CN109067800A - A kind of cross-platform association detection method of firmware loophole - Google Patents
A kind of cross-platform association detection method of firmware loophole Download PDFInfo
- Publication number
- CN109067800A CN109067800A CN201811149507.8A CN201811149507A CN109067800A CN 109067800 A CN109067800 A CN 109067800A CN 201811149507 A CN201811149507 A CN 201811149507A CN 109067800 A CN109067800 A CN 109067800A
- Authority
- CN
- China
- Prior art keywords
- function
- firmware
- feature
- loophole
- cross
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1433—Vulnerability analysis
Abstract
The present invention provides a kind of cross-platform association detection method of firmware loophole, improves the accuracy rate and efficiency of existing cross-platform firmware loophole association detection method, kNN is used in combination with SVM, has reached accuracy rate and efficiency good trade-off；Bipartite graph matching algorithm is utilized on the basis of function property controlling stream graph, function matching problem is changed into graph structure Similarity measures problem, and joined penalty term on the basis of original algorithm, improves accurate matched accuracy rate；And make this programme that there is higher detection efficiency using weighted euclidean distance and weighted Mahalanobis distance method.
Description
Technical field
The present invention relates to association detection technique field more particularly to a kind of cross-platform association detection methods of firmware loophole.
Background technique
With the deep development of Internet of Things, internet of things equipment gradually penetrates into the various aspects of people's work, life, in band
Also to bring increasingly serious security risk while convenience.Tesla in 2014 is found security breaches, Haikang in 2015
Prestige depending on supervision equipment be detected severe compromise, hacker in 2016 meets with Dyn using a large amount of internet of things equipment
Ddos attack the most serious in history.The importance for recognizing Internet of Things safety that these events make people deep.Wherein, firmware
Safety is an importance of Internet of Things safety again.It is shown according to the survey report of OWASP in 2017, the loophole of firmware is attacked
It hits and comes the 9th in the loophole attack of entire Internet of things system, and the major part of these loopholes is all issued mistake.
As it can be seen that being an important ring for firmware safety to the detection of firmware loophole.Firmware Hole Detection is broadly divided into two aspects, a side
Face is the detection to unknown loophole, is then the detection to known bugs on the other hand.Cross-platform firmware leakage of the present invention
Hole association is to belong to the latter, it is primarily referred to as removing to search the homologous loophole of other platforms using the loophole in known platform firmware, right
Firmware carries out loophole association and is equal to the binary file progress loophole association for including to firmware.However, existing cross-platform solid
Accuracy rate, the efficiency of part loophole association detection method need to be improved.
It is existing that the execution sequence of code is detected into binary system execution file as feature
In similar codes segment, the problem of being able to solve controlling stream graph isomery.But, this method is contacted with operation code and register name
Closely, it can not be applied in cross-platform application scenarios.
A set of solution for carrying out loophole association detection to extensive firmware automatically that existing Costin et al. is proposed,
Analysis is associated to firmware loophole using such as privately owned encryption key information obvious in firmware, but is lacked to more typically
Loophole detectability.
The existing cross-platform loophole based on function value type feature and structure feature is associated with detection method discovRE,
Sub-fraction function is quickly filtered out using kNN, and candidate functions are carried out using maximum public subgraph algorithm McGregor
Further matching improves the efficiency of cross-platform loophole association detection to a certain extent, but in function screening stage
There are some problems for accuracy rate.
Disclosed in patent " a kind of cross-platform association detection method of firmware loophole " a kind of firmware leak detection method and
System, main flow include: that firmware crawls and loophole collection, facility information extraction, the decoding and dis-assembling of firmware, the finger of function
Line is extracted and is matched and validating vulnerability etc..In the fingerprint matching stage of function, by calculating firmware function fingerprint and loophole letter
The similarity and given threshold of number fingerprint, to judge whether firmware function is doubtful loophole.
Summary of the invention
The object of the invention is that providing a kind of cross-platform association detection of firmware loophole to solve the above-mentioned problems
Method.
The present invention through the following technical solutions to achieve the above objectives:
The present invention the following steps are included:
S1: firmware obtains the stage, and firmware acquisition can be consolidated in such a way that manufacturer's image download or user upload by hand
Part；
S2: firmware decompression and dis-assembling stage, binary file relevant to firmware is obtained using firmware decompression tool, by solid
Part decompression and dis-assembling, obtain firmware dis-assembling function；
S3: firmware function feature is extracted；
S4: utilizing the kNN-SVM based on weighted euclidean distance, treats detection function and carries out quickly screening and accurate matching, judgement
Function to be detected is associated with accuracy with known bugs function；
S5: confirm that function to be detected is doubtful loophole.
It is currently preferred, according to step S4: being broadly divided into two stages, numerical characteristics of the first stage based on function
It treats detection function rapidly to be screened, second stage is then that the structure feature based on function carries out accurately candidate functions
Matching.
Currently preferred, the feature of the extraction includes numerical characteristics and two kinds of structure feature, and numerical characteristics are mainly
Refer to the numeralization feature of function rank；Structure feature is the feature of representative function property control flow graph structures, by atomic block level
Feature and some structural informations composition.
It is currently preferred, it is described after feature extraction, it is thus necessary to determine that the corresponding weight of each dimensional feature, selection
Relief algorithm determines weight.
Currently preferred, the Relief algorithm is by the source code of Busybox v1.21 respectively in ARM, MIPS and x86
Training dataset of three obtained function set A, M and the X as weight after process of compilation under these three platforms, to be associated with mould
For formula " ARM → MIPS ", the feature vector of each function in collection of functions A and M is carried out min-max standardization first by us,
So that every one-dimensional value in feature vector is all between 0 to 1；For each of A function, one can be found in M
It is a with real matched function ' and one and unmatched function g, it is assumed that the feature vector after standardization is, ' standardization after feature vector be, g standardization after feature vector be, then we willIt is labeled as " 1 " as positive sample, it will
The sample labeling that is negative is " 0 "；Wherein, the training sample ratio of positive and negative two class obtained is 1:1；Using training sample as Relief
The input of algorithm, and iteration 10 times, seek its average characteristics weight.Since the calculating of distance has symmetry, so association
The feature weight calculated under mode " ARM → MIPS " and " MIPS → ARM " be it is of equal value, similarly, association mode " ARM → x86 "
The feature weight calculated under " x86 → ARM ", " MIPS → x86 " and " x86 → MIPS " is also of equal value respectively.
Currently preferred, weighted Mahalanobis distance method is applied to by the kNN-SVM based on weighted euclidean distance first
It on kNN, and selects suitable k value to treat detection function and carries out preliminary screening (k < 500), then recycle as before
SVM algorithm does further screening to function to obtain candidate functions collection, wherein the horse between function and function g
The calculation formula of family name's distance is as follows using formula:
Wherein, X and Y is respectively function and 9 dimensional feature vectors of g, the covariance matrix of ∑ test sample feature space, and A is
After weight matrix, feature and weight all determine, start to screen function.
The beneficial effects of the present invention are:
The present invention provides a kind of cross-platform association detection method of firmware loophole, improves existing cross-platform firmware loophole association inspection
KNN is used in combination with SVM, has reached accuracy rate and efficiency good trade-off by the accuracy rate and efficiency of survey method；In function category
Property controlling stream graph on the basis of utilize bipartite graph matching algorithm, function matching problem is changed into graph structure Similarity measures and is asked
Topic, and joined penalty term on the basis of original algorithm, improve accurate matched accuracy rate；And using weighted Euclidean away from
Make this programme that there is higher detection efficiency from weighted Mahalanobis distance method.
Detailed description of the invention
Fig. 1 is the flowage structure schematic diagram of the cross-platform association detection method of firmware loophole of the present invention；
Fig. 2 is that the present invention is based on hybrid algorithm kNN-SVM to be associated with the firmware loophole cross-platform stage by stage of bipartite graph matching algorithm
Detection method general frame figure；
Fig. 3 is the flowage structure schematic diagram of the firmware function screening technique the present invention is based on kNN-SVM；
Fig. 4 is the accurate matched bipartite graph of loophole function of the present invention and candidate functions；
Fig. 5 is basic block grade feature of the present invention；
Fig. 6 is calculated result of each weight of Function feature of the present invention in six kinds of association modes；
Fig. 7 is the weighted value of each dimensional feature of basic block eigenvector of the present invention.
Specific embodiment
The present invention will be further explained below with reference to the attached drawings:
It is as depicted in figs. 1 and 2: the present invention the following steps are included:
S1: firmware obtains the stage, and firmware acquisition can be consolidated in such a way that manufacturer's image download or user upload by hand
Part；
S2: firmware decompression and dis-assembling stage, binary file relevant to firmware is obtained using firmware decompression tool, by solid
Part decompression and dis-assembling, obtain firmware dis-assembling function；
S3: firmware function feature is extracted；
S4: utilizing the kNN-SVM based on weighted euclidean distance, treats detection function and carries out quickly screening and accurate matching, judgement
Function to be detected is associated with accuracy with known bugs function；
S5: confirm that function to be detected is doubtful loophole.
According to step S4: being broadly divided into two stages, first stage treats detection function based on the numerical characteristics of function
It is rapidly screened, second stage is then that the structure feature based on function accurately matches candidate functions.
As shown in figure 5, the feature of the extraction includes numerical characteristics and two kinds of structure feature, numerical characteristics are primarily referred to as letter
The other numeralization feature of several levels；Structure feature is the feature of representative function property control flow graph structures, by the spy of atomic block level
Sign and some structural informations composition.
It is described after feature extraction, it is thus necessary to determine that the corresponding weight of each dimensional feature selects Relief algorithm to determine
Weight.
As shown in fig. 6, the Relief algorithm by the source code of Busybox v1.21 respectively ARM, MIPS and x86 this
Training dataset of three obtained function set A, M and the X as weight after process of compilation under three platforms, with association mode
For " ARM → MIPS ", the feature vector of each function in collection of functions A and M is carried out min-max standardization first by us, is made
Every one-dimensional value in feature vector is obtained all between 0 to 1；For each of A function, one can be found in M
With real matched function ' and one and unmatched function g, it is assumed that the feature vector after standardization is, ' standardization after feature vector be, g standardization after feature vector be
, then we willIt is labeled as " 1 " as positive sample, it willFor negative sample
Labeled as " 0 "；Wherein, the training sample ratio of positive and negative two class obtained is 1:1；Using training sample as the defeated of Relief algorithm
Enter, and iteration 10 times, seeks its average characteristics weight.Since the calculating of distance has symmetry, so association mode " ARM
The feature weight calculated under → MIPS " and " MIPS → ARM " be it is of equal value, similarly, association mode " ARM → x86 " and " x86 →
The feature weight calculated under ARM ", " MIPS → x86 " and " x86 → MIPS " is also of equal value respectively.
As shown in figure 3, the kNN-SVM based on weighted euclidean distance, is applied to kNN for weighted Mahalanobis distance method first
On, and select suitable k value to treat detection function and carry out preliminary screening (k < 500), then recycle SVM as before
Algorithm does further screening to function to obtain candidate functions collection, wherein the geneva between function and function g
The calculation formula of distance is as follows using formula:
Wherein, X and Y is respectively function and 9 dimensional feature vectors of g, the covariance matrix of ∑ test sample feature space, and A is
After weight matrix, feature and weight all determine, start to screen function.
In the first phase, the kNN and SVM used is two kinds in the widely used machine learning method in classification field, base
It is to come simply by calculating the Euclidean distance between function and loophole function to be detected to letter in the function screening technique of kNN
Number is screened, and such mode causes the accuracy rate of screening stage cannot be guaranteed.If it is intended to if guaranteeing accuracy rate, just
Biggish k value is chosen, but k value is larger and will increase the calculation amount of the accurate matching stage of candidate functions.Exactly because but
The calculation of kNN is very simple, and the function screening efficiency of the firmware function screening technique based on kNN is very high.And it is based on SVM
Firmware function screening technique, although due to the complexity of SVM, screening efficiency be significantly lower than the method based on kNN, its
Accuracy rate ratio kNN high.Moreover, the obtained average candidate functions number ratio kNN of firmware function screening based on SVM is few very
It is more, it can be more conducive to the calculating of next stage in this way.Therefore, by analyzing above, it can be appreciated that the letter based on kNN
Number sieve selects efficiency with higher, and the function based on SVM screens then accuracy rate with higher, in order to reach accuracy rate and effect
Rate good trade-off, present invention uses a kind of function screening techniques for being used in mixed way kNN and SVM, to screen rank in function
Section can reach preferable accuracy rate and efficiency.
As shown in figure 3, the function based on kNN-SVM screens, we select a suitable k value (k > 128) first, utilize
KNN algorithm quickly obtains the k to be detected functions nearest with loophole function distance, then to be detected to this k using SVM algorithm
Function is further screened, to leave less more accurate function as candidate functions, reduces the calculating of follow-up phase
It measures and improves accuracy rate.
Detailed process is as follows for firmware function screening technique based on kNN-SVM:
The preliminary screening of kNN the considerations of for time and space, is tentatively sieved treating detection function using kNN algorithm
When choosing is quickly to obtain with loophole function apart from k nearest function, we realize that kNN is calculated by the way of k-d tree
Method.9 dimensional feature vectors of loophole function and function to be detected are all standardized first, so that often one-dimensional is all 0
Then numerical value between to 1 constructs k-d tree with the feature vector after functional standard to be detected again, finally by retrieval k-d
Tree quickly filters out the k functions nearest with loophole function.It is worth noting that, using kNN algorithm treat detection function into
When row preliminary screening, the value of k is extremely important.K value is too small to will affect accuracy rate, excessive to will affect efficiency.By testing,
We finally found that under six kinds of association modes, when k value is 500, accuracy rate is attained by 90% or more, then takes small k value
Words, accuracy rate decline obvious.
The further screening of SVM.After treating detection function using kNN and carrying out preliminary screening, we continue with SVM
The range of candidate functions is reduced, further to reduce the calculation amount of next stage.In this step, we first use Busybox
The source code of v1.21 constructs the training sample under different mode, then with these training samples training SVM model, obtains every
Optimal classification surface under kind association mode, finally recycling these optimal classifications to face, k function is further to be screened, and is obtained
Final candidate functions collection.
In second stage, i.e. the accurate matching stage of candidate functions, the main task in this stage is controlled in function property
On the basis of flow graph, candidate functions are accurately matched using the structure feature of function, to find real with loophole function
Matched function.In order to improve efficiency, the present invention completes the essence of loophole function and candidate functions using bipartite graph matching algorithm
Really matching.
As shown in figure 4, the property control flow graph of given two functionsWith, whereinWithIt is respectivelyWithNode
Collect, each of node collection node, i.e. each basic block are indicated with the feature vector of one 8 dimension, feature of this 8 dimension
Vector basic block grade feature described in table 1 forms.
Since the essence of bipartite graph matching algorithm is measured therebetween by calculating the matching weight between two figures
Similarity degree, therefore, the two property control flow graphs are regarded as the bipartite graph of an entirety by the present invention,
Wherein,,It indicates from nodeIt arrivesA cum rights matching, power
Value is thenWithBetween 8 dimensional feature vectors distance.Although figure 4, it is seen that by node collectionWith node collectionOne
To one matching, there is various situations, but we only need to find out wherein to make weight and the smallest set of matches
Conjunction can.
In the present invention, bipartite graph matching while weight be by while both ends the distance between basic block determine,
Formula is as follows:
Wherein,Indicate basic blockFeature vector in i-th dimension numerical value,Indicate basic blockFeature vector neutralizeThat corresponding one-dimensional numerical value,Then indicate the difference that we are distributed to every one-dimensional characteristic in the feature vector of basic block
Weight.The specific weight of each dimensional feature is as shown in Figure 7.
The least weight match algorithm of bipartite graph is sought using Kuhn-Munkres algorithm, and the similar journey of two functions is measured with this
Degree, specific formula is as follows:
Wherein,Represent the property control flow graph acquired by Kuhn-Munkres algorithmWithBetween MINIMUM WEIGHT
Matched weight.Represent be withBasic block number is identical and the feature of basic block is to the property control flow graph for being all 0, equally
Ground,Represent be withBasic block number is identical and the feature vector of basic block be also all 0 property control flow graph.It is me
The penalty term that is added,It is penalty coefficient,It isWithBetween basic block number difference, in addition penalty term after can
Scale difference between property control flow graph is taken into account, also more to the similarity calculation between property control flow graph
Accurately.
In conclusion the present invention provides a kind of cross-platform association detection method of firmware loophole, improve existing cross-platform
Firmware loophole is associated with the accuracy rate and efficiency of detection method, and kNN is used in combination with SVM, has reached accuracy rate and efficiency is preferable
Compromise；Bipartite graph matching algorithm is utilized on the basis of function property controlling stream graph, and function matching problem is changed into figure knot
Structure Similarity measures problem, and joined penalty term on the basis of original algorithm, improve accurate matched accuracy rate；And
Make this programme that there is higher detection efficiency using weighted euclidean distance and weighted Mahalanobis distance method.
Those skilled in the art do not depart from essence and spirit of the invention, can there are many deformation scheme realize the present invention,
The foregoing is merely preferably feasible embodiments of the invention, and not thereby limiting the scope of the invention, all with this
The variation of equivalent structure made by description of the invention and accompanying drawing content, is intended to be included within the scope of the present invention.
Claims (6)
1. a kind of cross-platform association detection method of firmware loophole, which comprises the following steps:
S1: firmware obtains the stage, and firmware acquisition can be consolidated in such a way that manufacturer's image download or user upload by hand
Part；
S2: firmware decompression and dis-assembling stage, binary file relevant to firmware is obtained using firmware decompression tool, by solid
Part decompression and dis-assembling, obtain firmware dis-assembling function；
S3: firmware function feature is extracted；
S4: utilizing the kNN-SVM based on weighted euclidean distance, treats detection function and carries out quickly screening and accurate matching, judgement
Function to be detected is associated with accuracy with known bugs function；
S5: confirm that function to be detected is doubtful loophole.
2. the cross-platform association detection method of firmware loophole according to claim 1, it is characterised in that: according to step S4:
Two stages are broadly divided into, first stage is treated detection function based on the numerical characteristics of function and is rapidly screened, and second
A stage is then that the structure feature based on function accurately matches candidate functions.
3. the cross-platform association detection method of firmware loophole according to claim 2, it is characterised in that: the spy of the extraction
Sign includes numerical characteristics and two kinds of structure feature, and numerical characteristics are primarily referred to as the numeralization feature of function rank；Structure feature is
The feature of representative function property control flow graph structures is made of the feature and some structural informations of atomic block level.
4. the cross-platform association detection method of firmware loophole according to claim 3, it is characterised in that: described to be mentioned in feature
After taking, it is thus necessary to determine that the corresponding weight of each dimensional feature selects Relief algorithm to determine weight.
5. the cross-platform association detection method of firmware loophole according to claim 4, it is characterised in that: the Relief is calculated
Method the source code of Busybox v1.21 is obtained after process of compilation under these three platforms of ARM, MIPS and x86 respectively three
The training dataset of a function set A, M and X as weight, by taking association mode " ARM → MIPS " as an example, we are first by function
The feature vector for collecting each function in A and M carries out min-max standardization, so that all arriving 0 in feature vector per one-dimensional value
Between 1；One and real matched function can be found for each of A function, in M ' and one and
Unmatched function g, it is assumed that the feature vector after standardization is, ' standardization after feature vector be, g standardization after feature vector be, then we willMake
The sample labeling that is positive is " 1 ", willThe sample labeling that is negative is " 0 "；Wherein, positive and negative two class obtained
Training sample ratio is 1:1；Using training sample as the input of Relief algorithm, and iteration 10 times, seek its average characteristics weight.
6. the cross-platform association detection method of firmware loophole according to claim 1, it is characterised in that: described based on weighting
The kNN-SVM of Euclidean distance, first by weighted Mahalanobis distance method be applied to kNN on, and select suitable k value treat detection function into
Then the preliminary screening of row recycles SVM algorithm as before to do further screening to function to obtain candidate
Collection of functions, wherein the calculation formula of the mahalanobis distance between function and function g is as follows using formula:
Wherein, X and Y is respectively function and 9 dimensional feature vectors of g, the covariance matrix of ∑ test sample feature space, and A is
After weight matrix, feature and weight all determine, start to screen function.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811149507.8A CN109067800A (en) | 2018-09-29 | 2018-09-29 | A kind of cross-platform association detection method of firmware loophole |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811149507.8A CN109067800A (en) | 2018-09-29 | 2018-09-29 | A kind of cross-platform association detection method of firmware loophole |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109067800A true CN109067800A (en) | 2018-12-21 |
Family
ID=64767077
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811149507.8A Withdrawn CN109067800A (en) | 2018-09-29 | 2018-09-29 | A kind of cross-platform association detection method of firmware loophole |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109067800A (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111026012A (en) * | 2019-11-29 | 2020-04-17 | 哈尔滨安天科技集团股份有限公司 | Method and device for detecting PLC firmware level bugs, electronic equipment and storage medium |
| CN111310178A (en) * | 2020-01-20 | 2020-06-19 | 武汉理工大学 | Firmware vulnerability detection method and system under cross-platform scene |
| CN113191582A (en) * | 2021-03-15 | 2021-07-30 | 西南石油大学 | Road torrential flood vulnerability evaluation method based on GIS and machine learning |
| CN113254934A (en) * | 2021-06-29 | 2021-08-13 | 湖南大学 | Binary code similarity detection method and system based on graph matching network |
| CN114626071A (en) * | 2022-03-21 | 2022-06-14 | 中国人民解放军国防科技大学 | Vulnerability-oriented fuzzy test method, system and medium |
| CN116032654A (en) * | 2023-02-13 | 2023-04-28 | 山东省计算中心（国家超级计算济南中心） | Firmware vulnerability detection and data security management method and system |
-
2018
- 2018-09-29 CN CN201811149507.8A patent/CN109067800A/en not_active Withdrawn
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111026012A (en) * | 2019-11-29 | 2020-04-17 | 哈尔滨安天科技集团股份有限公司 | Method and device for detecting PLC firmware level bugs, electronic equipment and storage medium |
| CN111310178A (en) * | 2020-01-20 | 2020-06-19 | 武汉理工大学 | Firmware vulnerability detection method and system under cross-platform scene |
| CN111310178B (en) * | 2020-01-20 | 2024-01-23 | 武汉理工大学 | Firmware vulnerability detection method and system in cross-platform scene |
| CN113191582A (en) * | 2021-03-15 | 2021-07-30 | 西南石油大学 | Road torrential flood vulnerability evaluation method based on GIS and machine learning |
| CN113191582B (en) * | 2021-03-15 | 2022-09-06 | 西南石油大学 | Road torrential flood vulnerability evaluation method based on GIS and machine learning |
| CN113254934A (en) * | 2021-06-29 | 2021-08-13 | 湖南大学 | Binary code similarity detection method and system based on graph matching network |
| CN114626071A (en) * | 2022-03-21 | 2022-06-14 | 中国人民解放军国防科技大学 | Vulnerability-oriented fuzzy test method, system and medium |
| CN116032654A (en) * | 2023-02-13 | 2023-04-28 | 山东省计算中心（国家超级计算济南中心） | Firmware vulnerability detection and data security management method and system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109067800A (en) | A kind of cross-platform association detection method of firmware loophole | |
| CN109241740B (en) | Malicious software benchmark test set generation method and device | |
| US20170063893A1 (en) | Learning detector of malicious network traffic from weak labels | |
| CN109657473A (en) | A kind of fine granularity leak detection method based on depth characteristic | |
| CN112910859B (en) | Internet of things equipment monitoring and early warning method based on C5.0 decision tree and time sequence analysis | |
| CN106991325B (en) | Protection method and device for software bugs | |
| CN106096413B (en) | A kind of malicious code detecting method based on multi-feature fusion and system | |
| CN110198319A (en) | Security protocol bug excavation method based on more counter-examples | |
| CN111047173B (en) | Community credibility evaluation method based on improved D-S evidence theory | |
| CN111460250A (en) | Image data cleaning method, image data cleaning device, image data cleaning medium, and electronic apparatus | |
| CN107368526A (en) | A kind of data processing method and device | |
| CN113221960B (en) | Construction method and collection method of high-quality vulnerability data collection model | |
| CN108446559A (en) | A kind of recognition methods of APT tissue and device | |
| CN109740347A (en) | A kind of identification of the fragile hash function for smart machine firmware and crack method | |
| CN115017511A (en) | Source code vulnerability detection method and device and storage medium | |
| CN110825642B (en) | Software code line-level defect detection method based on deep learning | |
| CN115168856A (en) | Binary code similarity detection method and Internet of things firmware vulnerability detection method | |
| CN113297580B (en) | Code semantic analysis-based electric power information system safety protection method and device | |
| CN110808947B (en) | Automatic vulnerability quantitative evaluation method and system | |
| CN112016088A (en) | Method and device for generating file detection model and method and device for detecting file | |
| CN112200862A (en) | Training method of target detection model, target detection method and device | |
| CN117195220A (en) | Intelligent contract vulnerability detection method and system based on Tree-LSTM and BiLSTM | |
| CN116467720A (en) | Intelligent contract vulnerability detection method based on graph neural network and electronic equipment | |
| CN115455407A (en) | Machine learning-based GitHub sensitive information leakage monitoring method | |
| CN108647497A (en) | A kind of API key automatic recognition systems of feature based extraction |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| WW01 | Invention patent application withdrawn after publication |
Application publication date: 20181221 |
|
| WW01 | Invention patent application withdrawn after publication |