Method and system for firmware network service taint analysis based on minimum path coverage guidance

Abstract

The present application relates to network security and Internet of Things security technical field, provide a kind of based on minimum path cover guide's firmware network service stain analysis method and system.The method includes: the preprocessing of target firmware network service program, constructs function control flow graph and global function call graph, and identifies stain source and dangerous sink;Based on the function control flow graph and the global function call graph, the control flow subgraph containing from the stain source to the dangerous sink is constructed, the loop of the control flow subgraph is eliminated based on hierarchical graph conversion, to get directed acyclic graph, the directed acyclic graph is converted into bipartite graph, and the maximum matching of the bipartite graph is solved to obtain stain minimum path cover set;The stain minimum path cover set is used as the path guide constraint of symbolic execution, and the stain propagation analysis of the target firmware file system is carried out.

Description

Technical Field

[0001] This invention relates to the fields of network security and Internet of Things security technology, and in particular to a firmware network service taint analysis method and system based on minimum path coverage booting. Background Technology

[0002] With the rapid development of IoT technology, embedded devices have been widely used, but their security faces severe challenges, with frequent attacks targeting these devices (such as the Mirai botnet). In vulnerability detection technology, static taint analysis has become a key method for detecting memory corruption vulnerabilities (such as buffer overflows and command injections) because it does not rely on physical devices and has high code coverage.

[0003] Despite the progress made in existing technologies for taint source identification and partial path pruning, the following drawbacks remain:

[0004] A severe path explosion problem: Existing static analysis tools (such as SATC) face an exponential increase in the number of paths that the symbolic execution engine needs to explore when dealing with the complex input parsing logic commonly found in embedded firmware network services (such as httpd, boa) (e.g., nested loops when parsing HTTP requests, complex string processing). This causes the analysis engine to exhaust its time and memory resources in shallow loops, making it unable to complete the analysis.

[0005] Insufficient deep vulnerability detection capabilities: Due to path explosion and the pressure of complex constraint solving, existing tools often get bogged down in the code logic of input validation and format parsing, making it difficult to penetrate these logics to reach the deep vulnerability trigger point (Sink point), resulting in the underreporting of high-risk vulnerabilities.

[0006] Lack of global path planning: While reverse analysis methods like Mango (USENIX Security 2024) can filter constant paths, they lack effective forward path planning capabilities when dealing with complex forward control flows (especially nested loops and conditional branches), resulting in insufficient code coverage. Existing heuristic search strategies (such as random search) are essentially blind and cannot specifically guide the execution flow through complex validation logic. Summary of the Invention

[0007] To address the problem of insufficient taint analysis coverage caused by path explosion and inadequate detection of deep vulnerabilities in existing firmware network service taint analysis technologies, this invention proposes a firmware network service taint analysis method and system based on minimum path coverage guidance. By introducing a structured path guidance mechanism, the method significantly reduces the scale of path exploration while ensuring analysis accuracy, thereby improving detection efficiency and the ability to discover deep vulnerabilities.

[0008] In a first aspect, the present invention provides a firmware network service taint analysis method based on minimum path coverage booting, comprising:

[0009] The target firmware network service program is preprocessed to construct a function control flow graph and a global function call graph, and taint sources and dangerous sinks are identified;

[0010] Based on the function control flow graph and the global function call graph, a control flow subgraph containing the path from the taint source to the dangerous sink is constructed. Loops in the control flow subgraph are eliminated based on hierarchical graph transformation to obtain a directed acyclic graph. The directed acyclic graph is then transformed into a bipartite graph. The minimum path coverage set of taints is obtained by solving the maximum matching of the bipartite graph.

[0011] The taint minimum path coverage set is used as a path guidance constraint for symbolic execution to perform taint propagation analysis on the target firmware file system.

[0012] Furthermore, the source of the taint is identified using keyword matching technology, and the sink of danger is determined by identifying a security sensitivity function.

[0013] Further, based on the function control flow graph and the global function call graph, a control flow subgraph is constructed containing the flow from the taint source to the dangerous sink, including:

[0014] A forward reachability analysis is performed on the aforementioned taint sources to obtain the first set of nodes;

[0015] Perform backward reachability analysis on the dangerous sink points to obtain the second set of nodes;

[0016] The intersection of the first set of nodes and the second set of nodes is used as the graph nodes to construct the control flow subgraph.

[0017] Furthermore, the method of eliminating loops in the control flow subgraph based on hierarchical graph transformation to obtain a directed acyclic graph includes:

[0018] At the graph level: the strongly connected component shrinking algorithm is used to identify the recursive loop structure between functions, and a single virtual node is used to replace the recursive loop structure;

[0019] At the function level: Identify and remove backtracking edges inside the function to confirm the loop body, and convert the loop body into a modular subgraph.

[0020] Furthermore, the step of obtaining the tainted minimum path cover set by solving the maximum matching of the bipartite graph includes:

[0021] The Hopcroft-Karp algorithm is used to find the maximum matching in the bipartite graph, and then the Takeaki Uno algorithm is used to enumerate multiple maximum matchings to obtain the set of tainted minimum path covers.

[0022] Furthermore, the symbolic execution employs a preset six-level priority queue to schedule the execution state, wherein the six-level priority queue specifically includes:

[0023] P0 contains the path execution state where the adjacent nodes of the safe source point are in a contaminated state;

[0024] P1 contains the path execution status of adjacent nodes in the current tainted minimum path coverage scheme where the tainted node is not a safe source node;

[0025] P2 contains the path execution state that is in the current tainted minimum path coverage scheme and has unvisited basic blocks;

[0026] P3 contains the path execution state that is located in the current tainted minimum path coverage scheme and has visited basic blocks or untainted neighboring tainted nodes.

[0027] P4 contains the execution status of paths other than the current minimum taint path coverage scheme;

[0028] P5 represents the execution status of paths other than P0, P1, P2, P3, and P4.

[0029] Furthermore, using the tainted minimum path coverage set as a path-guiding constraint for symbolic execution to perform taint propagation analysis on the target firmware file system also includes:

[0030] During symbol execution, if the currently used tainted minimum path coverage meets the preset stall condition or fails to reach the coverage threshold during execution, then switch to another tainted minimum path coverage in the tainted minimum path coverage set.

[0031] Furthermore, the symbolic execution adopts a single-state step strategy: each time a globally optimal state is processed, the new state generated after processing is recycled back to the state pool.

[0032] Secondly, the present invention provides a firmware network service taint analysis system based on minimum path coverage booting, comprising:

[0033] The taint source and dangerous sink identification unit is used to preprocess the target firmware network service program, construct the function control flow graph and global function call graph, and identify taint sources and dangerous sinks;

[0034] The minimum path coverage calculation unit is used to construct a control flow subgraph containing the path from the taint source to the dangerous sink based on the function control flow graph and the global function call graph, eliminate the loops in the control flow subgraph based on hierarchical graph transformation to obtain a directed acyclic graph, transform the directed acyclic graph into a bipartite graph, and obtain the taint minimum path coverage set by solving the maximum matching of the bipartite graph.

[0035] The taint analysis unit is used to perform taint propagation analysis on the target firmware file system by using the taint minimum path coverage set as the path guidance constraint for symbolic execution.

[0036] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0037] The beneficial effects of this invention are as follows:

[0038] This invention provides a firmware network service taint analysis method that innovatively combines slicing technology with minimum path coverage theory to calculate minimum path coverage only for core paths related to "taint source / sink". Furthermore, for complex nested loop structures in firmware, this invention proposes a hierarchical (function-level + basic block-level) graph transformation method, converting control flow graphs containing loops into directed acyclic graphs with computable minimum path coverage, achieving structured abstraction and flattening of loop structures. This invention also designs a six-level priority queue encompassing multiple dimensions such as taint state, minimum path coverage state, and sink distance, combined with a dynamic switching mechanism for multiple minimum path coverage schemes. This scheduling strategy effectively overcomes the blockade of complex verification logic, significantly improving the detection capability for deep-seated latent vulnerabilities. Attached Figure Description

[0039] Figure 1 A simplified flowchart of the MAC address filtering configuration function (form mac filter set) provided in this embodiment of the invention;

[0040] Figure 2 This is one of the flowcharts illustrating the firmware network service taint analysis method based on minimum path coverage guidance provided in this embodiment of the invention.

[0041] Figure 3 This is the second flowchart illustrating the firmware network service taint analysis method based on minimum path coverage guidance provided in this embodiment of the invention.

[0042] Figure 4 This is a structural diagram of a firmware network service taint analysis system based on minimum path coverage guidance provided in an embodiment of the present invention. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0044] First, the technical terms involved in the embodiments of this invention will be explained:

[0045] Static taint analysis is a technique that traces data flow by analyzing source code or binary code without running the program. It marks untrusted external inputs as "taints" and tracks whether they propagate to sensitive functions (such as functions that execute commands), thereby detecting potential security vulnerabilities.

[0046] Symbolic execution is a program analysis technique that uses symbolic variables (rather than actual numerical values) as program input. During execution, it collects constraints along the path and explores different execution paths by solving these constraints.

[0047] Path Explosion: One of the major challenges faced by symbolic execution. When a program contains loops or a large number of branches, the number of possible execution paths grows exponentially, making it impossible for the analysis engine to traverse all paths within a finite amount of time.

[0048] Minimum Path Cover (MPC): A concept in graph theory. In a directed acyclic graph (DAG), it refers to finding the minimum set of paths such that every node in the graph is traversed by at least one path. Minimum path covers are classified into mutually exclusive or intersecting types based on whether intersecting paths are allowed. This invention focuses on mutually exclusive minimum path covers, where each vertex belongs to only one path, to systematically eliminate redundant state exploration. This invention utilizes this concept to plan optimal routes for symbolic execution.

[0049] Control Flow Graph (CFG): A graphical representation of program code, where nodes represent basic blocks (a piece of code executed sequentially) and edges represent control flow jumps (such as if jumps and loop jumps).

[0050] Taint Source: The entry point where external data enters the program, such as functions that read network packets (e.g., recv) or functions that retrieve HTTP request parameters (e.g., websGetVar).

[0051] Sink / Dangerous Sink: Functions in a program that perform sensitive operations. If the parameters of these functions are tainted, it may lead to security vulnerabilities. Common sinks include system (command execution) and strcpy (memory copy).

[0052] Static taint analysis based on symbolic execution has become a major technique for firmware vulnerability discovery. However, the complex input parsing logic commonly found in firmware network services often leads to severe path explosion problems. Figure 1 This challenge is illustrated using a simplified representation of the MAC address filtering configuration function (from mac filter set). This function is derived from a real-world router. Figure 1 As shown, the MAC address filtering configuration function retrieves the user-provided rule string `mac_list` (taint source) via line 6 of `websGetVarat`. The program then enters a nested loop structure for parsing, where the outer loop (lines 9-26) tokenizes individual MAC rules using `strsep`, and the inner loop (lines 17-20) verifies each address string character by character. This parsing process introduces complex conditional branches and data flow dependencies. For example, line 12 checks the mem-bership blacklist to skip processing, while line 25 formats the verified MAC string into `cmd_buf` using `sprintf`. Finally, `system(cmd_buf)` is called on line 31. An attacker, provided with a carefully crafted list of MAC addresses, could exploit this logic to inject arbitrary commands.

[0053] This situation highlights three key challenges facing traditional symbolic interpretation. First, the combination of nested OOP structures and conditional branching points (such as continue and break) leads to an exponential increase in the path space relative to the input length, a phenomenon known as path explosion. Second, iterative string manipulation and character-by-character verification generate complex constraints that often exceed the processing capabilities of the SMT solver, resulting in significant constraint solving overhead. Finally, the engine often exhausts its computational resources during shallow loop iterations, failing to reach the safety-critical system call located at line 31, thus causing depth reachability issues and false negative results.

[0054] This invention provides a novel method for firmware network taint analysis. First, it isolates a subgraph associated with the taint source to eliminate unrelated execution branches. Then, it abstracts nested loops through hierarchical graph transformations, thereby calculating a structurally complete set of MPC paths. This guided approach enables the symbolic engine to explore "on demand," traversing complex verification logic through a representative path, significantly reducing state redundancy and solver stress while ensuring access to deep-level vulnerabilities.

[0055] like Figure 2 and Figure 3 As shown, this embodiment of the invention provides a firmware network service taint analysis method based on minimum path coverage booting, including:

[0056] S101: Preprocess the target firmware network service program, construct the function control flow graph and global function call graph, and identify taint sources and dangerous sinks.

[0057] Specifically, the target firmware network service program is subjected to in-depth analysis using the IDA Pro automated plugin. Through segmented scanning, the boundaries between code segments and data segments are extracted, and a fine function control flow graph (CFG) and global function call graph (CG) are constructed for multi-instruction architectures (ARM / MIPS / x86). iCFG technology is used to identify taint sources and dangerous sinks.

[0058] When constructing a detailed function control flow graph and global function call graph, the following steps are implemented to restore the logic for indirect jumps in the binary program:

[0059] Instruction flow backtracking pattern recognition: In the MIPS architecture, for indirect calls such as jalr $t9, the instruction flow is backtracked to the nearest register definition point. If the definition point involves local offsets or global address loading (the load address is within the code segment), it is determined to be a static target and the associated edges are completed; similar register dependency tracing is performed for BLX instructions in the ARM architecture.

[0060] Jump table depth recovery: By analyzing the instruction combinations of branch nodes (such as sll / add / lw), the jump table offset is extracted from the corresponding storage area to recover the branch topology hidden by the compiler.

[0061] S102: Construct a control flow subgraph containing the path from taint source to dangerous sink based on the function control flow graph and the global function call graph. Eliminate loops in the control flow subgraph based on hierarchical graph transformation to obtain a directed acyclic graph. Transform the directed acyclic graph into a bipartite graph. Obtain the minimum path coverage set of taints by solving the maximum matching of the bipartite graph.

[0062] This step addresses the problem of complex combinatorial explosion in execution paths by constructing a taint-sensitive control flow subgraph. Through hierarchical graph transformation, loops are eliminated and multiple structurally complete MPC schemes are solved. This transformation process reduces the exploration space from exponential to polynomial level while maintaining sufficient path diversity to facilitate vulnerability discovery.

[0063] S103: Use the set of minimum taint path coverage as the path guidance constraint for symbolic execution to perform taint propagation analysis on the target firmware file system.

[0064] This step uses the tainted minimum path coverage set as the path guidance constraint for symbolic execution. During path exploration, the execution engine performs the following operations on each reached node: First, it checks whether the node belongs to the tainted minimum path coverage. If it does, it activates taint propagation tracking for that node, recording the propagation details of taint labels in registers and memory. If the current node is no longer within the tainted minimum path coverage range, it prunes the path and uses the tainted minimum path coverage set as the path guidance constraint for symbolic execution to perform taint propagation analysis on the target firmware file system.

[0065] The method provided in this invention utilizes source-aware graph segmentation and hierarchical graph transformation techniques to provide structured and polynomial-scale guidance for complex string parsing logic. It can be widely applied in fields such as firmware security auditing, automated vulnerability discovery, and cyberspace security assessment for embedded devices like routers, network cameras, and smart furniture.

[0066] In some embodiments, taint sources are identified using keyword matching technology, and hazardous sinks are determined by identifying security sensitivity functions.

[0067] Specifically, iCFG technology, based on the Function Control Flow Graph (CFG) and Global Function Call Graph (CG), is used to recover program structure and identify potential taint sources through keyword extraction. Sensitive functions are refined using the SinkTaint heuristic reverse slicing technique to obtain dangerous sinks. This step filters out sinks with fixed parameters, thus focusing on user-driven vulnerabilities.

[0068] In another embodiment, taint sources can be categorized into two types: those that pass user input as the function's return value (corresponding to Model 1) and those that pass user input as a function's parameter (Model 2). Then, using an IDA Pro plugin, combined with heuristic rules and a Large Language Model (LLM), parameter parsing functions are automatically identified from binary files. The specific process of using the identified functions as taint sources for taint analysis is as follows:

[0069] 1) Candidate function screening: Common parameter names (such as ssid, password, token, IP, mac, etc.) are read from the front-end script files (html, js files). The top five functions in the back-end target binary that are referenced by these string parameters more than or equal to ten times and have the most associated strings are selected as candidate functions (common library functions, such as strcmp and memcpy, are excluded because these library functions usually have a very high number of calls).

[0070] 2) Iterate through all candidate functions and perform pattern matching to filter all call points of the current candidate function: if the caller (or the parent function of the function) generally passes in variables such as wp (Web pointer) or a1 (parent function's first parameter) when calling it, it proves that its core function is to extract parameters from external input.

[0071] 3) Large Model Enhancement Judgment: Continue to judge the candidate functions. Pass the statistical results of the previous step and the specific code slices of the candidate functions and their internal sub-functions to the large model for final judgment. Determine whether it is a parameter parsing function (a function that obtains and parses user input) and give the specific taint propagation method (returned through return value or returned through parameters).

[0072] 4) Based on the judgment results of the previous step, map the taint propagation logic to specific registers according to the architecture (such as a0-a3 in MIPS, r0-r3 in ARM, the register offsets are different for different architectures) for subsequent taint creation and propagation.

[0073] Specifically, in taint analysis, high-level abstract knowledge such as "the length of the data is the second parameter" needs to be precisely translated into a physical machine state language that the underlying VEX IR or Angr engine can directly manipulate, i.e., the absolute offset of the registers determined by the target structure. In practice, different processing modes and initial taint values ​​can be generated based on the taint propagation method: if it's a return value method, the taint symbol is automatically injected into the return register according to the calling convention (e.g., the V0 register offset is 8 bytes in the MIPS architecture, and the R0 register offset is also 8 bytes in the ARM architecture); if it's a parameter method, the register corresponding to the second parameter is mapped as the taint source. Through this mapping, the high-level description is compiled into architecture-specific low-level offset operations, allowing the symbol execution engine to directly read and write tainted symbol values ​​at the corresponding physical location, thereby automatically and accurately tracking taint propagation.

[0074] In some embodiments, as shown in Table 1, a control flow subgraph containing the path from taint sources to dangerous sinks is constructed based on the function control flow graph and the global function call graph, including:

[0075] A forward reachability analysis is performed on the taint sources to obtain the first set of nodes;

[0076] Perform backward reachability analysis on the dangerous sink to obtain the second set of nodes;

[0077] The intersection of the first set of nodes and the second set of nodes is used as the graph nodes to construct the control flow subgraph.

[0078] Specifically, for the source of contamination Dangerous confluence ,in A node in a function control flow graph; a control flow subgraph ,in Represents the edge relationships between nodes, vertex set Includes all nodes that are reachable both forward from the source node and backward from the sink node:

[0079]

[0080] This step ensures Each node in the graph lies on at least one potential attack chain from user-controlled input to a dangerous function, thus focusing the analysis on the highest-risk path. Table 1 describes the construction process of the control flow subgraph. First, bidirectional reachability analysis is used to reduce the search space; for functions returning contaminated data, a forward traversal is performed starting from the call point; for parameter-driven contamination, the traversal begins inside the source function. By overlapping these nodes with backtracking slices initiated from security-critical source points, only those tangents that simultaneously satisfy the dual constraints of "source-preceding reachability" and "source-postced reachability" are retained. Furthermore, to maintain contextual coherence, the node set is expanded to include the complete functional context of any retained basic blocks. Additionally, a constant parameter filtering mechanism is employed to exclude sink calls with completely fixed parameters, thus prioritizing data flows controlled by external attackers.

[0081] Table 1. Control Flow Subgraph Construction Process

[0082]

[0083] In some embodiments, as shown in Table 2, a directed acyclic graph is obtained by eliminating loops in the control flow subgraph based on hierarchical graph transformation, including:

[0084] At the call graph level: the strongly connected component shrinking algorithm is used to identify recursive loop structures between functions, and a single virtual node is used to replace the recursive loop structure;

[0085] Specifically, inter-procedural recursive cycles are caused by recursive calls or reentrant function structures in the call graph. Such cycles must be modeled as modular components or collapsed into virtual nodes to linearize the global control flow. Therefore, Tarjan's Strongly Connected Components (SCC) algorithm is used to analyze the call graph to identify and merge recursive loops, grouping them into representative virtual nodes, thereby linearizing the inter-procedural structure.

[0086] When using the Tarjan algorithm to package and compress multiple mutually calling functions (a Set of Functions Calling Circles, SCCs) into an independent "virtual node," function calls within this set are downgraded / collapsed into the internal logical attributes of the virtual node (masking external visibility). For call relationships (i.e., incoming and outgoing edges) between functions within the set and unidirectionally related external code, "edge inheritance (redirection)" is used—all call edges pointing to any function within the SCC are changed to directly point to this new virtual node; function call edges extending outward from the SCC are all emitted from this virtual node. This physically breaks the cycle while logically preserving the dependencies between predecessors and successors.

[0087] At the function level: Identify and remove backtracking edges inside the function to confirm the loop body, and convert the loop body into a modular subgraph.

[0088] Specifically, the iterative loops within the program consist of standard control structures (such as while and for) within a single function. Loop paths are introduced via backtracking edges, requiring strategic removal or abstraction into a DAG subgraph to achieve formal path coverage. Within each independent function, we employ depth-first search (DFS) to identify and remove backtracking edges, abstracting the resulting loop bodies into modular subgraphs.

[0089] Table 2 Hierarchical Diagram Conversion Process

[0090]

[0091] This hierarchical transformation enables efficient path coverage on the derived control flow subgraph while maintaining the underlying mapping with the function control flow graph and the global function call graph, thus achieving precise execution guidance.

[0092] For directed acyclic graphs Its mutually exclusive minimum path cover set The cardinality is determined by the corresponding bilateral graph. Number of mid vertices With maximum matching size The difference between them is given as:

[0093] .

[0094] In some embodiments, the set of tainted minimum path covers is obtained by solving the maximum matching of the bipartite graph, including:

[0095] The Hopcroft-Karp algorithm is used to find the maximum matching in the bipartite graph, and then the Takeaki Uno algorithm is used to enumerate multiple maximum matchings to obtain the set of tainted minimum path covers.

[0096] Specifically, using Gallai's theorem, each node is split into inbound and outbound components. Each transformed DAG is converted into a bipartite graph with a partition. Bipartite graph construction: For any DAG... Construct an equivalent bipartite graph. ,in For each edge ,exist Add a corresponding edge Using the Hopcroft-Karp algorithm in The maximum match is computed efficiently within a short timeframe, and the minimum path coverage of taints is derived from the obtained match edges. Given that static analysis inherently involves over-approximation, a single MPC scheme may contain paths that are logically unreachable during symbolic execution. To provide sufficient path diversity, using the Takeaki Uno algorithm (Uno 1997), we can enumerate all possible maximum matches to generate diverse MPC schemes. These schemes are sorted according to their coverage density to security-sensitive targets, prioritizing paths with the highest probability of triggering potential vulnerabilities, thus addressing the potential path infeasibility during symbolic execution.

[0097] In some embodiments, symbolic execution uses a preset six-level priority queue to schedule the execution state of a path. The six-level priority queue is arranged as follows: P0 contains path execution states where the neighboring nodes of the safe source are in a tainted state; P1 contains path execution states where the tainted node is not a neighbor of the safe source in the current tainted minimum path coverage scheme; P2 contains path execution states that are located in the current tainted minimum path coverage scheme and have unvisited basic blocks; P3 contains path execution states that are located in the current tainted minimum path coverage scheme and have visited basic blocks or whose neighboring tainted nodes are not tainted; P4 contains path execution states other than those in the current tainted minimum path coverage scheme; P5 contains path execution states other than P0, P1, P2, P3, and P4.

[0098] Specifically, P0 (highest priority) is dedicated to contaminated states near the secure source to accelerate the vulnerability confirmation process; P1 covers contaminated states that are actively propagating in the subgraph; P2 focuses on states located on active MPC paths that cover previously unvisited basic blocks; P3 includes uncontaminated states guided by MPC that cover visited blocks or are close to the source; P4 handles states that cover new code regions outside the current MPC path set; and P5 represents the remaining execution states.

[0099] This hierarchical structure (P0>…>P5) is maintained by a dynamic selection strategy. Through a built-in automatic degradation mechanism, once the target block is overwritten, the untainted state will be transferred to a lower priority level.

[0100] In some embodiments, using the tainted minimum path coverage set as a path bootstrapping constraint for symbolic execution to perform taint propagation analysis on the target firmware file system further includes:

[0101] During symbolic execution, if the currently used tainted minimum path coverage meets the preset stall condition or fails to reach the coverage threshold during execution, switch to another tainted minimum path coverage in the tainted minimum path coverage set.

[0102] Specifically, to mitigate the impact of infeasible paths caused by static over-approximation, the exploration process is monitored. If the selected MPC scheme experiences persistent stagnation or fails to reach the coverage threshold (e.g., 80% block coverage), the engine triggers a dynamic scheme switching mechanism. By switching from a pre-calculated set of schemes to another alternative, the analysis process can bypass logically blocked paths and maintain structural coverage through more feasible paths.

[0103] In some embodiments, symbolic execution employs a single-state step strategy: each time a globally optimal state is processed, the resulting new state is returned to the state pool.

[0104] Specifically, a single-state step-by-step model is employed instead of a large-scale parallel exploration approach. Only the globally optimal state (selecting state P0 from a six-level priority queue) is processed. After executing this state, a new state is generated based on the instruction semantics. This new state is then returned to the priority management pool, its priority is recalculated, and it is assigned to the corresponding queue. This approach minimizes memory pressure, avoids state splitting explosions that could cause system crashes, and ensures that the symbolic engine always focuses on the most promising execution trajectory. Compared to traditional breadth-first or depth-first methods, this strategy maximizes the analytical value per unit of computational resources.

[0105] like Figure 4As shown, this embodiment of the invention also provides a firmware network service taint analysis system based on minimum path coverage booting, comprising:

[0106] The taint source and dangerous sink identification unit is used to preprocess the target firmware network service program, construct the function control flow graph and global function call graph, and identify taint sources and dangerous sinks;

[0107] The minimum path cover calculation unit is used to construct a control flow subgraph containing the path from the taint source to the dangerous sink based on the function control flow graph and the global function call graph. It eliminates the loops in the control flow subgraph based on hierarchical graph transformation to obtain a directed acyclic graph. The directed acyclic graph is then transformed into a bipartite graph. The minimum path cover set of taints is obtained by solving the maximum matching of the bipartite graph.

[0108] The taint analysis unit is used to perform taint propagation analysis on the target firmware file system by using the minimum taint path coverage set as the path guidance constraint for symbolic execution.

[0109] It should be noted that the firmware network service taint analysis system provided in this embodiment of the invention is for implementing the above method, and its specific functions can be referred to the above method embodiments, which will not be repeated here.

[0110] This invention also provides a computer program product, which includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer can execute the firmware network service taint analysis method provided in the above-described method embodiments, including S101 to S103 of the above embodiments.

[0111] This invention also provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the firmware network service taint analysis method provided in the above-described method embodiments, including S101 to S103 of the above embodiments.

[0112] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A firmware network service taint analysis method based on minimum path coverage booting, characterized in that, include: The target firmware network service program is preprocessed to construct a function control flow graph and a global function call graph, and taint sources and dangerous sinks are identified; Based on the function control flow graph and the global function call graph, a control flow subgraph containing the path from the taint source to the dangerous sink is constructed. Loops in the control flow subgraph are eliminated based on hierarchical graph transformation to obtain a directed acyclic graph. The directed acyclic graph is then transformed into a bipartite graph. The minimum path coverage set of taints is obtained by solving the maximum matching of the bipartite graph. The taint minimum path coverage set is used as a path guidance constraint for symbolic execution to perform taint propagation analysis on the target firmware file system.

2. The firmware network service taint analysis method based on minimum path coverage bootstrapping according to claim 1, characterized in that, The sources of contamination are identified using keyword matching technology, and the dangerous sinks are determined by identifying security sensitivity functions.

3. The firmware network service taint analysis method based on minimum path coverage bootstrapping according to claim 1, characterized in that, Based on the function control flow graph and the global function call graph, a control flow subgraph is constructed containing the flow from the taint source to the dangerous sink, including: A forward reachability analysis is performed on the aforementioned taint sources to obtain the first set of nodes; Perform backward reachability analysis on the dangerous sink points to obtain the second set of nodes; The intersection of the first set of nodes and the second set of nodes is used as the graph nodes to construct the control flow subgraph.

4. The firmware network service taint analysis method based on minimum path coverage booting according to claim 1, characterized in that, The method of eliminating loops in the control flow subgraph based on hierarchical graph transformation to obtain a directed acyclic graph includes: At the graph level: the strongly connected component shrinking algorithm is used to identify the recursive loop structure between functions, and a single virtual node is used to replace the recursive loop structure; At the function level: Identify and remove backtracking edges inside the function to confirm the loop body, and convert the loop body into a modular subgraph.

5. The firmware network service taint analysis method based on minimum path coverage booting according to claim 1, characterized in that, The method of obtaining the tainted minimum path cover set by solving the maximum matching of the bipartite graph includes: The Hopcroft-Karp algorithm is used to find the maximum matching in the bipartite graph, and then the Takeaki Uno algorithm is used to enumerate multiple maximum matchings to obtain the set of tainted minimum path covers.

6. The firmware network service taint analysis method based on minimum path coverage booting according to claim 1, characterized in that, The symbol execution employs a preset six-level priority queue to schedule the execution status, wherein the six-level priority queue specifically includes: P0 contains the path execution state where the adjacent nodes of the safe source point are in a contaminated state; P1 contains the path execution status of adjacent nodes in the current tainted minimum path coverage scheme where the tainted node is not a safe source node; P2 contains the path execution state that is in the current tainted minimum path coverage scheme and has unvisited basic blocks; P3 contains the path execution state that is located in the current tainted minimum path coverage scheme and has visited basic blocks or untainted neighboring tainted nodes. P4 contains the execution status of paths other than the current minimum taint path coverage scheme; P5 represents the execution status of paths other than P0, P1, P2, P3, and P4.

7. The firmware network service taint analysis method based on minimum path coverage booting according to claim 1, characterized in that, Using the tainted minimum path coverage set as a path guidance constraint for symbolic execution, taint propagation analysis is performed on the target firmware file system, further including: During symbol execution, if the currently used tainted minimum path coverage meets the preset stall condition or fails to reach the coverage threshold during execution, then switch to another tainted minimum path coverage in the tainted minimum path coverage set.

8. The firmware network service taint analysis method based on minimum path coverage booting according to claim 1, characterized in that, The symbol execution adopts a single-state step strategy: Each time, a globally optimal state is processed, and the new state generated after processing is returned to the state pool.

9. A firmware network service taint analysis system based on minimum path coverage booting, characterized in that, include: The taint source and dangerous sink identification unit is used to preprocess the target firmware network service program, construct the function control flow graph and global function call graph, and identify taint sources and dangerous sinks; The minimum path coverage calculation unit is used to construct a control flow subgraph containing the path from the taint source to the dangerous sink based on the function control flow graph and the global function call graph, eliminate the loops in the control flow subgraph based on hierarchical graph transformation to obtain a directed acyclic graph, transform the directed acyclic graph into a bipartite graph, and obtain the taint minimum path coverage set by solving the maximum matching of the bipartite graph. The taint analysis unit is used to perform taint propagation analysis on the target firmware file system by using the taint minimum path coverage set as the path guidance constraint for symbolic execution.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 8.

Images