A video surveillance device firmware identification method, system, device and medium

Abstract

The present application relates to a method, system, device and medium for identifying firmware of video surveillance equipment, and belongs to the technical field of automatic identification of video surveillance assets in the Internet of Things. The identification method includes: obtaining a sample data set and preprocessing it; constructing a video surveillance equipment firmware knowledge graph based on the preprocessed sample data set; predicting the link relationship between device nodes and firmware nodes in the video surveillance equipment firmware knowledge graph based on a pre-trained device firmware link prediction model, and obtaining a link prediction result; generating trusted triplet data to be inserted based on the link prediction result; updating the video surveillance equipment firmware knowledge graph based on the trusted triplet data to be inserted; performing a device firmware query on the video surveillance equipment to be identified based on the updated video surveillance equipment firmware knowledge graph, and obtaining the firmware version information of the video surveillance equipment to be identified. The present application can effectively identify the firmware version used by the video surveillance equipment.

Description

Technical Field

[0001] The present application relates to the technical field of automatic identification of assets in video surveillance of the Internet of Things, and in particular to a method, system, device and medium for identifying firmware of video surveillance equipment. Background Art

[0002] With the rapid development of Internet of Things (IoT) technology, video surveillance equipment has been widely used in public security, traffic monitoring, industrial scenarios, and personal property protection. While these devices provide security protection for users, they also face increasing security threats and operation and maintenance challenges. The firmware of video surveillance equipment plays a vital role in the normal operation of equipment functions, vulnerability repair, and performance optimization, so ensuring that the firmware of these devices is kept up to date has become a key task. However, in actual operation, there are many types of equipment and frequent firmware version updates, which greatly increase the complexity of device management and the challenges of secure operation and maintenance.

[0003] Device firmware identification refers to the process of determining the firmware (software program) version running on Internet of Things (IoT) devices and video surveillance devices through specific technical means. Firmware is usually embedded in hardware and is responsible for the basic operation and control of the device. Accurately identifying the firmware version is crucial for analyzing and confirming whether the device has associated vulnerabilities and maintaining device security.

[0004] At present, common firmware identification methods rely on directly accessing the physical interface of the device, analyzing network communications, or obtaining it through the management interface of the device. These methods are not only inefficient, but also may pose security risks and are difficult to implement without physical access to the device. Therefore, how to effectively identify the firmware version used by video surveillance equipment when it is impossible to rely on direct firmware version information is a technical problem that needs to be solved urgently. Summary of the invention

[0005] In order to effectively identify the firmware version used by a video surveillance device, the present application provides a video surveillance device firmware identification method, system, device and medium.

[0006] In a first aspect, the present application provides a method for identifying firmware of a video surveillance device, which adopts the following technical solution:

[0007] A method for identifying firmware of a video surveillance device, the method comprising:

[0008] Obtaining a sample data set and performing preprocessing; the sample data set includes video surveillance equipment and firmware information data;

[0009] Constructing a video surveillance device firmware knowledge graph based on the preprocessed sample data set; wherein the nodes in the video surveillance device firmware knowledge graph represent device nodes or firmware nodes, and the edges represent the relationship between device nodes and firmware nodes;

[0010] Based on a pre-trained device firmware link prediction model, predict the link relationship between the device node and the firmware node in the video surveillance device firmware knowledge graph to obtain a link prediction result;

[0011] Generate trusted triple data to be inserted according to the link prediction result;

[0012] Updating the video surveillance device firmware knowledge graph based on the trusted triplet data to be inserted;

[0013] Based on the updated video surveillance device firmware knowledge graph, a device firmware query is performed on the video surveillance device to be identified to obtain firmware version information of the video surveillance device to be identified.

[0014] By adopting the above technical solutions, based on automated data collection and processing processes, combined with advanced deep learning technology and knowledge graph construction strategies, we have achieved the ability to accurately identify the firmware versions of various types of video surveillance equipment without physical access rights. This not only improves work efficiency and reduces labor costs, but also significantly enhances the response speed and ability to potential network security threats, providing strong technical support for device security analysis and vulnerability patching.

[0015] Optionally, the identification method further includes a step of training the device firmware link prediction model, the training step including:

[0016] Based on the graph data in the video surveillance device firmware knowledge graph, extracting device node information and firmware node information;

[0017] Mapping the device model string of the device node information into an integer index vector to obtain a device model data set;

[0018] Encoding the device model data set based on the GRU autoencoder model to obtain a device model feature vector;

[0019] Encoding or standardizing the device specification data of the device node information to obtain a device specification feature vector;

[0020] Concatenate the device model feature vector and the device specification feature vector to obtain a device node feature vector;

[0021] One-Hot encoding is performed on the firmware node information to obtain a firmware node feature vector;

[0022] Concatenate the device node feature vector and the firmware node feature vector to obtain a node feature vector;

[0023] The node feature vector and the adjacency matrix in the video surveillance device firmware knowledge graph are combined as input to train a device firmware link prediction model based on the GCN model and the GAE model;

[0024] The device firmware link prediction model is optimized based on a preset combined loss function, and parameters are updated based on an Adam optimization algorithm to obtain the trained device firmware link prediction model.

[0025] By adopting the above technical solutions, a complete device firmware identification framework was built. Through the effective encoding of the device model string by the GRU model, the learning of the device node features by the GCN model, and the link prediction capability of the GAE model, the model's encoding capability for the graph structure was improved, and the accurate identification of the firmware version of the video surveillance device was achieved, significantly improving the recognition efficiency and accuracy.

[0026] Optionally, the preset combined loss function includes a reconstruction loss function and a sorting loss function.

[0027] Optionally, the step of generating trusted triple data to be inserted according to the link prediction result includes:

[0028] Obtaining a confidence score of a link relationship between the device node and the firmware node based on the link prediction result;

[0029] Determining whether the confidence score is greater than a preset confidence threshold;

[0030] If so, it is determined that there is a firmware-using relationship between the device node and the firmware node, and trusted triplet data to be inserted is generated according to the device node and the firmware node.

[0031] By adopting the above technical solution, it is possible to automatically generate trusted device and firmware relationship triples based on the output results of the link prediction model, and dynamically update the video surveillance device firmware knowledge graph to achieve dynamic maintenance of video surveillance device firmware information, thereby improving the system's automation level and recognition accuracy.

[0032] Optionally, based on the updated video surveillance device firmware knowledge graph, performing a device firmware query on the video surveillance device to be identified to obtain the firmware version information of the video surveillance device to be identified includes:

[0033] Obtain the device model and specification data of the video surveillance device to be identified;

[0034] Querying the corresponding device node in the updated video surveillance device firmware knowledge graph based on the device model and specification data;

[0035] The firmware version information of the video surveillance device to be identified is obtained according to the firmware node associated with the device node.

[0036] By adopting the above technical solution, if the device already exists in the knowledge graph, the firmware information can be quickly obtained, saving operation and maintenance time and reducing dependence on manual query and device management.

[0037] Optionally, after the step of querying the corresponding device node in the updated video surveillance device firmware knowledge graph based on the device model and specification data, the step further includes:

[0038] If no corresponding device node is found, the video surveillance device to be identified is added to the updated video surveillance device firmware knowledge graph as a device node to be identified;

[0039] Based on a pre-trained device firmware link prediction model, firmware link prediction is performed on the device node to be identified to obtain a link prediction result between each firmware node and the device node to be identified;

[0040] Determining whether there is a firmware node whose link prediction result meets a preset confidence threshold;

[0041] If so, the firmware version information of the video surveillance device to be identified is obtained according to the firmware node.

[0042] By adopting the above technical solution, if the device does not exist in the knowledge graph, the knowledge graph and the device firmware link prediction model are combined to realize the automatic identification of the firmware version of the unknown video surveillance device. By supporting the automatic addition of new devices, the timeliness and integrity of the knowledge graph are ensured, which not only improves the automation level of video surveillance device firmware management, but also greatly improves the security and operation and maintenance efficiency of the system. It is suitable for the management and safe operation and maintenance of large-scale video surveillance systems.

[0043] In a second aspect, the present application provides a video surveillance device firmware identification system, which adopts the following technical solution:

[0044] A video surveillance device firmware identification system, the identification system comprising:

[0045] A sample data processing module, used to obtain and pre-process a sample data set; the sample data set includes video surveillance equipment and firmware information data;

[0046] A knowledge graph construction module, used to construct a video surveillance device firmware knowledge graph based on the preprocessed sample data set; wherein the nodes in the video surveillance device firmware knowledge graph represent device nodes or firmware nodes, and the edges represent the relationship between device nodes and firmware nodes;

[0047] A link relationship prediction module, used to predict the link relationship between the device node and the firmware node in the video surveillance device firmware knowledge graph based on a pre-trained device firmware link prediction model, and obtain a link prediction result;

[0048] A trusted triplet data generation module, used to generate trusted triplet data to be inserted according to the link prediction result;

[0049] A knowledge graph updating module, used for updating the video surveillance device firmware knowledge graph based on the trusted triplet data to be inserted;

[0050] The device firmware query module is used to query the device firmware of the video surveillance device to be identified based on the updated video surveillance device firmware knowledge graph to obtain the firmware version information of the video surveillance device to be identified.

[0051] Optionally, the device firmware query module includes:

[0052] A device data acquisition unit, used to acquire the device model and specification data of the video surveillance device to be identified;

[0053] A device node query unit, configured to query a corresponding device node in the updated video surveillance device firmware knowledge graph based on the device model and specification data;

[0054] The firmware version determination unit obtains the firmware version information of the video surveillance device to be identified according to the firmware node associated with the device node.

[0055] In a third aspect, the present application provides a computer device, which adopts the following technical solution:

[0056] A computer device comprises a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method as described in the first aspect.

[0057] In a fourth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution:

[0058] A computer-readable storage medium stores a computer program that can be loaded by a processor and execute any one of the methods in the first aspect.

[0059] To summarize, the present application includes at least one of the following beneficial technical effects: based on automated data collection and processing procedures, combined with advanced deep learning technology and knowledge graph construction strategies, it achieves the ability to accurately identify the firmware versions of various types of video surveillance equipment without physical access rights. This not only improves work efficiency and reduces labor costs, but also significantly enhances the response speed and ability to potential network security threats, providing strong technical support for device security analysis and vulnerability patching. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 This is a first flow chart of a method for identifying firmware of a video surveillance device according to one of the embodiments of the present application.

[0061] Figure 2 This is a second flow chart of a method for identifying firmware of a video surveillance device according to one of the embodiments of the present application.

[0062] Figure 3 This is a third flow chart of a method for identifying firmware of a video surveillance device according to one of the embodiments of the present application.

[0063] Figure 4 This is a fourth flow chart of a method for identifying firmware of a video surveillance device according to one of the embodiments of the present application.

[0064] Figure 5 This is a fifth flow chart of a method for identifying firmware of a video surveillance device according to one of the embodiments of the present application. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solutions and advantages of this application more clear, the following Figure 1-5 It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0066] With the large number of video surveillance devices used in public safety, traffic monitoring, personal property protection and other fields, ensuring that the firmware of these devices is kept up to date is crucial to preventing the exploitation of security vulnerabilities. However, due to the large number of video surveillance device models, frequent firmware version updates, and the fact that manufacturers usually do not maintain a dedicated firmware development team for each device in order to save costs, firmware sharing is common.

[0067] In the security operation and maintenance of video surveillance equipment, identifying and analyzing the firmware version used by the equipment is crucial to determine and patch potential security vulnerabilities. However, due to various reasons, including equipment discontinuation, information deletion from the official website, or the manufacturer's failure to disclose firmware information, it is often difficult to obtain firmware version information for certain devices. The lack of firmware information not only increases the difficulty of security analysis, but also makes it more difficult to respond quickly to specific vulnerabilities.

[0068] At present, the prior art 1 discloses a method for identifying firmware of large-scale IoT devices based on weak keys. The method uses the characteristics of the device login page to identify the device type, brand, model and firmware version through web page analysis and clustering technology. The specific process includes: using the Zmap tool to scan the IP addresses of the entire network, extracting the login page content of active hosts using the HTTP protocol, and parsing the page structure and text through BeautifulSoup. Subsequently, the similarity between pages is calculated by the longest common subsequence algorithm (LCS), simhash algorithm and cosine similarity, and these similarity values ​​are summarized using Euclidean distance. Based on these calculation results, the DBSCAN algorithm is used to cluster the devices and mark the representative device types or brands in the cluster. In order to obtain firmware information, the scheme attempts to log in to the device background using a common weak password, and uses the BoM algorithm to block the page content, extract the device model and firmware version information, and finally standardize this information to ensure data consistency.

[0069] However, this technical solution has significant limitations and risks in application. First, firmware version identification is heavily dependent on the device background login page, so if the target device uses a strong password or is not publicly available on the Internet, the solution will not be able to obtain firmware information. In addition, there is a great legal risk in trying to log in to the device using a weak password, and unauthorized access may violate laws and regulations. This solution is not only inefficient in identifying firmware versions, but also faces compliance issues, and it is difficult to meet the actual needs of automated management and security analysis of firmware information for IoT devices.

[0070] In addition, the second prior art also discloses a method for capturing the radio signal of a wireless network device, extracting data packet features and radio frequency fingerprints to identify specific device firmware information. This solution uses a software radio device to receive radio signals, and preprocesses them through signal filtering and low-noise amplification technology to ensure the clarity of the signal. Subsequently, the signal is converted into a byte stream of a data packet, and independent data packets are separated according to the network protocol and effective features are extracted. These features are input into a trained classification model for identification, and an identification result based on data packet features is obtained. At the same time, the system performs signal transformation on the original radio signal, extracts the radio frequency fingerprint features and inputs them into the classification model again for identification, so as to obtain an identification result based on the radio frequency fingerprint. Finally, the device type is determined by fusing the identification results of the data packet features and the radio frequency fingerprint, and the specific firmware information of the device is further identified, and finally the accurate classification of the device firmware is achieved.

[0071] However, this method has limitations in terms of application scope and environmental adaptability. First, the solution requires capturing radio signals near the physical device to identify the firmware version, which means that in a large video surveillance network, it is necessary to approach the devices one by one to collect signals, resulting in excessive manpower and time costs, which is not suitable for large-scale applications. Second, this method is highly dependent on the quality of the radio signal and is therefore very sensitive to environmental noise and other interference. In the case of poor signal quality or more environmental interference, the accuracy and efficiency of recognition may drop significantly, affecting the actual use effect.

[0072] Based on this, in order to reduce the problems existing in the above-mentioned prior art solutions, an embodiment of the present application discloses a method for identifying firmware of a video surveillance device.

[0073] Reference Figure 1 , a method for identifying firmware of a video surveillance device, the identification method comprising:

[0074] Step S101, obtaining a sample data set and performing preprocessing;

[0075] Among them, the sample data set includes video surveillance equipment and firmware information data;

[0076] Specifically, the data sources of the sample data set include official websites of video surveillance equipment, product quotation websites, firmware forums, etc., which can be obtained by periodically acquiring public data on the Internet; the preprocessing step is to clean the collected data, extract device-related data (model, specifications) and firmware data (firmware version number and possible master control version number and encoding version number within the firmware), and then format and standardize them to generate triple data consisting of device nodes, firmware nodes, and the relationship between device firmware.

[0077] It can be understood that by cleaning and standardizing, removing redundant and noisy data and ensuring consistent data formats, the foundation is laid for the subsequent knowledge graph construction.

[0078] Step S102, constructing a video surveillance device firmware knowledge graph based on the preprocessed sample data set;

[0079] Among them, the nodes in the video surveillance device firmware knowledge graph represent device nodes or firmware nodes, and the edges represent the relationship between device nodes and firmware nodes;

[0080] Specifically, a knowledge graph of the video surveillance device firmware is constructed based on the large amount of triple data information preprocessed in step S101. The knowledge graph is a graphical data structure used to represent entities and their relationships, and is widely used in information retrieval, recommendation systems, natural language processing, and other fields. In the embodiment of the present application, the relationship between the device node and the firmware node in the knowledge graph includes a using firmware relationship and a possible using firmware relationship.

[0081] In some embodiments, the pre-processed triplet data consists of a device node, a firmware node, and a relationship between device firmware. The device node information includes the main attribute data such as device model, purpose, resolution, device appearance, and the secondary attribute data such as shutter speed, number of network interfaces, and power consumption; the firmware node information includes the main attribute data such as firmware version number, master control version number, encoding version number, WEB version number, and the secondary attribute data such as release time and support protocol; the relationship type includes uses_firmware relationship and may_uses_firmware relationship, that is, uses firmware relationship and may use firmware relationship.

[0082] For example, nodes: device node A (model: ABC-123), firmware node B (firmware version: v2.3.1), edge: A uses B, represented by the relationship “uses_firmware(A,B)”.

[0083] It should be noted that the knowledge graph can be periodically updated synchronously based on the triple data periodically obtained in step S101, and the relationship between the device and the firmware can be structured through the knowledge graph to make complex data association relationships visualized and queryable.

[0084] Step S103, based on the pre-trained device firmware link prediction model, predict the link relationship between the device node and the firmware node in the video surveillance device firmware knowledge graph to obtain a link prediction result;

[0085] The link prediction results include a set of new potential link relationships and their confidence scores, that is, inferring unknown relationships given some known relationships. For example, if it is known that there is a link between device A and firmware B, the model predicts that the confidence score between the new device C and firmware B is 0.85 (higher than the preset threshold of 0.8), which means that C may also use firmware B.

[0086] It can be understood that by evaluating the associations between device nodes and firmware nodes in the knowledge graph that have not been explicitly described, potential device and firmware combinations are discovered, providing references for device upgrades or maintenance.

[0087] It should be noted that the link prediction technology based on the knowledge graph is mainly used to predict the possible relationships between entities in the graph, that is, to infer unknown relationships based on existing entities and relationships. This technology can effectively mine and predict the potential connections between entities by analyzing the structural features and relationship patterns between entities. In the application scenario of device firmware identification of the present application, the link prediction technology can be used to predict the relationship between a specific device model and firmware version by running the forward reasoning process of the device firmware link prediction model, providing theoretical support and technical means for firmware identification.

[0088] Step S104, generating trusted triple data to be inserted according to the link prediction result;

[0089] Among them, reliable triple data are screened out according to the link prediction results and the set confidence threshold, providing a basis for updating the knowledge graph and ensuring that the inserted data is reliable and accurate.

[0090] Step S105, updating the video surveillance device firmware knowledge graph based on the trusted triplet data to be inserted;

[0091] For example, the triple (device C, uses_firmware, firmware B) is inserted into the graph, so that the relationship between the new device and the existing firmware node is supplemented. This step ensures that the knowledge graph can maintain timeliness and accuracy through dynamic updates, and improves the accuracy of firmware identification.

[0092] Step S106: Based on the updated video surveillance device firmware knowledge graph, perform a device firmware query on the video surveillance device to be identified to obtain firmware version information of the video surveillance device to be identified.

[0093] In some embodiments, the information of the video surveillance device to be identified (such as model or specification) provided by the user can be used to search for the firmware node associated with the device of the corresponding model or specification using the latest knowledge graph, and then obtain the firmware version information of the associated firmware node. For example, when querying device C, the associated firmware version information is "v2.3.1".

[0094] It is understandable that by quickly obtaining the firmware version information of the device, support can be provided for vulnerability repair and security analysis of the system.

[0095] In the above implementation, based on automated data collection and processing procedures, combined with advanced deep learning technology and knowledge graph construction strategies, the ability to accurately identify the firmware versions of various types of video surveillance equipment without physical access rights is achieved. This not only improves work efficiency and reduces labor costs, but also significantly enhances the response speed and ability to potential network security threats, providing strong technical support for device security analysis and vulnerability patching.

[0096] It is understandable that this application abandons the traditional method of relying on purchasing equipment to enter the background check or using weak passwords to attack public network equipment to obtain firmware information. Instead, it innovatively uses the trusted data publicly available on the Internet as the training basis to realize the identification of device firmware versions based on big data. To ensure the comprehensiveness and timeliness of the data, data related to the field of video surveillance on the Internet is periodically acquired, and the acquired data is cleaned and preprocessed. Subsequently, the system constructs and regularly updates a video surveillance equipment firmware knowledge graph containing multi-dimensional information such as device model, specifications and firmware version, providing data support for firmware identification.

[0097] Reference Figure 2 As an implementation of the device firmware link prediction model in step S103, the training steps of the device firmware link prediction model include:

[0098] Step S201, extracting device node information and firmware node information based on graph data in the video surveillance device firmware knowledge graph;

[0099] Among them, all device-related nodes (device nodes) and firmware-related nodes (firmware nodes) are extracted from the knowledge graph to provide basic data for subsequent feature encoding and model training.

[0100] Step S202, mapping the device model character string of the device node information to an integer index vector to obtain a device model data set;

[0101] Specifically, the device model string is converted into an integer index vector to form a dataset that can be processed by the model to simplify the representation of the device model. For example, the device model "ABC-123" is mapped to an index vector [1,2,3], where each character or substring corresponds to an integer index.

[0102] Step S203, encoding the device model data set based on the GRU autoencoder model to obtain a device model feature vector;

[0103] Among them, an unsupervised autoencoder model with both the encoder and decoder being GRU models is used to learn the sequence data of device models, capture the feature relationship between two characters and three characters, and map them into high-dimensional feature vectors.

[0104] It should be noted that GRU (Gated Recurrent Unit) is an efficient recurrent neural network (RNN) variant used to process sequence data. Compared with traditional RNN, GRU solves the problem of gradient vanishing and exploding by introducing update gates and reset gates, and improves the model's ability to capture long-term dependency information. In this application, for sequence feature encoding scenarios such as device model strings, GRU can effectively capture the structural information and dependencies within the sequence.

[0105] In one embodiment of the present application, the GRU autoencoder model can be trained using a device model data set to extract the feature vector of the device model and achieve efficient model information encoding. The training process of the GRU autoencoder model is optimized using a cross entropy loss function, and the Adam optimizer is used to accelerate parameter convergence. The specific training steps include: first, mapping the device model string sequence to an integer index vector. In the encoding stage, the GRU model receives the index vector sequence of the device model as input. The GRU encoder updates the hidden state by gradually processing the sequence. The hidden state of the last time step (unit) of the model will be used as the feature vector of the sequence. The accuracy of the model in reconstructing the device model sequence during training is evaluated by using a cross entropy loss function, and the parameters of the model are adjusted using an Adam optimizer to obtain a trained GRU autoencoder model.

[0106] After the model training is completed, the device model string sequence to be encoded is mapped to an integer index vector and input into the GRU autoencoder model; the GRU autoencoder model updates the internal state during the forward reasoning process and generates a hidden state vector at the last time step; the hidden state vector is the feature representation of the device model, called the device model feature vector. For example, for the input sequence [1,2,3], the last hidden state of the GRU model is the vector [0.2,0.3,0.7], which represents the feature expression of the device model.

[0107] Step S204, encoding or standardizing the device specification data of the device node information to obtain a device specification feature vector;

[0108] In some embodiments, categorical attributes (such as device usage) can be represented using One-Hot encoding, and numerical attributes (such as device resolution, shutter speed, etc.) can be processed using standardized formulas to reduce the impact of data distribution on model training.

[0109] Among them, One-Hot encoding is a commonly used data representation method used to convert classification features into numerical forms that can be understood by computer models. Each category can be converted into a binary vector in which only one position is 1 and the other positions are 0. One-Hot encoding effectively avoids the influence of the size order of category data on model training and is suitable for scenarios with less category data and mutually exclusive properties. For example, for equipment usage, such as "monitoring", One-Hot encoding can be [0,1].

[0110] The standardization process is as follows: first, for the numerical attribute to be standardized, the mean and standard deviation of all data points are calculated; second, the standardization formula is applied to each data point to convert it into a form with zero mean and unit variance.

[0111] The normalization formula is:

[0112]

[0113] In the above formula, Z is the standardized data point, X is the original data point, μ is the mean of the original data, and σ is the standard deviation of the original data. For example, for a resolution such as "1080P", it can be standardized to 0.75.

[0114] Step S205, concatenating the device model feature vector and the device specification feature vector to obtain a device node feature vector;

[0115] Among them, the feature vectors of the device model and specification data are merged through the splicing operation to form a complete device node feature vector.

[0116] Exemplarily, the model feature vector [0.2, 0.3, 0.7] and the specification feature vector [0.75, 0, 1] are concatenated to obtain the device node feature vector [0.2, 0.3, 0.7, 0.75, 0, 1].

[0117] Step S206, One-Hot encoding is performed on the firmware node information to obtain a firmware node feature vector;

[0118] Since the firmware version is unique, using One-Hot encoding on it can make each firmware node have an independent feature representation. For example, the firmware version "v2.3.1" can correspond to the One-Hot encoding of [0,0,1].

[0119] Step S207, concatenating the device node feature vector and the firmware node feature vector to obtain a node feature vector;

[0120] The feature vectors of the device node and the firmware node are merged. This vector comprehensively reflects the multi-dimensional information of the device and can provide global feature information for the model. For example, the device node feature vector [0.2, 0.3, 0.7, 0.75, 0, 1] and the firmware node feature vector [0, 0, 1] are concatenated into [0.2, 0.3, 0.7, 0.75, 0, 1, 0, 0, 1].

[0121] Step S208, combining the node feature vector and the adjacency matrix in the video surveillance device firmware knowledge graph as input, and training a device firmware link prediction model based on the GCN model and the GAE model;

[0122] It should be noted that GCN (Graph Convolutional Network) is a deep learning model that runs on graph structured data and can capture the complex relationships between nodes and graph topology information. By performing convolution operations on the graph, GCN can learn low-dimensional and efficient representations (embeddings) of nodes, providing powerful feature representation capabilities for tasks such as node classification, graph classification, and link prediction. GAE (Graph AutoEncoder) is a graph deep learning model that is used to learn low-dimensional representations of nodes in a graph while maintaining structural information between nodes. It maps nodes to a low-dimensional space through an encoder, and then reconstructs the adjacency matrix of the graph through a decoder, achieving node embedding while optimizing link prediction performance.

[0123] In one embodiment of the present application, the node feature vector and the adjacency matrix of the knowledge graph are used as input, the GCN model is used to aggregate the node features, and the GAE model is used to reconstruct the adjacency matrix to learn the relationship between the device and the firmware, and obtain the device firmware link prediction model. The link prediction model can learn the relationship between the device node and the firmware node, and give a confidence score that there is a firmware use relationship between the device node and the firmware node. If the confidence score is higher than a threshold, it is considered that the relationship exists.

[0124] Specifically, in the above link prediction model, the GCN model serves as the encoder part of the GAE model. The GCN encoder is used to learn the vector representation of nodes in the knowledge graph. The GCN layer updates the vector representation of nodes by aggregating the neighbor information of each node, making the node feature representation richer. The GAE model uses the node vector representation obtained from the GCN model as input and reconstructs the adjacency matrix through the decoder of the GAE model to learn and predict the potential relationship between devices and firmware, making up for the lack of missing data.

[0125] Step S209, optimizing the device firmware link prediction model based on a preset combined loss function, and updating parameters based on the Adam optimization algorithm to obtain a trained device firmware link prediction model.

[0126] Among them, the preset combined loss function includes a reconstruction loss function and a sorting loss function.

[0127] As an implementation of the reconstruction loss function, the reconstruction loss is used to measure the difference between the adjacency matrix predicted by the model and the actual adjacency matrix to ensure that the model can accurately predict the connection relationship between the device and the firmware. The specific formula is:

[0128]

[0129] In the above formula, pij is the probability predicted by the model that there is a relationship between nodes i and j, E represents the set of all edges in the graph, and N is the total number of edges.

[0130] As an implementation of the ranking loss function, the ranking loss is used to ensure that the positive sample relationship score predicted by the model is higher than the negative sample relationship score, and a minimum score difference (margin) is set as a constraint. The specific formula is:

[0131]

[0132] In the above formula, y is the target vector (which can be set to 1 in the embodiment of the present application), indicating that the expected positive sample score pos_score is greater than the negative sample score neg_score; margin is a preset interval value, indicating the expected minimum difference between the positive and negative sample scores, which can be set to 0.5 in the embodiment of the present application.

[0133] In one embodiment of the present application, the preset combined loss function is a combination of reconstruction loss and sorting loss, which ensures that the model achieves a balance between reconstructing the adjacency matrix and correctly distinguishing the relationship between positive and negative samples. The specific formula is: .

[0134] In addition, the Adam optimizer is used to train the device firmware link prediction model. Adam combines the advantages of momentum and adaptive learning rate to accelerate the parameter convergence of the model and improve training efficiency.

[0135] In the above implementation, a complete device firmware identification framework is constructed. Through the effective encoding of the device model string by the GRU model, the learning of the device node features by the GCN model, and the link prediction capability of the GAE model, the model's encoding capability for the graph structure is improved, and the accurate identification of the firmware version of the video surveillance device is achieved, which significantly improves the identification efficiency and accuracy.

[0136] It is understandable that this application, by constructing a knowledge graph of Internet public data and combining it with deep learning models (GRU, GCN, GAE) for training and prediction, breaks through the limitations of traditional reliance on device background access or weak password attacks to obtain firmware information, greatly improves recognition efficiency and accuracy, and transforms traditional problems into link prediction problems under homogeneous graphs in new technical fields, making the solution to this problem more scientific and standardized. In practical applications, this technical solution not only reduces legal risks and compliance pressures, but also reduces manpower and material costs, provides accurate and efficient support for security analysis and vulnerability patching of video surveillance systems, and significantly improves the overall security of the system.

[0137] In addition, in some other embodiments, after experimental verification by the applicant, the GRU model in the above embodiments can also be replaced by RNN variants such as LSTM, the GCN model can be replaced by GAT, GraphSAGE or SGC model, and the GAE model can be replaced by VGAE model.

[0138] Reference Figure 3 As an implementation of step S104, the step of generating the trusted triple data to be inserted according to the link prediction result includes:

[0139] Step S301, obtaining a confidence score of a link relationship between a device node and a firmware node based on a link prediction result;

[0140] The potential relationship between each device node and firmware node is predicted as a confidence score, which indicates the probability that the device node may use a certain firmware. The confidence score ranges from 0 to 1, and the higher the value, the greater the possibility that there is a relationship between the nodes.

[0141] Step S302, determine whether the confidence score is greater than a preset confidence threshold; if so, jump to step S303; if not, do not perform any operation;

[0142] To ensure the accuracy of the generated triplet data, the model uses a preset confidence threshold, which can be set based on experimental experience or specific application scenarios. If the confidence score of a pair of device and firmware is higher than this threshold, it is considered that there is a firmware-using relationship between them.

[0143] Step S303: determine whether there is a firmware-using relationship between the device node and the firmware node, and generate trusted triplet data to be inserted according to the device node and the firmware node.

[0144] Specifically, if the confidence score of a pair of device nodes and firmware nodes exceeds the preset threshold, the system will mark it as a trusted relationship; then, the corresponding triple data is generated to update the knowledge graph. The format of these triples is (device node, uses firmware relationship, firmware node), that is, (device C, uses_firmware, firmware B), indicating that device C uses firmware B.

[0145] In the above implementation, based on the output results of the link prediction model, a trusted device and firmware relationship triple is automatically generated, and the video surveillance device firmware knowledge graph is dynamically updated to achieve dynamic maintenance of video surveillance device firmware information, thereby improving the system's automation level and recognition accuracy.

[0146] Reference Figure 4 As an implementation method of step S106, based on the updated video surveillance device firmware knowledge graph, the step of performing a device firmware query on the video surveillance device to be identified and obtaining the firmware version information of the video surveillance device to be identified includes:

[0147] Step S401, obtaining the device model and specification data of the video surveillance device to be identified;

[0148] Among them, the device model and specification data are the basis for querying the knowledge graph and predicting firmware. For example, the device model is ABC-123, and the specification data includes: the purpose is "monitoring"; the resolution is "1080P"; the shutter speed is "1 / 50 second".

[0149] Step S402, querying the corresponding device node in the updated video surveillance device firmware knowledge graph based on the device model and specification data;

[0150] Among them, the model and specification data of the device to be identified are used to find the corresponding device node in the updated knowledge graph. After the device node is queried, the firmware information associated with it can be quickly obtained, thereby improving the query efficiency of the system.

[0151] Step S403: Obtain firmware version information of the video surveillance device to be identified according to the firmware node associated with the device node.

[0152] Specifically, if a matching device node is found, its associated firmware node and firmware version information can be directly returned. For example, a device node with a model number of "ABC-123" is searched in the knowledge graph, and its associated firmware version node "v2.3.1" is found.

[0153] In the above implementation, if the device already exists in the knowledge graph, the firmware information can be quickly obtained, saving operation and maintenance time and reducing dependence on manual query and device management.

[0154] Reference Figure 5 As a further implementation of the identification method, after the step of querying the corresponding device node in the updated video surveillance device firmware knowledge graph based on the device model and specification data, it also includes:

[0155] Step S501: if the corresponding device node is not found, the video surveillance device to be identified is added to the updated video surveillance device firmware knowledge graph as a device node to be identified;

[0156] Among them, if the device node does not exist in the knowledge graph, the system will insert it into the knowledge graph as a new device node to be identified, ensuring that the system can dynamically expand the knowledge graph so that it can cover new devices and provide support for subsequent firmware predictions.

[0157] Step S502, based on the pre-trained device firmware link prediction model, perform firmware link prediction on the device node to be identified, and obtain a link prediction result between each firmware node and the device node to be identified;

[0158] The device firmware link prediction model is used to predict the link relationship between the newly added device node to be identified and each firmware node, and a confidence score is generated for each possible firmware node.

[0159] Step S503, determining whether there is a firmware node whose link prediction result meets a preset confidence threshold; if so, jump to step S504; if not, jump to step S505;

[0160] Specifically, the system compares the predicted score of each device and firmware relationship with a preset confidence threshold. If the confidence score of a firmware node is higher than the threshold, the device is considered to use the firmware version.

[0161] Step S504, obtaining firmware version information of the video surveillance device to be identified according to the firmware node;

[0162] Step S505, confirming that the corresponding firmware version information cannot be queried.

[0163] In the above implementation, if the device does not exist in the knowledge graph, the knowledge graph and the device firmware link prediction model are combined to realize the automatic identification of the firmware version of the unknown video surveillance device. By supporting the automatic addition of new devices, the timeliness and integrity of the knowledge graph are ensured, which not only improves the automation level of video surveillance device firmware management, but also greatly improves the security and operation and maintenance efficiency of the system, and is suitable for the management and security operation and maintenance of large-scale video surveillance systems.

[0164] This application proposes an improvement plan to address the deficiencies in the prior art, aiming to achieve more efficient and secure firmware version identification by providing a firmware version identification method that does not rely on physical devices, building a knowledge graph through massive data disclosed on the Internet, and performing firmware version identification based on the knowledge graph and deep learning model. Traditional methods usually require direct access to the physical entity of the video surveillance device, such as determining the firmware version through data packet analysis or logging into the device management interface. This application breaks through this limitation by collecting data disclosed on the Internet, building a knowledge graph containing device model, specifications, and firmware version information, and combining GRU (gated recurrent unit) and GAE+GCN (graph autoencoder + graph convolutional network) models for prediction, thereby achieving automatic firmware version identification based on device model and specifications.

[0165] Secondly, in the context of increasingly stringent requirements for data security and privacy protection, this application provides a more secure and compliant firmware version identification solution that can improve identification efficiency while ensuring the legality and reliability of the system, which not only expands the application scenarios but also reduces legal risks. In addition, since this technical solution does not rely on contact operations of physical devices, there is no need to monitor device data packets or access management interfaces, which makes it suitable for various application scenarios, not limited by the physical location of the device or the network environment, and effectively avoids the legal and compliance risks that may be caused by direct access to the device.

[0166] The embodiment of the present application also discloses a video surveillance equipment firmware identification system.

[0167] A video surveillance device firmware identification system, the identification system comprising:

[0168] The sample data processing module is used to obtain and pre-process the sample data set; the sample data set includes video surveillance equipment and firmware information data;

[0169] A knowledge graph construction module is used to construct a video surveillance device firmware knowledge graph based on the preprocessed sample data set; wherein the nodes in the video surveillance device firmware knowledge graph represent device nodes or firmware nodes, and the edges represent the relationship between device nodes and firmware nodes;

[0170] A link relationship prediction module is used to predict the link relationship between device nodes and firmware nodes in the video surveillance device firmware knowledge graph based on a pre-trained device firmware link prediction model to obtain a link prediction result;

[0171] A trusted triplet data generation module, used to generate trusted triplet data to be inserted according to link prediction results;

[0172] A knowledge graph updating module, used to update the video surveillance device firmware knowledge graph based on the trusted triplet data to be inserted;

[0173] The device firmware query module is used to query the device firmware of the video surveillance device to be identified based on the updated video surveillance device firmware knowledge graph to obtain the firmware version information of the video surveillance device to be identified.

[0174] In the above implementation, efficient identification and dynamic management of firmware versions are achieved through the collaborative work of multiple modules. The system builds a knowledge graph based on a sample data set, and uses a pre-trained link prediction model to analyze the relationship between the device and the firmware node, generating reliable triple data to update the knowledge graph to ensure the timeliness and accuracy of the data. Through this firmware identification system, not only is automatic firmware version identification based on device models and specifications achieved, but firmware information can also be quickly queried without physical contact with the device, improving identification efficiency, expanding application scenarios, and effectively reducing legal and compliance risks, providing strong support for device security management and vulnerability response.

[0175] As an implementation of the device firmware query module, the device firmware query module includes:

[0176] A device data acquisition unit, used to acquire the device model and specification data of the video surveillance device to be identified;

[0177] A device node query unit, used to query the corresponding device node in the updated video surveillance device firmware knowledge graph based on the device model and specification data;

[0178] The firmware version determination unit obtains the firmware version information of the video surveillance device to be identified according to the firmware node associated with the device node.

[0179] In the above implementation, if the device already exists in the knowledge graph, the firmware information can be quickly obtained, saving operation and maintenance time and reducing dependence on manual query and device management.

[0180] The video surveillance device firmware identification system of the embodiment of the present application can implement any of the above-mentioned video surveillance device firmware identification methods, and the specific working process of each module in the video surveillance device firmware identification system can refer to the corresponding process in the above-mentioned method embodiment.

[0181] In the several embodiments provided in this application, it should be understood that the provided methods and systems can be implemented in other ways. For example, the system embodiments described above are only illustrative; for example, the division of a certain module is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed.

[0182] The embodiment of the present application also discloses a computer device.

[0183] The computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the above-mentioned video surveillance device firmware identification method is implemented.

[0184] The embodiment of the present application also discloses a computer-readable storage medium.

[0185] A computer-readable storage medium stores a computer program that can be loaded by a processor and execute any one of the above-mentioned methods for identifying firmware of a video surveillance device.

[0186] Among them, computer-readable storage media can be any tangible medium that contains or stores a program, which can be used by or in conjunction with an instruction execution system, apparatus or device; the program code contained on the computer-readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0187] It should be noted that in the above embodiments, the description of each embodiment has different emphases, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0188] The above are all preferred embodiments of the present application, and are not intended to limit the protection scope of the present application. Any feature disclosed in this specification (including the abstract and drawings), unless otherwise stated, can be replaced by other equivalent or alternative features with similar purposes. That is, unless otherwise stated, each feature is only an example of a series of equivalent or similar features.

Claims

1. A method for identifying firmware of a video surveillance device, characterized in that: The identification method comprises: Obtaining a sample data set and performing preprocessing; the sample data set includes video surveillance equipment and firmware information data; Constructing a video surveillance device firmware knowledge graph based on the preprocessed sample data set; wherein the nodes in the video surveillance device firmware knowledge graph represent device nodes or firmware nodes, the edges represent the relationship between device nodes and firmware nodes, and the relationship between device nodes and firmware nodes includes a use firmware relationship and a possible use firmware relationship; Based on a pre-trained device firmware link prediction model, predict the link relationship between the device node and the firmware node in the video surveillance device firmware knowledge graph to obtain a link prediction result; Generate trusted triplet data to be inserted according to the link prediction result; wherein the triplet data is composed of device nodes, firmware nodes, and relationships between device firmware; Updating the video surveillance device firmware knowledge graph based on the trusted triplet data to be inserted; Based on the updated video surveillance device firmware knowledge graph, query the device firmware of the video surveillance device to be identified to obtain the firmware version information of the video surveillance device to be identified; The step of generating the trusted triple data to be inserted according to the link prediction result comprises: Obtaining a confidence score of a link relationship between the device node and the firmware node based on the link prediction result; Determining whether the confidence score is greater than a preset confidence threshold; If so, it is determined that there is a firmware-using relationship between the device node and the firmware node, and trusted triplet data to be inserted is generated according to the device node and the firmware node.

2. A method for identifying firmware of a video surveillance device according to claim 1, characterized in that: The identification method further comprises a training step of the device firmware link prediction model, wherein the training step comprises: Based on the graph data in the video surveillance device firmware knowledge graph, extracting device node information and firmware node information; Mapping the device model string of the device node information into an integer index vector to obtain a device model data set; Encoding the device model data set based on the GRU autoencoder model to obtain a device model feature vector; Encoding or standardizing the device specification data of the device node information to obtain a device specification feature vector; Concatenate the device model feature vector and the device specification feature vector to obtain a device node feature vector; One-Hot encoding is performed on the firmware node information to obtain a firmware node feature vector; Concatenate the device node feature vector and the firmware node feature vector to obtain a node feature vector; The node feature vector and the adjacency matrix in the video surveillance device firmware knowledge graph are combined as input to train a device firmware link prediction model based on the GCN model and the GAE model; The device firmware link prediction model is optimized based on a preset combined loss function, and parameters are updated based on an Adam optimization algorithm to obtain the trained device firmware link prediction model.

3. A method for identifying firmware of a video surveillance device according to claim 2, characterized in that: The preset combined loss function includes a reconstruction loss function and a sorting loss function.

4. A method for identifying firmware of a video surveillance device according to claim 1, characterized in that: Based on the updated video surveillance device firmware knowledge graph, the step of performing a device firmware query on the video surveillance device to be identified to obtain the firmware version information of the video surveillance device to be identified includes: Obtain the device model and specification data of the video surveillance device to be identified; Querying the corresponding device node in the updated video surveillance device firmware knowledge graph based on the device model and specification data; The firmware version information of the video surveillance device to be identified is obtained according to the firmware node associated with the device node.

5. A method for identifying firmware of a video surveillance device according to claim 4, characterized in that: After the step of querying the corresponding device node in the updated video surveillance device firmware knowledge graph based on the device model and specification data, the step further includes: If no corresponding device node is found, the video surveillance device to be identified is added to the updated video surveillance device firmware knowledge graph as a device node to be identified; Based on a pre-trained device firmware link prediction model, firmware link prediction is performed on the device node to be identified to obtain a link prediction result between each firmware node and the device node to be identified; Determining whether there is a firmware node whose link prediction result meets a preset confidence threshold; If so, the firmware version information of the video surveillance device to be identified is obtained according to the firmware node.

6. A video surveillance equipment firmware identification system, characterized in that: The identification system comprises: A sample data processing module, used to obtain and pre-process a sample data set; the sample data set includes video surveillance equipment and firmware information data; A knowledge graph construction module, used to construct a video surveillance device firmware knowledge graph based on the preprocessed sample data set; wherein the nodes in the video surveillance device firmware knowledge graph represent device nodes or firmware nodes, the edges represent the relationship between device nodes and firmware nodes, and the relationship between device nodes and firmware nodes includes a firmware use relationship and a possible firmware use relationship; A link relationship prediction module, used to predict the link relationship between the device node and the firmware node in the video surveillance device firmware knowledge graph based on a pre-trained device firmware link prediction model, and obtain a link prediction result; A trusted triplet data generation module, used to generate trusted triplet data to be inserted according to the link prediction result; wherein the triplet data is composed of device nodes, firmware nodes, and relationships between device firmware; A knowledge graph updating module, used for updating the video surveillance device firmware knowledge graph based on the trusted triplet data to be inserted; A device firmware query module, configured to query the device firmware of the video surveillance device to be identified based on the updated video surveillance device firmware knowledge graph, and obtain the firmware version information of the video surveillance device to be identified; The trusted triplet data generation module is configured as follows: Obtaining a confidence score of a link relationship between the device node and the firmware node based on the link prediction result; Determining whether the confidence score is greater than a preset confidence threshold; If so, it is determined that there is a firmware-using relationship between the device node and the firmware node, and trusted triplet data to be inserted is generated according to the device node and the firmware node.

7. A video surveillance equipment firmware identification system according to claim 6, characterized in that: The device firmware query module includes: A device data acquisition unit, used to acquire the device model and specification data of the video surveillance device to be identified; A device node query unit, configured to query a corresponding device node in the updated video surveillance device firmware knowledge graph based on the device model and specification data; The firmware version determination unit obtains the firmware version information of the video surveillance device to be identified according to the firmware node associated with the device node.

8. A computer device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: A computer program is stored which can be loaded by a processor and execute the method according to any one of claims 1 to 6.

Images