0049] Compared to traditional key decryption, this embodiment employs a dynamic and intelligent segmented symbolic execution method. First, by analyzing firmware header features (such as 0xDEADBEEF) or specific function pointers, the encrypted code segment and potential decryption function entry points are precisely located. A symbolic execution engine (such as the Angr framework) is used to trigger the decryption function, setting the input parameters to symbolic values ​​instead of specific numerical values, and then simulating the execution of the function. The engine explores all possible execution paths of the decryption function. For each path explored, a set of specific path constraints is generated. The system employs an incremental memory extraction strategy: if a path successfully decrypts new code, the system immediately sends the decrypted code segment under that path to the intermediate representation conversion module for IR conversion; otherwise, the path state is discarded to release the memory resources occupied by that path and reduce memory usage. Finally, the SMT constraints of the decryption function (such as key generation logic) are recorded to accelerate subsequent analysis.

[0050] Handling obfuscated code (such as control flow flattening):

[0051] The core objective of this process is to restore the original control flow structure of the code, achieved through hierarchical constraint parsing. First, based on parsing the basic blocks of the obfuscated functions, the branch conditions of each conditional jump instruction are extracted. Using the Z3 solver, the logic behind these branch conditions is parsed layer by layer. For example, the key constraints for solving the master dispatcher jump are solved first, and then the constraints for the next level of jump are solved layer by layer, thus gradually restoring the original control flow graph (CFG). Combining static pattern matching (such as the function preamble instruction `push ebp`) and dynamic execution frequency analysis, the restored control flow paths are prioritized, and dead code blocks and invalid branches (such as unreferenced data segments) that are proven unreachable through constraint parsing are removed. Finally, the core, truly valid logical paths (such as `recv→memcpy→system`) are retained. This embodiment also employs indirect jump processing. Static pattern matching of function entry points (such as the preamble instruction `push ebp`), and the (Unicorn engine) capture indirect jump targets. Combined with snapshot rollback (such as saving dirty pages every 50 instructions), storage overhead is reduced. The process involves first narrowing the scope using static methods, then performing precise verification using dynamic methods, thus creating a layered approach. Incremental snapshots and dirty page tracking are used to address the memory overhead associated with saving state during dynamic execution.

[0052] S2, Extracting Function Features: Based on the intermediate representation, extract the features of the functions in the firmware. These features include static features and dynamic features obtained based on simulated execution. Specifically, such as... Figure 3 As shown,

[0053] S2.1, Perform static feature matching, conduct static analysis on the intermediate representation, and extract key function features, including:

[0054] First, sensitive API detection is performed. The module parses function call instructions (such as the `call` instruction) in the IR code and matches them against a predefined high-risk function signature library to identify potentially dangerous function calls. For example, it identifies unsafe string manipulation functions (such as `memcpy(dest, src, size)`). Next, stack space analysis is performed. By analyzing instructions used for stack space allocation in the IR (such as `alloca`) and operations on the stack pointer (such as `sub sp`, `#immediate`), the stack frame size of each function is precisely calculated. An excessively small stack frame size may indicate a potential risk of buffer overflow.

[0055] S2.2 monitors the propagation path of contaminated data. To obtain the dynamic behavior characteristics of functions, lightweight dynamic analysis is performed in a simulation execution engine (such as the Unicorn engine). Instrumentation is only applied to sensitive parameters of high-risk functions (e.g., the destination address `dest` and length parameter `size` in the `memcpy` function) to monitor the propagation path of untrusted data (taints) such as external input within the function. During execution, the complete memory state is not saved; instead, only registers and modified memory pages (dirty pages) are periodically saved. When analysis requires backtracking, it can quickly roll back to a previous snapshot point, thereby reducing storage overhead.

[0056] S2.3, perform function permission marking, and combine static analysis and dynamic verification methods to determine the operating system permission level that the function has in the execution environment.

[0057] S2.31, Static Analysis: On one hand, the privileged function list is extracted through symbol table resolution (e.g., vmlinux), and the symbol table is hashed to ensure integrity. On the other hand, the memory ownership permissions of the functions are determined according to the kernel address space rules of the firmware architecture (e.g., in the ARM32 architecture, the kernel space address is usually greater than or equal to 0x80000000). Furthermore, the access permissions of the memory page containing the function are checked by parsing the page table entries of the Memory Management Unit (MMU) (e.g., whether the executable page is marked as privileged).

[0058] S2.33, Dynamic Verification: To compensate for the shortcomings of static analysis, function code is simulated and executed in the Unicorn engine to monitor in real time whether privileged instructions (such as ARM's SVC and x86's INT 0x80) call privileged instructions (such as ARM's SVC instruction or x86's INT 0x80 soft interrupt). Simultaneously, by tracing the context switching process triggered by system calls, the permission flags of functions are dynamically updated. For example, after simulating the execution of the fork() function call, the permissions inherited by the child process are accurately marked.

[0059] S3, High-Risk Feature Database Matching: This involves performing graph matching between the extracted features and a pre-defined high-risk feature database to calculate the matching degree between the objective function and the high-risk vulnerability pattern. Specifically, for example... Figure 4 As shown,

[0060] S3.1, Construct a high-risk signature database. The rules in the signature database are mainly derived from the internationally recognized Common Vulnerability Enumeration Database (CWE Database), combined with custom security rules. Each rule is defined as a vulnerability pattern. For example, the rule for stack buffer overflow (CWE-121) is described as a combination of the conditions "no length check operation exists" and "external input source exists." The rules are converted into a unified graph structure for storage, where nodes represent specific operations (such as memory copying, length calculation), and edges represent data flow dependencies between operations.

[0061] To improve the model's compatibility with different instruction set architectures and its detection generalization ability, semantic normalization is performed on instructions before execution matching. This involves mapping functionally similar instruction variants across different architectures to unified semantic operations. For example, the MOV instruction in x86 architecture and the LDR instruction in ARM architecture are both mapped to the LOAD operation, and various jump instructions (such as JMP B) are uniformly mapped to the BRANCH operation. Semantic normalization effectively combats code variants caused by compiler or instruction set differences, improving detection accuracy.

[0062] S3.2, a hierarchical graph matching strategy is used to analyze the objective function. The matching process employs an efficient subgraph isomorphism algorithm (such as the VF3 algorithm) and follows the principle of "key nodes first." The algorithm prioritizes matching high-risk nodes with high weights in the graph (e.g., dangerous function nodes like strcpy). The weight-guided matching strategy used in this embodiment can quickly identify core risk points and significantly improve matching efficiency.

[0063] To avoid interference from irrelevant code and improve matching accuracy and speed, the graph structure of the target function is compressed and cleaned before matching. Nodes irrelevant to the analysis are automatically identified and removed, such as log printing functions and redundant initialization code, thereby preserving and highlighting the critical data flow path from the risk source (such as recv receiving network data) to dangerous operations (such as memcpy) and then to the sensitive sink point (such as system executing commands).

[0064] S4, Risk Assessment and Dynamic Validation: Based on the matching degree, combined with the false positive suppression factor, function call frequency, the influence factor of the module where the function is located, and the dynamic validation weight, a comprehensive risk score of the target function is calculated through a risk scoring model, and the target function is classified into risk levels according to the comprehensive risk score; wherein, the dynamic validation weight is determined after the target function is dynamically validated by a simulation execution engine. Specifically, as follows... Figure 5 As shown,

[0065] S4.1, Perform risk assessment and scoring calculation. This embodiment creatively discloses a multi-factor risk scoring model, expressed as follows:

[0066]

[0067] In this model, α, β, and γ are weight coefficients, and their optimal values ​​are determined through training with historical data. This model comprehensively considers the following key factors:

[0068] The MatchScore, representing the degree of match between the target function and vulnerability patterns in the high-risk signature database, is calculated as follows:

[0069] This reflects the static risk of the function.

[0070] False alarm suppressor It is an optimization term based on historical data, in which This factor represents the number of times the same vulnerability pattern has been dynamically verified as a false positive in historical detections. It adaptively reduces the impact of high-frequency false positive patterns on the overall score, thereby significantly improving the model's accuracy.

[0071] The call frequency factor, which characterizes the activity of a function during the firmware runtime, is expressed as:

[0072] The more frequently a function is called, the greater its potential impact.

[0073] The Module ImpactFactor is assigned a value based on the security criticality of the module in which the function resides (e.g., 100 for the network protocol stack module and 20 for the logging module) to differentiate the potential severity of vulnerabilities in different modules.

[0074] Dynamic verification weights , is a dynamic adjustment coefficient based on the results of lightweight dynamic verification, with a value ranging from 0.8 to 1.0. If dynamic verification successfully triggers a vulnerability, it is assigned a higher weight (e.g., 1.0), thereby improving the overall score.

[0075] The risk level of high-risk functions is classified based on the comprehensive risk score. For example, a score of 80 or above is classified as high-risk and needs to be fixed immediately; a score between 50 and 80 is classified as medium-risk and it is recommended to fix it within a specified period; and a score below 50 is classified as low-risk and can be delayed.

[0076] The module provides visualization capabilities to enhance the interpretability of results. This feature utilizes graph databases (such as Neo4j) to automatically generate interactive call chain graphs, highlighting the data flow path from risky input sources to high-risk functions. Security researchers can click on any node in the graph to view detailed information about the function, such as stack frame size and the propagation path of tainted data, greatly facilitating manual review and root cause analysis.

[0077] The module performs lightweight dynamic verification of high-risk targets. For high-risk functions with high scores, the module generates targeted test cases (e.g., injecting excessively long strings into functions suspected of buffer overflows) and loads the corresponding function code snippets into a simulation execution engine (such as the Unicorn engine) for verification. This verification process focuses on observing whether expected abnormal behaviors such as out-of-bounds memory writes or malicious command execution occur, thus providing the final empirical evidence for the risk assessment conclusions and effectively reducing false positives.

[0078] Test example:

[0079] To more clearly illustrate the technical solution of this invention and its beneficial effects, a test case is used for illustration: the automated detection process of a command injection vulnerability in a certain SIXNET RTU (Remote Terminal Unit) fully demonstrates the workflow of this system from firmware input to final risk assessment.

[0080] First, the firmware of the target RTU device is obtained and input into this high-risk function automated detection system.

[0081] The system's firmware parsing module parses the input firmware and converts it into a unified intermediate representation (IR), laying the foundation for subsequent feature extraction.

[0082] The function feature extraction module statically extracts all functions in the firmware based on the generated intermediate representation and identifies sensitive or high-risk functions, such as memcpy, strcpy, system, sprintf, mkdir, etc.

[0083] The high-risk feature library construction and matching module performs graph matching calculations on the function features extracted in step 3 and the built-in high-risk vulnerability feature library to obtain the matching degree (MatchScore) of each function and vulnerability pattern, and sends the results to the risk assessment and dynamic verification module.

[0084] This module is the core step, using a multi-factor risk scoring model for quantitative assessment and dynamic verification of high-risk functions. Taking the detected vulnerability related to the `system` function as an example, the risk score calculation process is as follows:

[0085]

[0086] In this embodiment, the weights of α, β, and γ are 0.6, 0.2, and 0.2, respectively. The vulnerability pattern summary points related to the system function are configured as 5, and the actual conditions are met 4 times. There is a key node (the weight of the key node is 1.0), and there have been no false alarms in the history of the same matching degree. The system function appears a total of 19 times, but it is only used 18 times. The detection point is the network protocol stack, and there are problems with dynamic verification.

[0087] Match rate: ;

[0088] Call frequency: ;

[0089] Module Impact Factor: ;

[0090] Final score =86.

[0091] Based on the preset risk level classification rules (e.g., a score ≥ 80 is "high risk"), this function is determined to be high risk, indicating the existence of a command injection vulnerability that needs immediate patching. This result is consistent with known vulnerability information, effectively demonstrating the accuracy and effectiveness of the method of this invention in practical applications.

[0092] Example 2

[0093] This embodiment discloses an industrial equipment firmware risk assessment system based on high-risk function detection, used to implement the industrial equipment firmware risk assessment method based on high-risk function detection in Embodiment 1, including:

[0094] The firmware parsing module is configured to convert the target firmware into a unified intermediate representation, restore the control flow of obfuscated code in the firmware, and decrypt encrypted firmware.

[0095] The function feature extraction module is configured to extract static and dynamic features of functions in the firmware based on the intermediate representation; in addition, the module also integrates a simulation execution engine, which is used to obtain dynamic features and perform the lightweight dynamic verification by simulating the execution of the target function code.

[0096] The high-risk feature library construction and matching module is configured to store high-risk vulnerability patterns, and performs graph matching between the extracted function features and the high-risk feature library to calculate the matching degree between the target function and the high-risk vulnerability pattern.

[0097] The risk assessment and dynamic verification module is configured to calculate the comprehensive risk score of the target function based on the matching degree, combined with the false positive suppression factor, function call frequency, module impact factor, and dynamic verification weight, using a risk scoring model, and output the risk assessment result. Furthermore, the risk assessment and dynamic verification module is also configured to generate an interactive call chain graph of the target function, visually displaying the data flow path of high-risk functions.

[0098] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for risk assessment of industrial equipment firmware based on high-risk function detection, characterized in that, Includes the following steps: S1, Firmware parsing: Convert the target firmware into a unified intermediate representation and process the obfuscated and / or encrypted code in the firmware to restore its analyzable program structure. S2, Extract function features: Based on the intermediate representation, extract the features of the functions in the firmware, including static features and dynamic features obtained based on simulated execution; S3, High-risk feature database matching: Perform graph matching between the extracted features and the preset high-risk feature database, and calculate the matching degree between the objective function and the high-risk vulnerability pattern; S4, Risk Assessment and Dynamic Validation: Based on the matching degree, combined with the false alarm suppression factor, function call frequency, the influence factor of the module where the function is located, and the dynamic validation weight, the comprehensive risk score of the objective function is calculated through the risk scoring model, and the risk level of the objective function is classified according to the comprehensive risk score.

2. The evaluation method according to claim 1, characterized in that, In step S1, control flow recovery is performed on the obfuscated code, specifically including: extracting the branch conditions of basic blocks, parsing the jump logic based on the constraint solver to generate the original control flow graph; combining static pattern matching and dynamic execution frequency analysis to prioritize the paths in the control flow graph; removing dead code blocks and invalid branches in the control flow graph, and retaining the core data flow paths.

3. The evaluation method according to claim 1, characterized in that, In step S1, the encrypted firmware is decrypted, specifically using a segmented symbolic execution method, including: locating the encrypted area through firmware header features and triggering the decryption function using symbolic execution; performing intermediate representation conversion on the decrypted code fragments and caching the path constraints of the decryption function.

4. The evaluation method according to claim 1, characterized in that, In step S2, the extracted dynamic features include tainted data propagation paths and function permission markers; the extraction of tainted data propagation paths is achieved by instrumenting the parameters of high-risk functions in the simulation execution engine and monitoring the propagation of tainted data; the function permission markers are determined by statically analyzing the symbol table and memory permission rules, combined with monitoring privileged instruction calls in the simulation execution engine.

5. The evaluation method according to claim 1, characterized in that, In step S3, a feature library is first constructed, vulnerability patterns are extracted from the CWE database and converted into a graph structure; instruction variants are mapped to unified operations through semantic normalization; then graph matching is performed, which adopts a hierarchical matching strategy, uses the VF3 algorithm to prioritize matching high-risk feature nodes, and assigns weights to different nodes; the graph structure is compressed, irrelevant nodes are removed, and critical paths are retained.

6. The evaluation method according to claim 1, characterized in that, In step S3, the matching degree is expressed as: 。 7. The evaluation method according to any one of claims 1-6, characterized in that, The calculation formula for the risk scoring model is as follows: ， Where α, β, and γ are weighting coefficients, MatchScore is the matching degree, lg(N false positives) is the false positive suppression factor, calculated based on the historical false positive count N of high-risk vulnerability patterns; CallFrequency is the function call frequency; and ImpactFactor is the module impact factor. To dynamically verify the weights, the objective function is determined by performing lightweight dynamic verification through a simulation execution engine.

8. An industrial equipment firmware risk assessment system based on high-risk function detection, used to implement the assessment method according to any one of claims 1-7, characterized in that, include: The firmware parsing module is configured to convert the target firmware into a unified intermediate representation, restore the control flow of obfuscated code in the firmware, and decrypt encrypted firmware. A function feature extraction module is configured to extract static and dynamic features of functions in the firmware based on the intermediate representation. The high-risk feature library construction and matching module is configured to store high-risk vulnerability patterns, and performs graph matching between the extracted function features and the high-risk feature library to calculate the matching degree between the target function and the high-risk vulnerability pattern. The risk assessment and dynamic verification module is configured to calculate the comprehensive risk score of the objective function based on the matching degree, combined with the false alarm suppression factor, function call frequency, module impact factor and dynamic verification weight, through a risk scoring model, and output the risk assessment result.

9. The evaluation system according to claim 8, characterized in that, The risk assessment and dynamic verification module is also configured to generate an interactive call chain graph of the target function, which visually displays the data flow path of the high-risk function.

10. The evaluation system according to claim 8, characterized in that, The function feature extraction module integrates a simulation execution engine, which is used to obtain dynamic features and perform the dynamic verification by simulating the execution of the target function code.

Images