PLC Malicious Code Detection via Symbolic Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malicious software detection systems for PLCs are ineffective in identifying deeply buried logic bombs, especially when the malicious code is triggered by complex conditions, and they rely on source code analysis which is rendered useless by pre-compiled binary files, making it difficult to define what constitutes malicious behavior without knowing the intended physical process.
Innovation Solution
A system that parses PLC code into functional elements, maps them into a high-level data structure, generates a behavioral model using a fuzzer, and classifies it to predict corresponding processes, detecting unsafe states and indicating potential malicious code without requiring source code or lengthy wait times for trigger conditions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If source code analysis is used to detect malicious PLC code, then detection accuracy can be improved, but pre-compiled binary files render source code unavailable making detection ineffective
Solution Approach 1:
The patent creates a symbolic execution model that copies and simulates the binary PLC program's execution flow without requiring the original source code. By constructing a control flow graph and symbolic execution path from the compiled binary, the system reproduces the program's logical structure and detects logic bombs through symbolic analysis, effectively bypassing the unavailability of source code while maintaining detection accuracy
Solution Approach 2:
The patent replaces traditional source code-based static analysis with a symbolic execution approach that works directly on compiled binaries. Instead of mechanically parsing source code, the system uses symbolic variables and control flow graph analysis to trace execution paths and detect malicious logic, substituting the mechanical source code analysis process with a binary-compatible symbolic execution mechanism
2Reliability
If waiting for trigger conditions to activate logic bombs is used to detect malicious code, then detection reliability can be improved, but lengthy wait times reduce productivity
Solution Approach 1:
The patent performs preliminary symbolic execution analysis on the PLC binary program before any trigger conditions can activate the logic bomb. By constructing the control flow graph and analyzing execution paths symbolically in advance, the system identifies malicious logic and its trigger conditions without needing to wait for them to activate during normal operation, thus maintaining detection reliability while eliminating lengthy wait times
Solution Approach 2:
The patent transforms the static waiting approach into a dynamic symbolic execution process. Instead of passively waiting for trigger conditions to activate logic bombs during normal PLC operation, the system actively simulates and analyzes all possible execution paths through symbolic variables and control flow graph traversal, dynamically identifying malicious code regardless of whether trigger conditions are met during actual operation
3Object-affected harmful factors
If complex trigger conditions are used in logic bombs, then malicious code can evade detection, but this increases the complexity of defining malicious behavior
Solution Approach 1:
The patent changes the parameter of analysis from observing actual trigger condition activation to symbolic execution path analysis. By using symbolic variables to represent input conditions and tracing all possible execution paths through the control flow graph, the system can identify logic bombs with complex trigger conditions without needing to define or evaluate the complexity of those conditions, thus maintaining evasiveness detection capability while avoiding the complexity of defining malicious behavior
4Ease of manufacture
If passive defense monitoring techniques are used, then system deployment is simplified, but they can only detect anomalies after they appear and cannot identify deeply buried logic bombs
Solution Approach 1:
The patent performs preliminary symbolic execution analysis on the PLC binary program during deployment, constructing a control flow graph and analyzing execution paths before the PLC goes into operation. This proactive approach identifies deeply buried logic bombs and their trigger conditions in advance, rather than waiting for anomalies to appear during passive monitoring, thus maintaining deployment simplicity while dramatically improving the ability to detect buried malicious code
Data Source
AI summary
A system (100) and method for detecting a malicious programmable logic controller (PLC) code segment (110) in a PLC program corresponding to a specific type of PLC includes a binary parser (112) that parses the code segment (110) into a plurality of functional elements. A variable and function block mapper (114) maps the functional elements into a high-level data structure. A fuzzer (116) generates a behavioral model of the high-level data structure into an automaton (118). A classifier (120) predicts to which processes the automaton (118) corresponds. A detector (122) detects unsafe states in the automaton (118) and that generates an indication of a detected unsafe state.