Representation learning-based online Internet of Things equipment firmware identification method

Abstract

The invention relates to a firmware identification method of IoT (Internet of Things) equipment, in particular to an online IoT equipment firmware identification method based on representation learning, which comprises the following steps: firstly simulating firmware of target IoT equipment to obtain the running state of the target IoT equipment, and then collecting an embedded webpage as analysis input through a GET request of HTTP (Hyper Text Transport Protocol); a fusion feature is generated through a deep feature fusion extraction module, and a hard mining cosine triple center loss mechanism is introduced to optimize the fusion feature; in the model training stage, a full-connection neural network is used as a classifier, and features are mapped to corresponding labels; after training is completed, feature representation learned by the framework is analyzed through a clustering algorithm, and similar samples are recognized and clustered; and according to a clustering result, selecting a representative page to query the real Internet of Things equipment, and determining a firmware version through a voting mechanism. The method provided by the invention is obviously superior to the most advanced scheme in the aspect of firmware identification, and the identification accuracy has extremely high superiority.

Description

Technical Field

[0001] The present invention relates to a firmware identification method for an IoT device, and in particular to an online IoT device firmware identification method based on representation learning. Background Art

[0002] In the modern Internet architecture, Internet of Things (IoT) devices play a vital role. However, during product development, manufacturers often focus more on quick time to market rather than comprehensive security, resulting in security risks at the firmware level of IoT devices. As a key indicator reflecting the update status of device software libraries and components, the firmware version is of great significance for assessing the security and potential vulnerability risks of IoT devices. It can reveal whether the device is vulnerable to known vulnerabilities.

[0003] At present, vulnerability analysis of IoT devices mainly relies on two firmware identification techniques. One is to use the information provided by IoT search engines (such as Shodan and Censys), such as vendor, model, and firmware version, to identify and locate potential n-day vulnerabilities. The other is to adopt firmware fingerprinting methods to evaluate the vulnerability of target devices by analyzing their specific characteristics. Both methods highlight the core role of fine-grained identification of firmware versions in vulnerability analysis. However, there are several shortcomings in existing firmware version identification methods. First, the data collection of IoT search engines relies on public device information such as service banners and login pages, while firmware version information is usually regarded as sensitive data. Manufacturers may be reluctant to disclose it and may even forge protocol banners to reduce security risks. In addition, the data update frequency of search engines is limited and cannot reflect the latest firmware version of the device in a timely manner, resulting in a high false positive rate. Second, from the perspective of firmware fingerprinting, devices from different manufacturers may use the same hardware or firmware platform, which leads to firmware homogeneity, increases the similarity of firmware fingerprint features, reduces the accuracy of fingerprint recognition, and thus increases the false negative rate. In addition, the scheme based on firmware fingerprinting requires a large amount of data packet detection and verification, which not only increases the burden of analysis work but also increases the cost. Therefore, the two existing firmware identification schemes are no longer sufficient to cope with the increasingly complex and diverse firmware environment, and it becomes difficult to obtain the latest version for research.

[0004] In summary, the defects of the existing technology mainly include: relying on search engine data with limited update frequency, insufficient data integrity and accuracy, firmware identification is susceptible to manipulation and outdated data; firmware homogeneity leads to reduced fingerprint recognition accuracy; firmware fingerprint schemes cannot effectively distinguish subtle differences between versions, and the recognition granularity is too coarse, etc. These defects show that there is an urgent need to develop more accurate and efficient firmware version identification technology to improve the accuracy and reliability of IoT device security assessment. Summary of the invention

[0005] Aiming at the problem that existing firmware identification schemes are not sufficient to cope with the increasingly complex and diverse firmware environment, making it difficult to obtain device firmware, the present invention provides an online IoT device firmware identification method based on representation learning.

[0006] The present invention is implemented by adopting the following technical scheme: an online IoT device firmware identification method based on representation learning, the method is based on an online IoT device firmware identification framework, the online IoT device firmware identification framework includes a deep feature fusion extraction module, a hard mining triple representation learning module and a classification and clustering analysis module, the method workflow includes: firstly simulating the firmware of the target IoT device to obtain its running state, and then collecting embedded web pages as analysis inputs through HTTP GET requests; then generating fusion features through the deep feature fusion extraction module, and deeply mining the semantic features of the web pages; at the same time, the hard mining triple representation learning module introduces a hard mining cosine triple center loss mechanism to optimize the fusion features, enhance the intra-class compactness and inter-class separability, so as to learn more robust feature representations; in the model training stage, the classification and clustering analysis module uses a fully connected neural network with a softmax activation function as a classifier, maps features to corresponding labels, and trains the classification ability of the model; after the training is completed, the feature representation learned by the clustering algorithm analysis framework is used to identify and cluster similar samples; according to the clustering results, representative pages are selected to query real IoT devices, and the firmware version is determined through a voting mechanism.

[0007] In the above-mentioned online IoT device firmware identification method based on representation learning, the deep feature fusion extraction module includes a fusion feature attention network, and the fusion feature attention network includes a word embedding extraction module, a multi-scale convolution and pooling module, and an attention state fusion mechanism;

[0008] The word embedding extraction module includes a static word embedding model to generate word embedding vectors for embedded web pages, and then organize the word embedding vectors into a word embedding matrix; in the multi-scale convolution and pooling module, firstly, the multi-core convolution operation on the word embedding matrix is ​​implemented, and then the adaptive maximum pooling strategy is selected in the pooling module, which can automatically adjust the pooling parameters to adapt to the variable length input and retain important features; finally, the features of different scales are connected to form a comprehensive feature representation vector E(x i ), which is used for the subsequent attention state fusion mechanism; the attention state fusion mechanism is used to improve the distinction accuracy. First, according to the feature representation vector E(x i ) Define the query Q, key K and value V in the self-attention mechanism: Q = W q E(x i ),K=W kE(x i ),V=W v E(x i ); Then, the attention weight A w and output A o Defined as: A o =A w V, where d k is the dimension of the key vector, and then the state update mechanism is used to capture all the information encountered by the model before the current time step. Specifically, the state of the k-1th step is defined as: State k-1 =σ(W1·concat(E(x i ),A o )), and then use the self-attention weight to update the state of step k: State k =State k-1 +σ(W2·(A w *State k-1 )); where k represents the current time step, σ represents the ReLU activation function, W1 and W2 are the weight matrices of the linear transformation, and the last updated state of the attention state fusion mechanism is the fusion feature finally output by the deep feature fusion extraction module.

[0009] The above-mentioned online IoT device firmware identification method based on representation learning, the calculation formula of the hard mining cosine triple center loss mechanism is: Where f(·) represents the fusion feature output by the deep feature fusion extraction module, Indicates i embedded given anchor web page, Indicates i web pages of the same type as the given anchor web page, Indicates i embedded given anchor web pages of the same and different categories, sm(·) is the softmax function, m is the boundary parameter, represents the class center of the anchor webpage in each batch, [·] + means that only non-negative values ​​are considered, D(·) represents the square of the Euclidean distance function, and λ reg is the regularization parameter, the function S(·) represents the cosine similarity, and N is the total number of web pages.

[0010] The above-mentioned online IoT device firmware recognition method based on representation learning uses a fully connected neural network with a softmax function as a classifier when optimizing feature representation using the hard mining cosine triplet center loss mechanism. The loss function of the classifier adopts the cross entropy loss function L cls , defined as: Where C is the number of categories, yi is the true label, p i is the predicted probability of the i-th category output by the softmax layer, and the total loss is calculated as: L total =L cls +λ hctc ·L HCTC , where λ hctc is a balancing hyperparameter;

[0011] The specific process of cluster analysis is as follows: first, the framework is used to generate a fused feature representation of each embedded web page in different versions of each device model; then, a clustering algorithm is applied to the extracted fused feature vector to group similar pages into the same cluster; finally, in order to quantify the effectiveness of clustering, two evaluation indicators are calculated: the silhouette coefficient and the Davis-Bourdin index; a comprehensive score is obtained by dividing the silhouette coefficient by the Davis-Bourdin index, and the higher the score, the stronger the page distinction ability; through this cluster analysis, the most representative n pages are identified so that these pages can be applied in real-world scenarios to accurately identify and verify the firmware version information.

[0012] This paper proposes a firmware version identification framework for IoT devices called DeepFW (Deep Learning for Firmware Identification). This framework introduces deep learning technology into the field of firmware identification for the first time. Compared with other technologies, it has the following significant advantages and effects:

[0013] 1. Accurately identify the firmware of online IoT devices. The firmware version of the device is identified by extracting subtle differences in the file system of the firmware image, surpassing the performance of existing firmware fingerprint recognition technology in terms of accuracy and efficiency. The ROC curve on the test firmware dataset shows that the DeepFW framework has a strong advantage in the accuracy of firmware version recognition.

[0014] 2. Enhanced the ability to handle the problem of firmware homogeneity in the supply chain and obtain more robust feature representations. By applying the fused feature attention network (FFAN), the framework achieves adaptive learning of feature weights, which can capture and amplify subtle differences in web page reuse and obtain more discernible text embedding representations. In addition, the introduction of the hard mining cosine triple center loss (HCTCL) achieves intra-class compactness and inter-class separability between versions, enhancing the learning of robust feature representations.

[0015] 3. Improved the efficiency of firmware identification. DeepFW uses clustering score evaluation to filter out the most representative page of each model to identify and verify IoT devices, instead of scanning all web pages in the device firmware by default. This greatly improves the recognition efficiency of real devices. Even by only obtaining a single page (such as the login page), the present invention can accurately distinguish most firmware versions in the data set. This feature shows that the present invention provides significant advantages in device vulnerability analysis and security management.

[0016] 4. The model has good generalization ability. In terms of the generalization ability of the model, the present invention can resist device page noise from real environments (such as slight changes in HTML structure, dynamic content and CSS style differences, etc.). Tests conducted on real-world data sets show that the present invention can achieve extremely high firmware recognition accuracy.

[0017] In the experiment, DeepFW significantly outperformed the most advanced existing solutions in firmware identification. The present invention collected 4,442 firmware images and obtained 130,445 valid embedded web interface files as test data. It can be seen that the firmware identification accuracy of the DeepFW framework is extremely superior and can significantly enhance the discrimination of features extracted from web files. At the same time, the generalization test was carried out to verify the effectiveness of the present invention in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a system overview diagram.

[0019] Figure 2 This is the FFAN framework diagram. DETAILED DESCRIPTION

[0020] The present invention proposes an online IoT device firmware identification framework named DeepFW. The framework uses Feature Fusion Attention Network (FFAN) to perform deep fusion feature extraction on embedded pages, and uses Hard Mining Cosine Triplet-Center Loss (HCTCL) to optimize the intra-class and inter-class distances of feature vectors to learn more robust feature representations. Specifically, the firmware is first simulated; once the firmware simulation is successful, the embedded web pages are collected as input using HTTP GET requests. Next, the Static Word Embedding Model (SEM) in the FFAN framework is used to generate word embedding matrices for the embedded web pages and further capture feature differences. At the same time, HCTCL is used to constrain features to enhance the robustness of representation learning. During the training process, the present invention uses a fully connected neural network with a softmax function as a classifier to map feature representations to labels. Finally, a clustering algorithm is applied to analyze the samples after representation learning using DeepFW. By evaluating the clustering results, representative pages are selected to query real IoT devices, and a voting mechanism is used to determine their firmware versions. The present invention is described in detail below with reference to the accompanying drawings.

[0021] The present invention comprises three main modules: a deep feature fusion extraction module, a hard mining triple representation learning module, and a classification and clustering analysis module. Figure 1 An overview of the system design is presented.

[0022] 1. The deep feature fusion extraction module mainly includes the Fusion Feature Attention Network (FFAN), which is used to extract fine-grained features of embedded web pages and learn effective feature representations, such as Figure 2 As shown in Figure 2, FFAN mainly consists of the following modules: word embedding extraction, multi-scale convolution and pooling, and attention state fusion mechanism.

[0023] (1) The word embedding extraction module mainly includes static word embedding models (SEM), such as FastText and GloVe, to generate word embedding vectors for web page texts. These word embedding vectors are then organized into a word embedding matrix of size D×B×S, where D is the dimension of the word embedding vector, S is the maximum sequence length, and each text is divided into B blocks of length S.

[0024] (2) In the multi-scale convolution and pooling module, we first implemented the multi-core convolution operation on the word embedding matrix generated by SEM. Specifically, we used two-dimensional convolutional neural networks (2D-CNNs) with convolution kernels of different sizes to capture local context features and multi-scale information by sliding the convolution kernels in the sequence dimension. Secondly, we selected an adaptive maximum pooling strategy in the pooling module, which can automatically adjust the pooling parameters to adapt to variable-length inputs and retain important features. Finally, we connected the features of different scales to form a comprehensive feature representation vector E(x i ), which is used in the subsequent attention state fusion mechanism.

[0025] (3) The attention state fusion mechanism is mainly used to improve the accuracy of discrimination. The device firmware of different manufacturers has significant differences in implementation methods and technology stacks, resulting in considerable heterogeneity in embedded web pages of different firmware. However, firmware version updates usually only involve bug fixes or minor changes, and the differences between version iterations are subtle (for example, only a few words have been changed). Therefore, for web page texts with high similarity, not only fine-grained feature extraction is required, but also effective integration of global and local features. To address these problems, the state update mechanism is integrated into the self-attention mechanism. This new mechanism combines the outputs of the convolutional layer and the attention layer to generate a new state representation. Therefore, the enhanced self-attention mechanism not only captures global dependencies, but also uses the generated attention weights to update features in a weighted manner. The specific implementation process is as follows:

[0026] First, according to the feature representation vector E(x i ) Define the query Q, key K and value V in the self-attention mechanism: Q = W q E(x i ),K=W k E(x i ),V=W v E(x i ), W q , W k , W v are learnable parameters.

[0027] Next, the attention weight A w and output A o Defined as: A o =A w ·V. Where d k is the dimension of the key vector, used as a scaling factor to prevent weight concentration and vanishing gradients.

[0028] Then, the state update mechanism is used to capture all the information encountered by the model before the current time step, and each step is dynamically updated to ensure information aggregation. Specifically, the state of the k-1th step is defined as: State k-1 =σ(W1·concat(E(x i ),A o )), and then use the self-attention weight to update the state of step k: State k =State k-1 +σ(W2·(A w *State k-1 )); where k represents the current time step, σ represents the ReLU activation function, and W1 and W2 are weight matrices of linear transformation. It can be seen that the fusion of self-attention and state update mechanism ensures that the model can extract important features and details of web page text while dynamically fusing local and global features, and capture more comprehensive and rich semantic information from the input sequence. The state updated by the attention state fusion mechanism module is the fusion feature finally output by the deep feature fusion extraction module.

[0029] 2. The hard mining triplet representation learning module uses a new hard mining cosine triplet center loss (HardMining Cosine Triplet-Center Loss, HCTCL) to solve the intra-class compactness problem while maintaining the inter-class separation of samples, which helps to increase the inter-class sample discrimination and reduce training time. When using only softmax loss for network training and optimization, the similarity of embedded web pages with the same name causes different versions of the same vendor to overlap in the feature space, while the feature distribution within the same version is relatively dispersed. In addition, the web pages in the actual device may have slight changes compared to the web pages in the simulation environment. It is difficult to enhance the robustness of the model to these slight changes using only softmax loss. Inspired by triplet loss and center loss, the present invention proposes this new loss HCTCL. The following is an introduction and comparative analysis of these three losses.

[0030] (1) Center loss. This loss achieves intra-class compactness by learning a center for each class in the feature space and minimizing the Euclidean distance between the sample feature and the corresponding class center. Specifically, the present invention defines the center loss as: Where f(·) represents the fusion feature output by the deep feature fusion extraction module, D(·) represents the square of the Euclidean distance function, and x i represents the i-th embedded web page, Indicates the category y to which the i-th embedded web page belongs iThe center point of , N is the total number of web pages. It can be seen that the center loss only considers the intra-class distance and ignores the inter-class distance. If their centers are close, the center loss is easily affected by noise and category overlap.

[0031] (2) Triplet loss. This loss enhances the recognition ability of the model by ensuring that the distance between similar samples is smaller than the distance between dissimilar samples. Specifically, the triplet loss consists of three components: anchor points, positive samples, and negative samples. The triplet loss function can be defined as: Where f(·) represents the fusion feature output by the deep feature fusion extraction module, D(·) represents the square of the Euclidean distance function, represents the i-th embedded given anchor web page, Indicates i web pages of the same type as the given anchor web page, Indicates i embedded given anchor web pages of the same or different categories, [·] + Indicates that only non-negative values ​​are considered, N represents the number of triplets in the training set, and m is a hyperparameter called margin, which ensures that the distance difference between positive and negative samples is greater than m. The triplet loss focuses on the distance difference between positive and negative samples and cannot guarantee intra-class compactness.

[0032] (3) Hard Mining Cosine Triplet-Center Loss (HCTCL). In order to improve both intra-class compactness and inter-class separation, the center loss and triplet loss are used to jointly supervise the training and optimization of the model. However, the different optimization directions of these losses require balancing their emphasis to resolve conflicts. To address these challenges, the class center of the anchor sample is first calculated, and then the negative sample closest to the anchor in cosine distance is selected to form a new triplet. By controlling the distance between the anchor and its center to be smaller than the distance between the anchor and its nearest negative sample, the distance of the feature can be adjusted more accurately. The calculation formula is: Where f(·) represents the fusion feature output by the deep feature fusion extraction module, sm(·) is the softmax function, and m is the boundary parameter. represents the class center of the anchor webpage in each batch, [·] + means that only non-negative values ​​are considered, D(·) represents the square of the Euclidean distance function, and λ reg is the regularization parameter, and the function S(·) represents the cosine similarity.

[0033] In the fine-grained text classification task, the cosine distance can better measure the similarity of text content. HCTCIn this paper, the cosine distance is used instead of the Euclidean distance used in the traditional triple loss. In addition, the softmax function is used to mine negative samples instead of a simple maximum value operation, which helps to smooth the gradient changes and improve the stability of the gradient descent algorithm. In order to solve the problem of significant drift of class centers during small batch training, the present invention introduces a regularization term To constrain the class center, the model can dynamically adapt to changes in sample distribution.

[0034] 3. Classification and cluster analysis

[0035] (1) Use Softmax loss to train the classification model. HCTCL aims to apply metric learning directly to the learned feature representation, while softmax loss maps samples to a class-separable space. Therefore, when using HCTCL to optimize feature representation, a fully connected neural network with a softmax function is used as the classifier. The loss function of the classifier adopts the cross entropy loss function L cls , defined as: Where C is the number of categories, y i is the true label, p i is the predicted probability of the i-th class output by the softmax layer. The total loss is calculated as: L total =L cls +λ hctc ·L HCTC . Where λ hctc is a balancing hyperparameter.

[0036] (2) Cluster analysis. First, DeepFW is used to generate feature representations for each embedded web page in different versions of each device model. Next, a clustering algorithm is applied to the extracted feature vectors to group similar pages into the same cluster. Finally, to quantify the effectiveness of clustering, two evaluation metrics are calculated: the silhouette coefficient and the Davis-Bourdin index. A comprehensive score is obtained by dividing the silhouette coefficient by the Davis-Bourdin index, where a higher score indicates a stronger ability to distinguish pages. Through this cluster analysis, the most representative n pages can be identified so that these pages can be applied in real-world scenarios to accurately identify and verify the firmware version information.

[0037] 4. Training and Optimization

[0038] The DeepFW framework is trained and optimized using HCTCL and softmax loss. Given M samples, the loss function L HCTC It can be expressed as the loss L of each sample i The sum of L i The calculation formula is: In the formula Indicated as S a,- , Expressed as [·] + Indicates a non-negative value. Expressed as Category Center Expressed as The softmax function is denoted as φ. Assume that there exists a function δ(·) such that when L i > 0, output 1, otherwise output 0. Therefore, the derivation process of the gradient can be expressed as:

[0039]

[0040] In summary, the present invention provides a method for identifying the firmware version of an IoT device, and its workflow includes: firstly simulating the firmware of the target IoT device to obtain its running status, and then collecting embedded web pages as analysis inputs through HTTP GET requests; then generating a word embedding matrix through a static word embedding model (SEM) to deeply mine the semantic features of the web pages; introducing a hard mining cosine triple center loss (HCTCL) mechanism to optimize the feature vector, enhance the intra-class compactness and inter-class separability, and learn a more robust feature representation; in the model training stage, a fully connected neural network with a softmax activation function is used as a classifier to map the features to the corresponding labels to train the classification ability of the model; after the training is completed, a clustering algorithm is used to analyze the feature representation learned by the DeepFW framework, identify and cluster similar samples; based on the clustering results, a representative page is selected to query the real IoT device, and the firmware version is determined through a voting mechanism. This method can effectively identify and distinguish the firmware versions in IoT devices, significantly improve the security of firmware management, and provide an efficient means for device security assessment and vulnerability management.

Claims

1. An online IoT device firmware identification method based on representation learning, characterized in that: The method is based on the online IoT device firmware identification framework, which includes a deep feature fusion extraction module, a hard mining triple representation learning module and a classification and clustering analysis module. The workflow of the method includes: first, simulating the firmware of the target IoT device to obtain its running status, and then collecting embedded web pages as analysis inputs through HTTP GET requests; then generating fusion features through the deep feature fusion extraction module to deeply mine the semantic features of the web pages; at the same time, the hard mining triple representation learning module introduces the hard mining cosine triple center loss mechanism to optimize the fusion features, enhance the intra-class compactness and inter-class separability, so as to learn more robust feature representations; in the model training stage, the classification and clustering analysis module uses a fully connected neural network with a softmax activation function as a classifier to map features to corresponding labels and train the classification ability of the model; after training, the feature representation learned by the clustering algorithm analysis framework is used to identify and cluster similar samples; based on the clustering results, representative pages are selected to query real IoT devices, and the firmware version is determined through a voting mechanism.

2. According to claim 1, a method for online IoT device firmware identification based on representation learning is characterized in that: The deep feature fusion extraction module includes a fusion feature attention network, which includes a word embedding extraction module, a multi-scale convolution and pooling module, and an attention state fusion mechanism; The word embedding extraction module includes a static word embedding model to generate word embedding vectors for embedded web pages, and then organize the word embedding vectors into a word embedding matrix; in the multi-scale convolution and pooling module, firstly, the multi-core convolution operation on the word embedding matrix is ​​implemented, and then the adaptive maximum pooling strategy is selected in the pooling module, which can automatically adjust the pooling parameters to adapt to the variable length input and retain important features; finally, the features of different scales are connected to form a comprehensive feature representation vector E(x i ), which is used for the subsequent attention state fusion mechanism; the attention state fusion mechanism is used to improve the distinction accuracy. First, according to the feature representation vector E(x i ) Define the query Q, key K and value V in the self-attention mechanism: Q=W q E(x i ),K=W k E(x i ),V=W v E(x i ); Then, the attention weight A w and output A o Defined as: where d k is the dimension of the key vector, and then the state update mechanism is used to capture all the information encountered by the model before the current time step. Specifically, the state of the k-1th step is defined as: State k-1 =σ(W1·concat(E(x i ),A o )), and then use the self-attention weight to update the state of step k: State k =State k-1 +σ(W2·(A w *State k-1 )); where k represents the current time step, σ represents the ReLU activation function, W1 and W2 are the weight matrices of the linear transformation, and the last updated state of the attention state fusion mechanism is the fusion feature finally output by the deep feature fusion extraction module.

3. According to claim 2, a method for online IoT device firmware identification based on representation learning is characterized in that: The calculation formula of the hard mining cosine triple center loss mechanism is: Where f(·) represents the fusion feature output by the deep feature fusion extraction module, Indicates i embedded given anchor web page, Indicates i web pages of the same type as the given anchor web page, Indicates i embedded given anchor web pages of the same and different categories, sm(·) is the softmax function, m is the boundary parameter, represents the class center of the anchor webpage in each batch, [·] + means that only non-negative values ​​are considered, D(·) represents the square of the Euclidean distance function, and λ reg is the regularization parameter, the function S(·) represents the cosine similarity, and N is the total number of web pages.

4. The method for online IoT device firmware identification based on representation learning according to claim 3 is characterized in that: When optimizing feature representation using the hard mining cosine triplet center loss mechanism, a fully connected neural network with a softmax function is used as the classifier, and the loss function of the classifier adopts the cross entropy loss function L cls , defined as: Where C is the number of categories, y i is the true label, p i is the predicted probability of the i-th category output by the softmax layer, and the total loss is calculated as: L total =L cls +λ hctc ·L HCTC , where λ hctc is a balancing hyperparameter; The specific process of cluster analysis is as follows: first, the framework is used to generate a fused feature representation of each embedded web page in different versions of each device model; then, a clustering algorithm is applied to the extracted fused feature vector to group similar pages into the same cluster; finally, in order to quantify the effectiveness of clustering, two evaluation indicators are calculated: the silhouette coefficient and the Davis-Bourdin index; a comprehensive score is obtained by dividing the silhouette coefficient by the Davis-Bourdin index, and the higher the score, the stronger the page distinction ability; through this cluster analysis, the most representative n pages are identified so that these pages can be applied in real-world scenarios to accurately identify and verify the firmware version information.

Images