摘要
随着科技的迅猛进步,工控系统的固件安全问题日益凸显。受限于工控平台复杂异构、设计封闭及运行环境等问题,快速找出并修复工控固件中的安全问题至关重要。首先介绍了工控固件安全分析技术的现状,基于静态分析、动态模糊测试、符号执行和人工智能辅助等4个技术维度,介绍了现有工控固件安全分析的有效策略及其发展历程,并评估上述技术的优势和局限。最后,根据当前工控设备固件安全分析技术的现状,提出工控固件安全分析的挑战和机遇,并对其结合实时分析及大数据等相关技术的研究进行了展望。
With the rapid advancement of science and technology,the issue of firmware security in industrial control systems has become increasingly critical.Due to the complex and heterogeneous nature of industrial control platforms,as well as their closed design and operating environments,it is imperative to promptly identify and address security vulnerabilities within industrial control firmware.The current state of industrial control firmware security analysis technology was reviewed.The existing effective strategies and historical developments across four technical dimensions:static analysis,dynamic fuzz testing,symbolic execution,and artificial intelligence assistance were examined,and the strengths and limitations of these technologies were assessed.Finally,considering the current status of industrial control equipment firmware security analysis technology,this paper s challenges and opportunities in industrial control firmware security analysis was identified,and the prospects for real-time analysis and big data research were explored.
作者
陶耀东
顾俊杰
虞闯
孙永超
TAO Yaodong;GU Junjie;YU Chuang;SUN Yongchao(School of Computer Science and Technology,Beijing Jiaotong University,Beijing 100088,China;School of Information Science and Engineering,Shenyang Ligong University,Shenyang 110159,China;Beijing DualPi Intelligent Security Technology Co.,Ltd.,Beijing 100088,China)
出处
《计算机集成制造系统》
北大核心
2026年第3期799-812,共14页
Computer Integrated Manufacturing Systems
基金
2023年工信部高质量发展专项资助项目(ZTZB-23-990-035)。
关键词
工业控制系统
固件安全
静态分析
动态模糊测试
符号执行
人工智能辅助
安全测试
industrial control system
firmware security
static analysis
dynamic fuzz testing
symbolic execution
artificial intelligence assistance
security testing
