Firmware homologous vulnerability mining method and system based on multi-dimensional feature portrait

Abstract

The invention provides a firmware homologous vulnerability mining method and system based on multi-dimensional feature portray.The firmware homologous vulnerability mining method and system based on the multi-dimensional feature portray.The firmware homologous vulnerability mining method includes the steps that S1, a firmware set to be detected and a firmware set with known vulnerabilities are obtained, and firmware samples are formatted and preprocessed; s2, performing multi-dimensional feature portrait extraction on the preprocessed to-be-detected firmware set and the known vulnerability firmware set to form a standardized five-dimensional feature portrait; s3, based on the five-dimensional feature portrait, performing multi-semantic firmware similarity calculation on the known vulnerability firmware and the to-be-detected firmware by adopting multiple algorithms to obtain a global similarity score; and S4, based on the global similarity score, analyzing and screening out a to-be-detected high-risk firmware sample, automatically generating a vulnerability verification task, performing basic environment configuration, task distribution and multi-node parallel verification, and outputting a vulnerability verification result. According to the method, the full-process closed loop of automatic processing of firmware, deep feature mining, similarity quantitative analysis and vulnerability verification is realized.

Description

Technical Field

[0001] The present invention belongs to the field of computers, and particularly relates to a method and system for firmware homologous vulnerability mining based on multi-dimensional feature portraits. Background Art

[0002] With the rapid popularization of Internet of Things devices and embedded systems in various fields, the firmware security problem has become increasingly severe. As a key bridge connecting hardware and software, security defects in firmware may be exploited by attackers to achieve remote control of devices, data theft, or even cause serious physical security accidents. Currently, automated firmware vulnerability mining and verification technologies have become an important direction in security research. However, existing technologies mainly rely on manual analysis, feature matching, or single tools, and it is difficult to cope with the diversity, homology, and vulnerability migration challenges of firmware in real-world scenarios.

[0003] Specifically, the traditional vulnerability mining methods have the following significant problems: First, manual auditing consumes a large amount of professional manpower and is difficult to cope with the rapidly growing firmware scale; second, fuzz testing is limited by the complexity of the firmware environment and is difficult to implement; in addition, dynamic analysis often cannot adapt to diverse and specialized firmware operating environments. More prominently, existing methods fail to effectively utilize known vulnerability information, making it difficult to achieve rapid migration and verification of vulnerabilities across firmware versions and different manufacturers, resulting in a relatively high proportion of repetitive labor in vulnerability analysis.

[0004] It is worth noting that due to the widespread code reuse and version evolution relationships between firmware of different versions and manufacturers, how to efficiently migrate and verify vulnerabilities has become a core problem to be solved urgently. Therefore, there is an urgent need for a new method that can make full use of the homologous characteristics of firmware and achieve automated vulnerability migration and verification to effectively improve the efficiency and accuracy of vulnerability mining. Summary of the Invention

[0005] To solve the above technical problems, the present invention provides a method for firmware homologous vulnerability mining based on multi-dimensional feature portraits, including the following steps:

[0006] Step S1: Obtain the firmware set to be detected and the firmware set with known vulnerabilities, and perform formatting, preprocessing, and standardized storage on the firmware samples;

[0007] Step S2: Input the preprocessed firmware set to be detected and the firmware set with known vulnerabilities into the firmware multi-dimensional heterogeneous feature portrait extraction module for multi-dimensional feature portrait extraction, specifically including: unpacking signature sequence portrait, vulnerability-sensitive parameter call chain portrait, external communication interface portrait, boundary communication component symbol portrait, and file layout portrait in five dimensions, to form a set of standardized five-dimensional feature portraits;

[0008] Step S3: Based on the five-dimensional feature portrait, use multiple algorithms to calculate the multi-semantic firmware similarity between known vulnerable firmware and the firmware to be detected, and obtain the global similarity score through weighted fusion;

[0009] Step S4: Based on the global similarity score, analyze and screen out the high-risk firmware samples to be detected, automatically generate vulnerability verification tasks, perform basic environment configuration, task distribution, and multi-node parallel verification, and output the vulnerability verification results.

[0010] Beneficial effects:

[0011] 1. By performing multi-dimensional comparison and analysis on the firmware set to be detected and the known vulnerable firmware set, and using technologies such as static analysis, feature extraction, and function call chain analysis, the present invention can efficiently identify high-risk firmware and output preliminary vulnerability matching results. In contrast, traditional methods often rely on a single analysis method, with limited detection coverage and low accuracy.

[0012] 2. Through automatic firmware unpacking and multi-dimensional feature extraction by the firmware multi-dimensional heterogeneous feature vector extraction module, and comprehensive analysis using multiple algorithms such as the Jaccard coefficient, the present invention forms a complete similarity analysis chain, overcoming the problems of single feature extraction and limited similarity calculation methods in the prior art.

[0013] 3. By configuring the basic environment on running node 1 and generating verification tasks on running node 2, the present invention realizes multi-node parallel verification, supports firmware simulation, dynamic permission adjustment, and execution of automated verification scripts, greatly improving the efficiency and accuracy of vulnerability verification. In contrast, traditional verification methods are mostly manual operations and are difficult to achieve large-scale automated verification.

[0014] 4. Through containerized sandbox technology, the present invention realizes the standardized deployment and operation of each analysis module, constructs a complete closed-loop system from firmware parsing, similarity analysis, vulnerability verification to tool evaluation, supports batch processing of large-scale and multi-architecture firmware, significantly improves the scalability, stability, and analysis efficiency of the system, and breaks through the limitations of traditional methods in terms of automation degree and system integration. Brief description of the drawings

[0015] Figure 1 It is a schematic flowchart of a method for mining firmware homologous vulnerabilities based on a multi-dimensional feature portrait according to the present invention;

[0016] Figure 2 It is a schematic structural diagram of the method according to the present invention. Detailed implementation manners

[0017] To make the objectives, technical solutions and advantages of the present invention more clear and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only for explaining the present invention and are not used to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0018] For a better understanding of the following embodiments, the explanations of the terms used are as follows:

[0019] Firmware: Special software used to control hardware operations in embedded devices or Internet of Things devices, usually stored in read-only memories such as ROM and Flash.

[0020] Binary file: An executable file or library file stored in binary format, which requires special tools for analysis.

[0021] Vulnerability: A security defect existing in firmware or software, which may be exploited by attackers.

[0022] Static analysis: A method of discovering security risks by analyzing code or binary structures without running the program.

[0023] Dynamic analysis: A method of discovering security problems by monitoring the behavior of a program (such as system calls, memory access, etc.) when the program is actually running.

[0024] Emulation / Firmware emulation: Using software to simulate a hardware environment so that firmware can run on non-native hardware.

[0025] Container / Docker: A lightweight virtualization technology that packages an application and its dependent environment to ensure consistent operation in different environments. Docker is the mainstream container platform.

[0026] Image: A read-only template used to create container instances, which contains an application and its running environment.

[0027] Running node: In an automated analysis or verification process, an automated work unit or process responsible for executing specific tasks.

[0028] Automatic scheduling system: A system component that automatically allocates and manages analysis tasks and computing resources.

[0029] JSON: A lightweight data interchange format.

[0030] Function call chain / Call graph: A structured representation that describes the call relationships between functions in a program.

[0031] Hash / Signature: Converting data into a unique short string through an algorithm, which is used for comparison and duplicate checking.

[0032] Feature Code / Feature Extraction: Extract representative structural, content, or behavioral information from binary files or firmware.

[0033] Feature Vector: Use a set of numerical values to represent the multi-dimensional features of an object (such as firmware, file).

[0034] Feature Space: The multi-dimensional space of all possible values of feature vectors.

[0035] Feature Fusion / Feature Normalization / Feature Concatenation / Feature Encoding / Feature Aggregation: Multiple feature processing and combination methods used to unify, standardize, and enhance the feature expression ability.

[0036] n-gram: Divide a sequence into consecutive subsequences of length n for pattern modeling.

[0037] Jaccard Coefficient / Algorithm: An index to measure the similarity between two sets, where a higher value indicates greater similarity.

[0038] Edit Distance: The minimum number of operations required to transform one sequence into another.

[0039] ssdeep Fuzzy Hashing: A fuzzy hashing algorithm used to detect structural similarities between files.

[0040] Behavior Baseline Monitoring / Behavior Analysis: Monitor the behavioral characteristics of a system or program during operation to determine anomalies or attacks.

[0041] Sandbox: An isolated operating environment used to safely execute and analyze programs.

[0042] Regular Expression: An expression used to describe string matching rules.

[0043] Information Entropy / Shannon Entropy: A statistic to measure the uniformity of information distribution.

[0044] Natural Number Space / Real Number Space: The set of all natural numbers / real numbers in mathematics, often used to describe the value range of feature vectors.

[0045] Normalization: Standardize numerical values with different dimensions or ranges to a unified interval.

[0046] Similarity Matrix / Alignment Matrix: Use a two-dimensional table to record the similarity scores between different objects.

[0047] Control Sample: A firmware sample with known vulnerability conditions, used to evaluate the accuracy of tools.

[0048] Vulnerability Propagation / Migration: The phenomenon of reuse and spread of the same vulnerability among different firmwares, versions, or manufacturers.

[0049] Priority Sorting: Sort the order of vulnerability repairs according to factors such as the severity of the vulnerability.

[0050] Multi-modal / multi-dimensional fusion: Joint analysis of various different types or sources of features and data.

[0051] Taint analysis: A technique for tracing how untrusted inputs (such as user inputs) in a program affect program execution.

[0052] Maximum matching: Finding the maximum number of pairing relationships in a set or graph.

[0053] Top-k / Top-n: Selecting the top k / n elements.

[0054] Weighted average / weighted fusion: Different features or scores are combined according to weights to obtain a comprehensive result.

[0055] Normalized Euclidean distance / cosine similarity: Commonly used methods for measuring the distance or similarity between vectors.

[0056] Multi-node parallel / distributed verification: Multiple computing nodes cooperate and process tasks simultaneously.

[0057] Containerization / automated closed-loop: Using container technology to implement a fully automated, standardized, and traceable system architecture.

[0058] Embodiment 1

[0059] As Figure 1 shown, a firmware homologous vulnerability mining method based on multi-dimensional feature portraits provided by an embodiment of the present invention includes the following steps:

[0060] Step S1: Obtain the firmware set to be detected and the firmware set with known vulnerabilities, and format, preprocess, and store the firmware samples in a standardized manner;

[0061] Step S2: Input the preprocessed firmware set to be detected and the firmware set with known vulnerabilities into the firmware multi-dimensional heterogeneous feature portrait extraction module for multi-dimensional feature portrait extraction, specifically including: unpacking signature sequence portraits, vulnerability-sensitive parameter call chain portraits, external communication interface portraits, boundary communication component symbol portraits, and file layout portraits in five dimensions, forming a set of standardized five-dimensional feature portraits;

[0062] Step S3: Based on the five-dimensional feature portraits, use various algorithms to calculate the multi-semantic firmware similarity between the firmware with known vulnerabilities and the firmware to be detected, and obtain the global similarity score through weighted fusion;

[0063] Step S4: Based on the global similarity score, analyze and screen out the high-risk firmware samples to be detected, automatically generate vulnerability verification tasks, perform basic environment configuration, task distribution, and multi-node parallel verification, and output the vulnerability verification results.

[0064] Existing firmware vulnerability mining methods mostly rely on traditional technical routes such as signature matching or taint analysis. These methods not only have a high dependence on manual work but also have obvious deficiencies in detection efficiency and accuracy. Different from this, the present invention systematically extracts five-dimensional features of the unpacking signature sequence portrait, vulnerability-sensitive parameter call chain portrait, external communication interface portrait, boundary communication component symbol portrait, and file layout portrait of the firmware, realizing a comprehensive characterization of the deep structure and behavior of the firmware. On this basis, the present invention further introduces the use of multiple similarity modeling algorithms to perform fusion analysis on the five-dimensional features, fully mining the homology and code reuse relationships between firmwares, thereby significantly improving the automation level and accuracy of vulnerability detection. In addition, for cross-architecture and diverse firmware scenarios, the present invention effectively breaks through the bottlenecks in feature mapping and model generalization of traditional methods through standardized feature vectors and multi-dimensional similarity metrics, realizing efficient and accurate vulnerability migration detection and verification.

[0065] In one embodiment, the above step S1: Obtain the firmware set to be detected and the firmware set with known vulnerabilities, and perform formatting, preprocessing, and standardized storage on the firmware samples;

[0066] First, perform data collection, formatting, and preprocessing on the firmware to be detected and the firmware with known vulnerabilities, and construct a standardized firmware analysis data set, laying a foundation for subsequent feature extraction and comparison analysis.

[0067] In one embodiment, the above step S2: Input the preprocessed firmware set to be detected and the firmware set with known vulnerabilities into the firmware vulnerability existence analysis module for multi-dimensional feature portrait extraction, specifically including: five dimensions of unpacking signature sequence portrait, vulnerability-sensitive parameter call chain portrait, external communication interface portrait, boundary communication component symbol portrait, and file layout portrait, forming a set of standardized five-dimensional feature portraits, specifically including:

[0068] Step S21: Use a recursive unpacking algorithm to hierarchically parse the firmware image, extract embedded binary components, calculate multi-dimensional hash values, and construct unpacking signature sequence portrait features Specifically including:

[0069] Embedded firmware usually encapsulates multiple structural content segments in an aggregated or compressed format, such as file system images, kernel images, initialization scripts, configuration segments, or key storage areas, etc. Different from traditional operating system images, the nesting relationship and encapsulation order of embedded firmware have a high degree of implementation differences, bringing significant challenges to structural analysis and content reuse detection.

[0070] To this end, the present invention proposes to unpack the signature sequence image for extracting the semantic behavior trajectory during the structural unfolding process from the firmware image to model its nested pattern and component organization characteristics. Specifically, the present invention regards the firmware as a linear byte stream, identifies the structural boundaries of the nested components through a semantic signature matching mechanism, and symbolically encodes their occurrence order, thereby constructing a discrete structural trajectory sequence representing the unpacking behavior. This sequence depicts the logical deconstruction path of the firmware in a stable manner and can provide comparable structural behavior representations across samples without relying on file system mounting or complete parsing.

[0071] To make this structural trajectory computable and operable, the present invention further introduces formal modeling and constructs it into a nested behavior representation that can be vectorized in the structural feature space. This process is divided into the following three steps:

[0072] Step S211: Structural signature trajectory extraction: Given a firmware image F, identify the nested structural components it contains through a structure matching process, and assign a unique semantic signature identifier to each piece of structural content. The extracted signatures are arranged in the order of their appearance in the byte stream to form a structural signature sequence: ; where represents a finite set of structural signature symbols, and each symbol corresponds to an identified nested structure (such as a compressed container, file system, kernel segment, certificate data, path identifier, etc.). This sequence can be regarded as the structural behavior trajectory of the firmware during the logical unpacking process, reflecting its content nesting order and organizational characteristics. Since this process does not depend on file system mounting or complete extraction, it has good adaptability and universality and is applicable to firmware samples under various architectures and packaging formats;

[0073] Step S212: Structural behavior abstraction: To enhance the expressive power of the trajectory sequence and the semantic alignment ability across firmwares, the sequence of each firmware is abstracted into a structural behavior path representing the sequence of structural states experienced by the nested components during the deconstruction process. Each corresponds to an explicit unpacking behavior, and its combination pattern can reveal the packaging strategy, module division, or distribution template adopted by the firmware during the construction process. This abstraction process does not care about the actual offset or size of the components in the physical space but focuses on the stability and commonality of their behavior order, nesting level, and semantic pattern, providing a structural basis for subsequent firmware structure clustering, template attribution judgment, and behavior reuse analysis.

[0074] Step S213: Sequence pattern modeling and vectorization: To convert the structural behavior representation into a computable feature vector, perform n-gram modeling on the sequence and construct all its subsequences of length Subsequence pattern set: , where represents all consecutive local structure fragments of length extracted from the structure trajectory; frequency statistics are performed on this set to generate a vectorized representation of the n-gram pattern: , where represents the number of occurrences of the th pattern in , and is the dimension of the feature space. Finally, the vector constitutes the structural representation of the firmware in this dimension and can be used for subsequent similarity measurement and cross-sample clustering analysis;

[0075] Step S22: Based on the taint analysis technique, trace the propagation path of sensitive parameters during program execution and construct the portrait features of the vulnerability-sensitive parameter call chain ;

[0076] The communication parameters in the embedded firmware, as the core control entry for function triggering and protocol scheduling, their propagation paths in the program constitute the key channels of potential vulnerability trigger chains. When parameters are passed into processing logic that is not fully verified, especially sensitive functions involving memory copying or command concatenation, it is extremely easy to cause serious vulnerabilities such as buffer overflows or command injections. Therefore, from the perspective of vulnerability propagation, the present invention proposes a vulnerability-sensitive parameter call chain portrait for statically modeling the function-level propagation paths associated with communication parameters and capturing their sensitive interaction behaviors within the boundary program. This portrait focuses on the parameter propagation paths triggered by sensitive functions in the boundary binary program and constructs a structured call chain set through a three-stage modeling process, namely: parameter perception chain extraction, address normalization and path reconstruction, and path sampling and sequence modeling. This portrait provides a unified structural basis for vulnerability context reconstruction, cross-sample propagation chain comparison, and semantic path alignment;

[0077] Step S221: Parameter perception chain extraction: First, identify the set of sensitive functions involved in typical vulnerability patterns (such as strcpy, system, memcpy, snprintf, etc.) in each Top-n boundary binary program as potential vulnerability trigger points. Subsequently, use the static taint analysis method to reverse-trace the input parameter sources of these sensitive functions and extract all subsets of communication parameters that have a dependency relationship with them, denoted as:

[0078] ;

[0079] where is the number of sensitive parameters extracted; each in Represents the parameter name that appears at least once in the propagation path of the sensitive function. For each , further trace its propagation path and construct the set of its function-level call chains:

[0080] ;

[0081] Among them, each path represents a call chain from the parameter input point to the sensitive function, in the form of a function sequence:

[0082] ;

[0083] Each function node in the path may contain original information such as function names and disassembly addresses, representing the specific process of parameter passing and function dependencies. The set of paths constructed in this stage covers all observable propagation path branches;

[0084] Step S222: Address normalization and path reconstruction: Since different firmware samples have differences in compilation configuration, loading address, and symbol recovery, directly using the original paths will cause the sequence structure to lose alignment in cross-sample comparison. To improve the cross-firmware consistency of the call chain structure, the present invention defines a normalization operation , removing all address information and only retaining the function names with semantic expressiveness:

[0085] ;

[0086] ;

[0087] Among them, represents the function symbol extraction function, represents the th original call chain (including address information) in the th firmware sample, which is composed of a sequence of function nodes; is the number of function nodes in the th call chain; represents the normalized function name or placeholder; represents the th function node in this call chain, which may contain the original address, offset, or disassembly location; when the path node is an anonymous address or unsigned instruction location, it is uniformly processed with a placeholder. The processed set of call chains can be represented as:

[0088] ;

[0089] Among them, Denote the total number of original call chains extracted from the k-th firmware; each chain in this set only contains function identifiers, forming a path representation that can be aligned across architectures and samples, laying a consistent foundation for subsequent structural comparison and similarity modeling;

[0090] Step S223: Path Sampling and Sequence Modeling: In actual analysis, the same parameter may trigger a large number of call paths. If directly incorporated into the modeling, it will lead to redundant representation and reduce the comparison efficiency. Therefore, the present invention groups according to the call chain length and retains at most five representative paths in each length category. Let the set of all path lengths that appear be , and the final sampling set is defined as:

[0091] ;

[0092] where represents extracting at most five representative paths from the same type of paths according to the path position or the order of function appearance; represents the target length of the call chain.

[0093] This sampling method significantly reduces the representation redundancy while retaining the path diversity.

[0094] Step S224: Define the vulnerability-sensitive parameter call chain portrait feature of the firmware in the call chain dimension as:

[0095] ;

[0096] Aggregates the normalized propagation paths of all communication parameters, with good structural stability and semantic interpretability. In the subsequent comparison task between firmwares, the present invention uses the edit distance as the call chain similarity metric, supporting various downstream applications such as path structure alignment, propagation chain clustering, and potential vulnerability migration analysis;

[0097] Step S23: Through static analysis techniques, extract interface identifiers, structural hierarchies, configuration parameters, and exposure features to construct the external communication interface portrait feature , specifically including:

[0098] The communication interface in embedded firmware constitutes the core path for interaction between external entities and devices. Its interface path and parameter semantics directly reveal the exposure surface and input control boundaries of system functions. A typical communication interface is the Web communication interface. Unlike traditional software, embedded firmware often lacks interface documentation and source code information. Its communication interface is usually statically distributed in the file system in the form of configuration scripts, HTML forms, or hard-coded strings. To accurately restore the visibility and organizational structure of the communication input surface, this paper proposes a communication interface exposure profile, which is used to extract the external communication paths and their associated parameters in the firmware and model potential functional entry points and attack surface structures. The modeling process of this profile includes the following three stages: interface identifier extraction, interface structure summary modeling, and communication input surface profile representation:

[0099] Step S231: Interface Identifier Extraction: First, a static scan is performed on the unpacked firmware file system, focusing on string constants within HTML pages, CGI paths, shell scripts, and binary programs. Paths such as / cgi-bin / upload_firmware.cgi or boafrm / formUpload represent function triggering entries, while parameter keys such as action and modelName reflect the communication semantic structure. The extracted interface paths and parameter names are defined as follows:

[0100] ;

[0101] ;

[0102] in, Indicates firmware The set of all resolvable interface paths in , is the number of interfaces in the collection, Represents a set of parameter names. The present invention retains the original string representation of the path and parameters without vector embedding or vocabulary indexing to maximize the preservation of their semantic structure and naming consistency.

[0103] Step S232: Interface structure summary modeling: To support compact representation and horizontal comparison of input surface features, we further introduce communication interface structure summary features, statistically analyze the interface structure distribution pattern of each sample, and construct the following five-dimensional statistical feature vector:

[0104] 1) Number of interface paths: , represents the cardinality of the communication path set;

[0105] 2) Number of parameter names: , representing the size of the set of input parameters;

[0106] 3) Average path depth , measuring the structural nesting level of the communication path, is defined as:

[0107] ;

[0108] Among them, is the communication path; is the number of / in

[0109] 4) Path naming prefix entropy : Used to measure whether the paths are concentratedly deployed in a certain type of interface module (such as cgi-bin, boafrm, goform, etc.), defined as the discrete distribution entropy of the path prefix, where is the prefix category is the occurrence probability in the path set. The prefix can be obtained by naming the first-level directory in the interface path:

[0110] ;

[0111] Among them, k is the total number of prefix categories;

[0112] 5) Parameter naming character entropy : Measuring the character diversity of all parameter names, reflecting the consistency and semantic sparsity of naming, is defined as follows:

[0113] ;

[0114] Among them, represents the set of all characters that appear in the parameter name, is the character is the relative frequency of occurrence (counted after concatenating all parameter names into a string);

[0115] The structural summary vector constructed accordingly is defined as:

[0116] ;

[0117] The vector provides an overall description of the firmware communication input surface in dimensions such as scale, nested structure, and naming convention, and is applicable to cross-sample structure clustering and complexity analysis tasks;

[0118] Step S233: Communication input surface portrait representation: Define the external communication interface portrait of the firmware as:

[0119] ;

[0120] Among them, , capture the surface information of the input semantics, provide structural summary features, and the three cooperate to express the content, scope and morphological distribution of the firmware input surface structure. The portrait features of the external communication interface have the following three characteristics. First, it retains the original identifiers and has higher semantic integrity and traceability; second, it supports the expression and alignment of input structures such as new sample interfaces and parameters; third, the structural summary features support multi-granularity analysis tasks and can depict the systematic differences in the scale, depth and normativity of the communication input surface. The portrait features of the external communication interface will be used as an important input for firmware similarity calculation in the follow-up to assist in revealing the input path hierarchy, parameter design style and potential functional clustering relationships;

[0121] Step S24: Analyze the symbol table structure and function call naming convention of the boundary communication component, and construct the symbol portrait features of the boundary communication component ;

[0122] In embedded firmware, the boundary binary program, as the core hub connecting the external communication interface and the internal control logic, undertakes the key tasks of input processing, protocol parsing and system interaction. The function definitions, symbol table structures and recognizable semantic information contained therein directly reflect the external behavior entry and internal function layout of the device. In particular, these programs are often at the forefront of the system execution path, and the characteristics of their symbol exposure not only reveal the functional boundaries between modules, but also constitute the core jump points for vulnerability access paths and attack surface diffusion. To systematically model the structural characteristics of such programs at the symbol level, the present invention proposes a symbol portrait of the boundary communication component, and extracts multi-dimensional information such as its imported functions, exported symbols, reconstructed symbol tables and function signatures through static analysis methods to form a structured semantic representation. This modeling process relies on the path and parameter sets extracted from the aforementioned communication interface portrait, and preferentially selects the top-n boundary programs with the most communication exposure among them , to form the binary set to be analyzed:

[0123] ;

[0124] where n3 is the number of boundary binary programs;

[0125] Subsequently, use a static disassembly analysis tool to parse each one in the set , and extract four core structures in the dimension of symbol exposure: imported function table, exported symbol table, symbol table reconstruction information and recognizable function signature. The overall modeling process consists of the following four stages:

[0126] Step S241: Modeling of the imported function table: From Extract the set of external functions it depends on from the import table, denoted as:

[0127] ;

[0128] This set reflects the library functions or system interfaces that the binary program needs to link during initialization and operation, and has strong behavioral directivity. Record the original function names in this set to support subsequent cross-sample behavior comparison. At the same time, to introduce quantitative features, calculate the number of functions in this set ;

[0129] Among them, represents the th boundary program in the th imported symbol function;

[0130] Step S242: Export symbol table modeling: Extract The set of function interfaces exposed externally, defined as:

[0131] ;

[0132] Among them, represents the th boundary program in the th exported symbol function;

[0133] This set includes function entry points and global symbol names visible to other programs or modules, and is an important basis for analyzing component interactions and service exposure. Similarly, retain the original function names and record their quantity composition characteristics:

[0134] ;

[0135] Step S243: Symbol table restoration modeling: During the static analysis process, attempt to restore The recognizable function symbol information in it to obtain the symbol set:

[0136] ;

[0137] Among them, represents the function name obtained through symbol restoration or debugging information restoration;

[0138] This set covers functions that are not exported but have symbol characteristics, such as static functions with residual debugging information or hit by the symbol restoration algorithm; count the number of times they appear as a feature: ;

[0139] Step S244: Function signature modeling: For Perform signature matching and fingerprint extraction on all included functions to obtain the set of identifiable functions:

[0140] ;

[0141] in, Represents the function identifier identified by signature matching;

[0142] This set can be used to build comparisons with known vulnerable functions, protocol processing logic, etc. We record the matching results and the total number of functions: ;

[0143] Step S245: Finally, for each , concatenate the four types of statistical feature vectors to construct their symbolic statistical portraits:

[0144] ;

[0145] At the same time, the original four types of function sets are retained:

[0146] ;

[0147] In order to support multiple strategies such as string equality and function set intersection in symbol-level similarity analysis, the image vectors of all boundary binaries in the set are concatenated and aggregated to form the overall symbolic feature representation of the firmware:

[0148] ;

[0149] Where n4 is the number of boundary communication binary programs selected in firmware F;

[0150] It has scalability and semantic resolution, providing quantitative statistics on the exposed surface of the firmware symbol layer while retaining the symbol name foundation required for structural comparison. It has important analytical value in component identification, protocol analysis, semantic attribution, and vulnerability propagation path modeling.

[0151] Step S25: Analyze the file system layout, sensitive resource distribution pattern and binary component deployment strategy to build a file layout profile feature , specifically including:

[0152] Embedded firmware usually contains a complete or nearly complete file system structure after unpacking. This structure not only undertakes the organization and scheduling functions of system components but also exposes a large amount of static information that can be exploited by attackers through path naming, file content, and resource layout. To capture the multi-dimensional structure and semantic behavior in the file system, the present invention proposes a Filesystem Semantic Profile for modeling the static features of firmware in aspects such as path topology, sensitive resources, configuration exposure, and binary file distribution. This profile consists of three modeling stages, corresponding to structure layout modeling, sensitive resource annotation and modeling, and binary resource signature profiling, which are finally fused into a unified structural feature vector to support similarity analysis and clustering modeling of firmware in terms of deployment mode, information leakage risk, and resource reuse behavior:

[0153] Step S251: Structure layout modeling: To characterize the structural differences in the component organization and directory deployment levels of the firmware file system, the present invention denotes the root directory of the unpacked file system as whose structure can be formally represented as a directed tree where is the set of all reachable directories, and is the hierarchical nesting relationship between directories. For each directory , four types of metric indicators are defined: its depth , that is, the path length from the root directory to ; its executable density , representing the proportion of executable files in all files under the directory; its aggregation degree , measuring the number of files and subdirectories contained in the current directory; and the global directory distribution entropy , used to quantify the deployment uniformity and organizational complexity of the entire file system. Statistical summaries of these indicators (such as the mean and the standard deviation ) are constructed to form a structural feature vector:

[0154] ;

[0155] where and represent the mean and standard deviation of all directory depths respectively, and represent the average values of the global executable density and aggregation degree, while is the normalized result obtained by applying the Shannon entropy function to the file number distribution in the directory; the vector characterizes the structural behavior of the firmware file system in the organization method, which helps to analyze its component deployment habits and path construction patterns;

[0156] Step S252: Sensitive resource annotation and modeling: For static assets in the file system that may cause information leakage, authentication bypass, or system exposure, the present invention constructs a path label system for firmware semantic content. This system covers three types of high-risk resources: authentication assets, static information, and configuration files, and uniformly models the static attack surface structure of different firmware samples through a rule-driven label annotation mechanism.

[0157] Define all reachable paths in the file system as a path set , where each path represents a file or directory node generated after unpacking. To identify its potential sensitive meaning, design a regular rule set , where each rule corresponds to a semantic label one-to-one, and is a set of semantic labels. Specifically, define a pattern matching function to map the path to the label it matches. This label system is further divided into the following three categories:

[0158] 1) Authentication asset exposure: This type of label mainly identifies path features related to key materials of authentication mechanisms and encryption protocols. We focus on the following types of resource paths: First, the key and certificate files that appear, such as files with extensions.key,.pem,.crt,.cer,.p12, etc.; Second, the paths representing password storage, such as common system password files like.htpasswd, shadow, passwd, etc.; Third, SSH and TLS-related configuration paths, such as.ssh / , sshd_config, ssl.conf, authorized_keys, etc.; Once exposed, such resources will directly affect the security boundaries of remote access control, encrypted communication, and device authentication in the firmware;

[0159] 2) Static information leakage indicators: This label family is used to capture hard-coded static information in the firmware that may be used by attackers for target identification, device fingerprint tracking, or constructing targeted attacks. We designed a pattern set for identifying feature items such as IP addresses, hard-coded URLs, email addresses, MAC addresses, and device unique identifiers, and incorporated these contents into the information leakage label annotation in the file system. Although such paths may not directly lead to vulnerabilities, they are often used as side-channel resources in actual attacks for precise target positioning and environmental intelligence collection;

[0160] 3) Configure exposure indicators: This type of tag identifies configuration paths that are closely related to system components, service modules, and operating logic. We have defined a set of rules covering web services, database connections, automation scripts, and startup items, which match typical file paths and naming conventions such as.conf,.ini,.sql,.db,.sh, etc. If such paths are exposed, it may cause attackers to directly obtain the service operating logic, hard-coded database passwords, or script entry points for automatic execution, thereby forming an attack path or exposing the access surface.

[0161] For each tag count its hit times in the path set to construct a semantic feature vector of sensitive resources:

[0162] ;

[0163] Among them, represents the frequency of the tag appearing in the firmware file system, is the total dimension of the tag space. The vector comprehensively depicts the semantic profile of the firmware sample on static exposure surfaces such as authentication, configuration, and information, and can provide a quantitative basis for downstream similarity analysis tasks.

[0164] Step S253: Binary resource signature modeling: This step focuses on the deployment location, content structure, and potential reuse characteristics of binary programs in the unpacked file system. The present invention proposes binary resource signature dimensions for statically modeling the path distribution, string features, and structural fingerprints of typical executable files in the firmware to support binary resource similarity analysis and component clustering between firmwares. A set is formed by all executable files with execution permissions or significant path semantics, where each

[0165] ;

[0166] Among them, represents the path semantic hit flag, represents the set of original printable strings, represents the fuzzy hash fingerprint; specifically:

[0167] 1) The path semantic feature determines by matching a predefined set of path patterns Whether it is deployed in typical locations (such as / bin / httpd, / usr / sbin / telnetd, / lib / libcrypto.so, etc.). If it hits, set , otherwise it is 0. Count the number of binaries in all hit paths as a structural representation of the deployment location;

[0168] 2) The string summary feature is obtained by extracting the set of ASCII printable strings in each , and only retaining the strings with a length greater than the threshold (default ), to form its original semantic content set;

[0169] 3) The fuzzy fingerprint feature is formed by calculating the ssdeep hash value of each , to form its original content fingerprint. Use all fingerprint sets as the feature basis for subsequent cross-firmware fuzzy comparison;

[0170] Finally, unify these three types of features into a resource signature vector:

[0171] ;

[0172] Among them, represents the set of resources hit by all paths, represents the set of printable strings in all binaries, represents the original ssdeep fingerprints of all binary files; As the input for subsequent resource comparison between firmwares, it supports operations such as path alignment, intersection and union analysis of string sets, and fuzzy fingerprint similarity matching. Its modeling process is lightweight and semantically stable, and is suitable for function reuse analysis and similarity clustering tasks in a large-scale firmware sample environment.

[0173] Step S254: Feature fusion and portrait representation: To uniformly represent the structural and semantic features in the above three dimensions, concatenate the structure layout vector , the sensitive resource vector and the binary resource vector in order to construct a semantic portrait vector of the firmware in the file system dimension:

[0174] ;

[0175] Among them, represents the vector concatenation operation. The vector is comparable and interpretable between different firmware samples and can directly participate in downstream tasks such as calculating structural similarity.

[0176] The file layout portrait provides a multi-dimensional, lightweight, and highly interpretable modeling method. The construction of this portrait does not rely on file content decryption, system mounting, or dynamic analysis capabilities, so it has good adaptability and analysis efficiency, and has important supporting value in tasks such as structure reuse detection and configuration exposure assessment;

[0177] Step S26: Construct a five-tuple based on the above five different dimensions of features , which is used to represent the five-dimensional feature portrait of the firmware F.

[0178] In order to apply the above semantic portrait to the similarity modeling and semantic alignment tasks between firmwares, the present invention proposes a unified multi-dimensional semantic portrait similarity calculation method. This method takes any pair of firmwares as input, and designs customized similarity measurement functions for each type of semantic portrait , and adopts a differentiated similarity calculation strategy according to its feature type (such as sequence set, path structure, statistical vector, or call chain). On this basis, a fusion mechanism is further introduced to integrate the multi-dimensional scoring results, and finally a global semantic similarity index is output.

[0179] In one embodiment, the above step S3: Based on the five-dimensional feature portrait, use multiple algorithms to perform multi-semantic firmware similarity calculation on the known vulnerable firmware and the firmware to be detected, and obtain the global similarity score through weighted fusion, specifically including:

[0180] Step S31: The unpacked signature sequence portrait aims to capture the nested structure behavior characteristics shown by the firmware image during the deconstruction process. Its core representation form is the structure signature sequence , and the set of structure subsequences extracted based on the n-gram pattern and its frequency vector . To achieve the structural similarity modeling of different firmwares in this dimension, the present invention designs a two-level similarity calculation method combining set matching and frequency statistics:

[0181] First, for the known vulnerability and the firmware to be tested and , let their corresponding sets of structure n-gram patterns be: and , where each represents a subsequence of the unpacked signature sequence portrait with a length of ;

[0182] Use the Jaccard similarity coefficient to measure the similarity of the unpacked signature sequence sets; ​

[0183] ;

[0184] Secondly, for the n-gram pattern set construct a globally unified vocabulary , and generate frequency vectors and , where represents the occurrence frequency of the structural fragment in the th firmware; calculate the cosine similarity between the two in the frequency space:

[0185] ;

[0186] where, represents the inner product operation of two vectors; and are the Euclidean norms of the corresponding vectors respectively;

[0187] Calculate the similarity of the unpacked signature sequence portrait features :

[0188] ;

[0189] The two-level computing framework designed by the present invention takes into account both the semantic structure consistency and the behavior frequency preference of the unpacking behavior, and has good stability, interpretability and cross-sample generality. In the subsequent multi-dimensional feature fusion process, this index will participate in the overall similarity modeling of the firmware as an important component of the structural expansion dimension.

[0190] Step S32: The vulnerability-sensitive parameter call chain portrait depicts the semantic reach chain of potential vulnerabilities in the embedded firmware by recording the parameter propagation path related to the sensitive function. In order to compare the structural similarity of such propagation chains in different firmwares, the present invention uses the edit distance (Edit Distance) as the chain-level similarity metric based on the normalized function sequence, and introduces a cross-set matching strategy to implement the firmware-level path similarity calculation.

[0191] Step S321: Let the call chain portraits of the firmwares and be and respectively; where, and represent a single normalized function call chain, which is defined as an ordered function name sequence and ;

[0192] Calculate the normalized similarity of the edit distance of the vulnerability-sensitive parameter call chain path:

[0193] ;

[0194] Among them, and respectively represent and the th th vulnerability-sensitive parameter call chain in is the edit distance between two vulnerability-sensitive parameter call chains, used to measure the minimum transformation cost between two function sequences, and the operations include insertion, deletion, and replacement. and are the lengths of the corresponding vulnerability-sensitive parameter call chains respectively; The value of is in the range of

[0195] Step S322: Calculate the similarity of the vulnerability-sensitive parameter call chain portrait features :

[0196] ;

[0197] Among them, and respectively represent and the sets of vulnerability-sensitive parameter call chains extracted from is the total number of vulnerability-sensitive parameter call chains in represents the th vulnerability-sensitive parameter call chain in the firmware represents the maximum similarity value between the th vulnerability-sensitive parameter call chain in and all vulnerability-sensitive parameter call chains in

[0198] While maintaining the accuracy of the structural semantic comparison, it reduces the risk of false matching caused by path misalignment, quantity inconsistency, and naming differences. By using the call chain similarity as the semantic representation of the function propagation behavior, the system can effectively identify firmware samples with similar vulnerability reach paths, providing a structural basis for cross-architecture vulnerability migration modeling and reproduction analysis.

[0199] Step S33: External communication interface exposure portrait It aims to capture the external communication paths and parameter name structures in the embedded firmware, and characterize the organizational form and complexity of its input boundaries through the structural summary vector. This portrait consists of three parts: the set of interface paths , the set of parameter names , and the structural summary feature vector . Therefore, when calculating the similarity in the communication interface dimension between firmwares, the present invention separately considers two types of features, namely the similarity of the semantic identifier set (including path similarity and parameter similarity) and the structural vector similarity, and fuses them in a unified metric space to construct a complete similarity metric.

[0200] Step S331: Calculate the path similarity:

[0201] ;

[0202] Among them, and respectively represent the sets of communication interface paths extracted from and , is and the number of common interface paths, is and the number of the union of all interface paths;

[0203] Step S332: Calculate the parameter similarity:

[0204] ;

[0205] Among them, and respectively represent the sets of communication interface parameter keywords extracted from and , is and the number of common parameter keywords, is and the number of the union of all parameter keywords;

[0206] and effectively measure the overlap degree of different firmwares in the externally exposed paths and input variable naming, providing a basis for interface structure alignment and function commonality identification;

[0207] Step S333: At the structural level, the present invention uses the communication interface structure summary vector Characterize the number of interface paths, the number of parameter names, the average path depth, the path naming prefix entropy, and the parameter naming character entropy respectively.

[0208] Calculate the cosine similarity of the structural summary vectors:

[0209] ;

[0210] Among them, and are respectively and 's communication interface structure summary feature vectors, represents the inner product operation of the two feature vectors, and are respectively the Euclidean norms corresponding to and ;

[0211] Step S334: Calculate the similarity of the external communication interface portrait features :

[0212] ;

[0213] Among them, , , are respectively the fusion weights of the path similarity, parameter similarity, and cosine similarity of the structural summary vectors, satisfying the normalization constraint condition ;

[0214] The metric method has the following three advantages: First, the Jaccard similarity of the original string set can capture the commonalities of interface naming and parameter semantics, and is suitable for cross-vendor path structure classification and clustering analysis; Second, the statistical summary vector provides a computable representation of the macroscopic structure profile, which helps to characterize the deployment complexity and naming consistency; Third, the fusion design supports multi-source feature collaborative modeling, enhancing the expression ability of cross-architecture communication interface semantic alignment and structure comparison. This metric will participate in the global fusion scoring in the subsequent firmware similarity assessment.

[0215] Step S34: The boundary binary program plays a key role in communication parsing and system interaction in the embedded firmware, and its symbolic-level structure reflects the external dependencies, internal function organization, and recognizable behavior signatures of the program. In step S24, a statistical feature vector was constructed for each Top-n boundary program and the original symbol set , which is used to express the exposure characteristics of its import functions, export symbols, reconstructed symbol tables, and function signatures in four dimensions. To measure the structural similarity of different firmware in this semantic dimension, the present invention models and fuses from two levels: statistical features and symbol content.

[0216] Step S341: For any two firmware and , let their boundary program sets be , , for the four-dimensional statistical vector of each program, perform average pooling to generate an overall statistical representation: and ;

[0217] Cosine similarity after average pooling of statistical vectors:

[0218] ;

[0219] Among them, and respectively represent and The boundary binary symbol statistical feature vectors after average pooling; represents the inner product operation of the two feature vectors; and are the L2 norms of the corresponding vectors respectively;

[0220] Step S342: To further utilize the original function identification information, extract and merge the four types of function sets of all boundary programs in each firmware, denoted as:

[0221] ;

[0222] ;

[0223] Calculate the symbol set similarity:

[0224] ;

[0225] Among them, and respectively represent and The boundary binary symbol sets extracted from; is and The number of common symbols, is and The number of the union of all symbols;

[0226] Step S343: Calculate the similarity of the symbolic portrait features of the boundary communication components :

[0227] ;

[0228] Among them, is the weight coefficient of the cosine similarity after statistical vector average pooling, is the corresponding weight of the symbol set similarity, and the two satisfy the normalization constraint condition ;

[0229] The design of takes into account both the structural statistical stability and the semantic integrity of the function set while maintaining the computational efficiency, and is applicable to the module function comparison and semantic behavior clustering between firmware samples of different complexities.

[0230] Step S35: The file system semantic portrait statically depicts its deployment mode and attack surface structure from three aspects: the structural organization of the embedded firmware, the exposure of sensitive resources, and the binary deployment behavior. To measure the structural similarity of different firmware samples in this dimension, the present invention represents its overall features is disassembled into three types of heterogeneous sub-features, and targeted measurement strategies are respectively used to perform similarity calculation and fuse them into an overall score at the vector level; the specific method is as follows:

[0231] [[ID=@28]]Step S351: Let the structural layout feature vectors of the firmware and be respectively:

[0232] and

[0233] Among them, and respectively represent the mean and standard deviation of all directory depths of, and represent the average value of the global executable density and aggregation degree of, is the normalized result obtained by applying the Shannon entropy function to the file number distribution in the directory of ;

[0234] Calculate the file system structure layout similarity using the normalized Euclidean distance:

[0235] ;

[0236] Among them, and respectively represent and The structural layout feature vector is the L2 norm of the difference between two feature vectors;

[0237] The result of is within the interval. The larger the value, the more similar the structural deployment features are. Normalization processing avoids comparison biases caused by differences in feature scales and is applicable to direct comparison of low-dimensional dense vectors;

[0238] Step S352: Sensitive resources are modeled as frequency vectors in a unified label space:

[0239] and , where the -dimensional represents the frequency of the label appearing in . Since the label set is a predefined unified space, the dimensions of the two vectors are consistent;

[0240] Calculate the cosine similarity of sensitive resource labels:

[0241] ;

[0242] where and are the semantic feature vectors of and sensitive resources respectively, represents the inner product operation of the two vectors; and are the L2 norms of the corresponding vectors respectively;

[0243] The value range is , which is applicable to evaluating the direction consistency between high-dimensional sparse vectors and can effectively reflect the similarity degree of the types and quantity distributions of sensitive resources.

[0244] Step S353: The representation of binary resources consists of a path hit set , a string set and a fuzzy hash set , which describe the semantics of binary resources from three aspects: deployment location, text content, and file structure:

[0245] Calculate the weighted fusion similarity of binary resource signatures:

[0246] ;

[0247] ;

[0248] ;

[0249] ;

[0250] Among them, represents the path semantic similarity, which is used to quantify the consistency of the deployment locations of key binary files between firmwares; and represent the set of paths that hit semantic tags;

[0251] represents the string content similarity, which reflects the degree of overlap of text semantic information between firmwares; and represent the set of printable strings;

[0252] represents the fuzzy hash similarity, which evaluates the structural similarity of binary files between firmwares; is the hash similarity function provided by ssdeep; and represent the set of original ssdeep fingerprints of all binary files, represents the number of elements in the set;

[0253] Weight coefficient and and respectively correspond to the importance weights of path semantic similarity, string content similarity, and fuzzy hash similarity, satisfying the normalization constraint condition ;

[0254] Step S354: Calculate the file layout portrait feature similarity :

[0255] ;

[0256] Among them, and and are the weights of structural layout similarity, cosine similarity of sensitive resource tags, and weighted fusion similarity of binary resource signatures respectively, satisfying the normalization constraint condition ;

[0257] ensures the collaborative modeling ability of multi-source features and provides a stable and reliable measurement basis for structural attribution judgment and behavior clustering at the file system level.

[0258] Step S36: Weightedly fuse the similarities in the above five dimensions to obtain a global similarity score, specifically:

[0259] ;

[0260] Among them, is the weight coefficient of the similarity in each dimension, satisfying .

[0261] Due to the semantic portrait of the file system Because of its stable directory topology and high-dimensional static information density, it shows good discrimination and robustness in various scenarios, and it is recommended to assign a relatively high fusion weight. The remaining dimensions are equally important in expressing the exposed surface of program functions, input structure features, and vulnerability propagation paths, and an equal configuration is adopted to achieve complementary enhancement. In the embodiment of the present invention .

[0262] In one embodiment, the above step S4: Based on the global similarity score, analyze and screen out the high-risk firmware samples to be detected, automatically generate vulnerability verification tasks, perform basic environment configuration, task distribution, and multi-node parallel verification, and output the vulnerability verification results, specifically including:

[0263] Step S41: Through the distributed verification agent, run node 1 for basic environment configuration, including pulling the operating system image, installing the dependency libraries, and preparing the firmware simulation tool, and run node 2 for generating verification tasks, including firmware simulation and vulnerability verification task distribution;

[0264] In this step, run node 1 is responsible for building the basic environment, preparing the basic running environment for the subsequent vulnerability verification tasks, including but not limited to automatically pulling and configuring the operating system image, installing the necessary dependency libraries, preparing the tools and scripts required for firmware simulation, etc., to ensure that each verification node can independently and stably run the firmware samples. Run node 2 simulates these high-risk firmware on the basis of the basic running environment built by run node 1, and automatically generates specific vulnerability verification tasks according to the previous vulnerability analysis report. Each task will describe in detail the vulnerability types to be verified, verification methods, input data, expected behaviors, etc., and distribute these tasks to multiple run nodes to achieve parallel processing. That is, a dedicated vulnerability environment is provided for the vulnerabilities corresponding to each high-risk firmware.

[0265] Step S42: Multi-node parallel verification process, and each run node independently executes binary firmware simulation, resource access authorization request, and vulnerability exploitation success measurement;

[0266] Each run node can be regarded as an independent verification workstation, which can handle different firmware samples and vulnerability verification tasks simultaneously. The main process of each run node includes:

[0267] 1) Binary firmware emulation: The node will use firmware emulation technologies (such as QEMU, dedicated emulators, etc.) to restore the real operating environment of the firmware in the dedicated environment provided by Node 2 according to the unique verification mechanism of the firmware itself, enabling the firmware to run as if it were on real hardware. This step is crucial for discovering actual vulnerability behaviors;

[0268] 2) Resource access authorization request: In the emulation environment, some vulnerability verifications may require higher system permissions or special access controls. The system will automatically detect and dynamically adjust the permission settings as needed to ensure that the verification process can cover all attack surfaces without affecting system security;

[0269] 3) Vulnerability exploitation success measurement: It specifically includes the following steps:

[0270] Step S421: Automatically execute the vulnerability verification script and attempt to trigger the target vulnerability, including but not limited to sending specific network packets, constructing abnormal inputs, simulating attack behaviors, etc.;

[0271] Step S422: Observe whether the firmware exhibits abnormal phenomena such as crashes, unauthorized access, and sensitive data leakage;

[0272] Step S423: According to the observation results, calculate the accuracy of the existence of vulnerabilities identified by high-risk firmware under different tools.

[0273] Step S43: Result collection and determination, collect the logs, abnormal events, and behavior data of each node in real time, and use the automated behavior analysis module to determine whether the vulnerability has been successfully triggered and perform a credibility score on the verification result.

[0274] In one embodiment, the firmware homologous vulnerability mining method based on multi-dimensional feature portraits further includes the following steps:

[0275] Containerized verification sandbox and benchmark environment: The verification process is carried out in a containerized sandbox: To ensure the consistency and reproducibility of the verification environment each time, all verification processes are carried out in the sandbox container. Each node will start one or more containers, which are built-in with standardized behavior baseline validators that can automatically record each operation and result for subsequent analysis and traceability;

[0276] Result collection and determination: During the verification process, the system will collect the logs, abnormal events, and behavior data of each node in real time. Through the automated behavior analysis module, the system can determine whether the vulnerability has been successfully triggered and perform a credibility score on each verification result;

[0277] Efficient Expansion and Coverage: The entire verification architecture supports horizontal expansion. It can dynamically increase or decrease the running nodes according to the number of firmware samples and the task complexity, enabling large-scale parallel verification. This not only significantly improves the verification efficiency but also ensures comprehensive coverage of firmware of different types and architectures.

[0278] Through the above process, it is possible to achieve automated, batch, and standardized verification of high-risk firmware vulnerabilities, greatly improving the accuracy and efficiency of vulnerability detection, and providing solid data support for subsequent vulnerability repair and security reinforcement.

[0279] Figure 2 It is a structural schematic diagram of the method of the present invention.

[0280] Embodiment 2

[0281] The embodiment of the present invention provides a firmware homologous vulnerability mining system based on multi-dimensional feature portraits, including the following modules:

[0282] A preprocessing module for obtaining a set of firmware to be detected and a set of firmware with known vulnerabilities, and performing formatting, preprocessing, and standardized storage on the firmware samples;

[0283] A firmware multi-dimensional heterogeneous feature portrait extraction module for inputting the preprocessed set of firmware to be detected and the set of firmware with known vulnerabilities into a firmware vulnerability existence analysis module for multi-dimensional feature extraction, specifically including: unpacking signature sequence portraits, vulnerability-sensitive parameter call chain portraits, external communication interface portraits, boundary communication component symbol portraits, and file layout portraits in five dimensions, forming a set of standardized five-dimensional feature portraits;

[0284] A firmware multi-dimensional feature portrait similarity calculation module for performing multi-semantic firmware similarity calculation on the firmware with known vulnerabilities and the firmware to be detected based on the five-dimensional feature portraits using multiple algorithms, and obtaining a global similarity score through weighted fusion;

[0285] A firmware security vulnerability verification module for analyzing and screening out high-risk firmware samples to be detected based on the global similarity score, automatically generating vulnerability verification tasks, performing basic environment configuration, task distribution, and multi-node parallel verification, and outputting vulnerability verification results.

[0286] A firmware homologous vulnerability mining device based on multi-dimensional feature portraits includes one or more electronic devices, and one or more of the electronic devices are used to implement the firmware homologous vulnerability mining method based on multi-dimensional feature portraits.

[0287] An electronic device includes: one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the firmware homologous vulnerability mining method based on multi-dimensional feature portraits.

[0288] A computer-readable storage medium stores executable instructions thereon, and when the instructions are executed by a processor, the processor implements a method for mining firmware homologous vulnerabilities based on a multi-dimensional feature profile.

[0289] The above are only specific embodiments of the present invention, enabling those skilled in the art to understand or implement the present application. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present invention will not be limited to these embodiments shown herein, but rather to the broadest scope consistent with the principles and novel features claimed herein.

Claims

1. A firmware homologous vulnerability mining method based on multi-dimensional feature portraits, characterized in that, Including: Step S1: Obtain the firmware set to be detected and the firmware set with known vulnerabilities, and format, preprocess, and store the firmware samples in a standardized manner; Step S2: Input the preprocessed firmware set to be detected and the firmware set with known vulnerabilities into the firmware multi-dimensional heterogeneous feature portrait extraction module for multi-dimensional feature portrait extraction, specifically including: unpacked signature sequence portrait, vulnerability-sensitive parameter call chain portrait, external communication interface portrait, boundary communication component symbol portrait, and file layout portrait in five dimensions, forming a set of standardized five-dimensional feature portraits; Step S3: Based on the five-dimensional feature portraits, use multiple algorithms to calculate the multi-semantic firmware similarity between the firmware with known vulnerabilities and the firmware to be detected, and obtain the global similarity score through weighted fusion; Step S4: Based on the global similarity score, analyze and screen out the high-risk firmware samples to be detected, automatically generate vulnerability verification tasks, perform basic environment configuration, task distribution, and multi-node parallel verification, and output the vulnerability verification results.

2. The firmware homologous vulnerability mining method based on multi-dimensional feature portraits according to claim 1, wherein, In Step S2: Input the preprocessed firmware set to be detected and the firmware set with known vulnerabilities into the firmware vulnerability existence analysis module for multi-dimensional feature portrait extraction, specifically including: unpacked signature sequence portrait, vulnerability-sensitive parameter call chain portrait, external communication interface portrait, boundary communication component symbol portrait, and file layout portrait in five dimensions, forming a set of standardized five-dimensional feature portraits, specifically including: Step S21: Use a recursive unpacking algorithm to hierarchically parse the firmware image, extract embedded binary components, calculate multi-dimensional hash values, and construct a portrait feature of the unpacking signature sequence ; Step S22: Based on the taint analysis technique, trace the propagation path of sensitive parameters during program execution, and construct the portrait features of the vulnerability-sensitive parameter call chain ; Step S23: Extract the interface identifier, structural hierarchy, configuration parameters, and exposure characteristics through static analysis techniques to construct the portrait features of the external communication interface ; Step S24: Analyze the symbol table structure and function call naming convention of the boundary communication component, and construct the symbol portrait features of the boundary communication component ; Step S25: Analyze the file system layout, sensitive resource distribution patterns, and binary component deployment strategies to construct file layout portrait features ; Step S26: Construct a five-tuple based on the above five different-dimensional features , which is used to represent the five-dimensional feature portrait of the firmware F.

3. The firmware homologous vulnerability mining method based on multi-dimensional feature portraits according to claim 1, wherein In Step S3: Based on the five-dimensional feature portraits, use multiple algorithms to calculate the multi-semantic firmware similarity between the firmware with known vulnerabilities and the firmware to be detected, and obtain the global similarity score through weighted fusion, specifically including: Step S31: First, for the known vulnerabilities and the firmware to be tested and , let their corresponding structural n-gram pattern sets be respectively: and , where each represents a subsequence of the unpacked signature sequence portrait with a length of ; Use the Jaccard similarity coefficient to measure the similarity of the unpacked signature sequence set; ； Secondly, for the n-gram pattern set construct a globally unified vocabulary , and generate frequency vectors and , where represents the occurrence frequency of the structural fragment in the th firmware; calculate the cosine similarity between the two in the frequency space: ； Among them, represents the inner product operation of two vectors; and are the Euclidean norms of the corresponding vectors respectively; Calculate the similarity of unpacked signature sequence portrait features : ； Step S32: Calculate the normalized similarity of the path-level edit distance of the vulnerability-sensitive parameter call chain; ； Among them, and respectively represent and the th and th vulnerability-sensitive parameter call chains in is the edit distance between the two vulnerability-sensitive parameter call chains, and are the lengths of the corresponding vulnerability-sensitive parameter call chains respectively; Calculate the similarity of the call chain portrait features of vulnerability-sensitive parameters : ； Among them, and respectively represent and the set of vulnerability-sensitive parameter call chains extracted from is the total number of vulnerability-sensitive parameter call chains in represents the firmware in the th vulnerability-sensitive parameter call chain, represents in the th vulnerability-sensitive parameter call chain and the maximum similarity value of all vulnerability-sensitive parameter call chains in Step S33: Calculate the path similarity; ； Among them, and respectively represent and the set of communication interface paths extracted from is and the number of interface paths shared by is and the number of the union of all interface paths; Calculate the parameter similarity; ； Among them, and respectively represent and the set of communication interface parameter keywords extracted from is and the number of common parameter keywords is and the number of the union of all parameter keywords; Calculate the cosine similarity of the structural summary vector; ； Among them, and are respectively and the communication interface structure summary feature vectors, represents the inner product operation of the two feature vectors, and are respectively the corresponding and Euclidean norms; Calculate the similarity of the external communication interface image features : ； Among them, , , are the fusion weights of path similarity, parameter similarity, and cosine similarity of the structure summary vector, respectively, and satisfy the normalization constraint condition ; Step S34: Statistically calculate the cosine similarity after vector average pooling; ； Among them, and respectively represent and the boundary binary symbol statistical feature vectors after average pooling processing; represents the inner product operation of two feature vectors; and are the L2 norms of the corresponding vectors respectively; Symbol set similarity; ； Among them, and respectively represent and the set of boundary binary symbols extracted from is and the number of symbols common to is and the number of the union of all symbols; Calculate the similarity of the symbol image features of the boundary communication component : ； Among them, is the weight coefficient of the cosine similarity after statistical vector average pooling, is the corresponding weight of the symbol set similarity, and the two satisfy the normalization constraint condition ; Step S35: Use the normalized Euclidean distance to calculate the file system structure layout similarity; ； Among them, and respectively represent and the structural layout feature vectors of is the L2 norm of the difference between the two feature vectors; Calculate the cosine similarity of the sensitive resource tags; ； Among them, and are respectively and the semantic feature vectors of sensitive resources, represents the inner product operation of two vectors; and are respectively the L2 norms of the corresponding vectors; Calculate the weighted fusion similarity of the binary resource signatures; ； ； ； ； Among them, represents the path semantic similarity, which is used to quantify the consistency of the deployment locations of key binary files between firmware; and represents the set of paths that hit semantic tags; Represents the similarity of string content, reflecting the overlapping degree of text semantic information between firmware; , Represents a set of printable strings; Represents the fuzzy hashing similarity, which evaluates the structural similarity of binary files between firmware; It is the hash similarity function provided by ssdeep; , Represents the set of original ssdeep fingerprints of all binary files, Represents The number of elements in the set; Weight coefficient , , correspond to the importance weights of path semantic similarity, string content similarity, and fuzzy hashing similarity respectively, and satisfy the normalization constraint condition ; Calculate the similarity of file layout portrait features : ； Among them, , , are the weights of the structural layout similarity, the cosine similarity of sensitive resource tags, and the weighted fusion similarity of binary resource signatures, respectively, satisfying the normalization constraint condition ; Step S36: Perform weighted fusion on the similarities of the above five dimensions to obtain the global similarity score, specifically: ； Among them, is the weight coefficient of the similarity in each dimension, satisfying .

4. The firmware homologous vulnerability mining method based on multi-dimensional feature portraits according to claim 1, wherein In Step S4: Based on the global similarity score, analyze and screen out the high-risk firmware samples to be detected, automatically generate vulnerability verification tasks, perform basic environment configuration, task distribution, and multi-node parallel verification, and output the vulnerability verification results, specifically including: Step S41: Through the distributed verification agent, run Node 1 for basic environment configuration, including pulling the operating system image, installing the dependency libraries, and preparing the firmware simulation tool, and run Node 2 for verification task generation, including firmware simulation and vulnerability verification task distribution; Step S42: Multi-node parallel verification process, where each running node independently executes binary firmware simulation, resource access authorization request, and vulnerability exploitation success measurement; Step S43: Result collection and determination. Logs, exception events, and behavior data of each running node are collected in real time. The automated behavior analysis module is used to determine whether the vulnerability has been successfully triggered, and a credibility score is given to the verification result.

5. The firmware homologous vulnerability mining method based on multi-dimensional feature portraits according to claim 4, characterized in that, The successful exploitation measurement of the vulnerability in step S42 specifically includes: Step S421: Automatically execute the vulnerability verification script to attempt to trigger the target vulnerability; Step S422: Observe whether abnormal phenomena such as firmware crash, unauthorized access, and sensitive data leakage occur; Step S423: According to the observation results, calculate the accuracy of the existence of vulnerabilities identified by different tools for high-risk firmware.

6. The firmware homologous vulnerability mining method based on multi-dimensional feature portraits according to claim 1, wherein The step S4: Based on the global similarity score, analyze and screen out high-risk firmware samples to be detected, automatically generate vulnerability verification tasks, perform basic environment configuration, task distribution, and multi-node parallel verification, and output vulnerability verification results. It also includes: All verification processes are carried out in a containerized sandbox; the operation and results are automatically recorded through a built-in standardized behavior baseline validator; a dynamic expansion mechanism is used to dynamically adjust the number of running nodes according to the number of firmware samples and task complexity.

7. A firmware homologous vulnerability mining system based on multi-dimensional feature portraits, characterized in that, It includes the following modules: A preprocessing module, which is used to obtain the firmware set to be detected and the firmware set with known vulnerabilities, and perform formatting, preprocessing, and standardized storage on the firmware samples; A firmware multi-dimensional heterogeneous feature portrait extraction module, which is used to input the preprocessed firmware set to be detected and the firmware set with known vulnerabilities into the firmware vulnerability existence analysis module for multi-dimensional feature extraction. Specifically, it includes five dimensions: unpacked signature sequence portrait, vulnerability sensitive parameter call chain portrait, external communication interface portrait, boundary communication component symbol portrait, and file layout portrait, forming a set of standardized five-dimensional feature portraits; A firmware multi-dimensional feature portrait similarity calculation module, which is used to perform multi-semantic firmware similarity calculation on the firmware with known vulnerabilities and the firmware to be detected based on the five-dimensional feature portraits using multiple algorithms, and obtain the global similarity score through weighted fusion; A firmware security vulnerability verification module, which is used to analyze and screen out high-risk firmware samples to be detected based on the global similarity score, automatically generate vulnerability verification tasks, perform basic environment configuration, task distribution, and multi-node parallel verification, and output vulnerability verification results.

8. A firmware homologous vulnerability mining device based on multi-dimensional feature portraits, characterized in that It includes one or more electronic devices, where the one or more electronic devices are used to implement the method according to any one of claims 1 to 6.

9. An electronic device, characterized in that, It includes: One or more processors; A memory, which is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that, An executable instruction is stored thereon, and when the instruction is executed by the processor, the processor is caused to implement the method according to any one of claims 1 to 6.

Images