Automatic mining method and system for misuse vulnerabilities of third-party components of firmware of Internet of Things based on Datalog

Abstract

The invention discloses a Datalog-based automatic vulnerability mining method and system for a third-party component of firmware of the Internet of Things, and belongs to the technical field of security of the Internet of Things. The system comprises a firmware preprocessing module for collecting firmware, preprocessing the firmware and storing the firmware into a firmware warehouse; the Datalog coding module is used for extracting files in the firmware and extracting character string contents, and recoding a decompilation result of the binary file by adopting a Datalog coding method; the third-party component identification and rule extraction module is used for identifying a third-party component in the firmware based on regular matching and editing distance and acquiring a related third-party component use rule; and the vulnerability query module is used for performing logical query on the misuse vulnerability of the third-party component in the firmware by utilizing a Datalog query template filled based on the use rule of the third-party component. According to the method, the misuse vulnerability of the third-party component in the firmware of the Internet of Things can be quickly mined with high precision.

Description

technical field [0001] The invention relates to the technical field of Internet of Things security, in particular to a method and system for automatic mining of misuse vulnerabilities of third-party components of Internet of Things firmware based on Datalog. Background technique [0002] With the continuous development of the Internet of Things, all kinds of Internet of Things devices have entered thousands of households. IoT devices are affecting every aspect of our lives. However, the security issues posed by IoT devices cannot be ignored. While pursuing development speed, developers often ignore the security of IoT devices, resulting in frequent IoT device vulnerabilities. At present, all kinds of botnets take IoT devices as their primary targets, and IoT devices have become an important basis for botnets to launch attacks. [0003] Since the development of IoT devices has long relied on various third-party components, vulnerabilities caused by third-party components a...

AI Technical Summary

Problems solved by technology

Third-party components often have cumbersome and complex usage rules. Calling third-party components that do not strictly follow such usage rules may cause various vulnerabilities, such as memory leaks, unauthorized attacks, etc.

After the firmware is disassembled, it is impossible to obtain source code-level semantic information and code context logic relationships, so it is difficult to match third-party component usage rules

(2) Low test efficiency

The current mainstream IoT firmware vulnerability mining methods all have defects that limit large-scale applications, such as high false positive rate, manual participation and low success rate, etc.

(3) Difficult to identify third-party components

[0005] Vulnerabilities in IoT firmware due to misuse of third-party components can have serious consequences, and there is currently no effective way to detect such vulnerabilities at the binary level

Images