面向大规模嵌入式设备固件的自动化分析方法

An Automated Analysis Method for Large-Scale Embedded Device Firmware

设计了一种面向大规模嵌入式设备固件的自动化分析方法,该方法能够对固件进行自动化分析,提取其文件系统、操作系统、中央处理器指令架构等关键信息.针对固件解码成功的自动化判定难题,提出了一种基于分类回归树的固件解码状态检测算法,并选取收集的6 160个固件和固件自动化解码后得到的1 823个可反汇编二进制文件作为样本进行实验.实验结果表明,该算法相对其他分类器具有更好的分类效果,其分类准确率、召回率均在96%以上.

An automated analysis method for large-scale embedded firmware was designed to get device information,such as file system type,operating system type,or CPU instruction set. But it was difficult to know whether it was decoded successfully during automated firmware analysis. To solve this problem,a firmware decoding status detection method was proposed based on classification and regression tree algorithm. The dataset contained 6 160 firmware samples and 1 823 disassembled binary files that were collected from firmware decoding. The experiments conducted on the dataset demonstrated that the proposed method had a considerable performance comparing with other classifiers,whose precision and recall rate are both above 96%.