Firmware homology vulnerability mining method and system based on multi-dimensional feature profiling

Abstract

The present invention proposes a firmware homology vulnerability mining method and system based on multidimensional feature profiling, which belongs to the field of computer science and includes the following steps: S1: obtaining a set of firmware to be tested and a set of firmware with known vulnerabilities, and formatting and preprocessing the firmware samples; S2: extracting multidimensional feature profiling from the preprocessed set of firmware to be tested and the set of firmware with known vulnerabilities to form a standardized five-dimensional feature profiling; S3: based on the five-dimensional feature profiling, using multiple algorithms to calculate multi-semantic firmware similarity between the firmware with known vulnerabilities and the firmware to be tested, and obtaining a global similarity score; S4: based on the global similarity score, analyzing and screening high-risk firmware samples to be tested, automatically generating vulnerability verification tasks, performing basic environment configuration, task distribution, and multi-node parallel verification, and outputting vulnerability verification results. The method of the present invention realizes a closed-loop process of automated firmware processing, deep feature mining, similarity quantification analysis, and vulnerability verification.

Description

Technical Field

[0001] The present invention belongs to the field of computers, and in particular relates to a method and system for mining firmware homologous vulnerabilities based on multi-dimensional feature profiling. Background Art

[0002] With the rapid adoption of IoT devices and embedded systems across various fields, firmware security issues are becoming increasingly serious. Firmware, the critical bridge between hardware and software, can be exploited by attackers to remotely control devices, steal data, and even cause serious physical security incidents. Currently, automated firmware vulnerability discovery and verification technology has become a key area of ​​security research. However, existing technologies primarily rely on manual analysis, feature matching, or single tools, making them difficult to address the diversity, homology, and vulnerability migration challenges of firmware in real-world scenarios.

[0003] Specifically, traditional vulnerability discovery methods suffer from the following significant issues: First, manual auditing consumes a significant amount of specialized manpower and is unable to cope with the rapidly growing size of firmware. Second, fuzz testing is limited by the complexity of the firmware environment and is difficult to implement. Furthermore, dynamic analysis often fails to adapt to the diverse and specialized firmware operating environments. More importantly, existing methods fail to effectively utilize known vulnerability information, making it difficult to rapidly migrate and verify vulnerabilities across firmware versions and different vendors, resulting in a high proportion of repetitive work in vulnerability analysis.

[0004] It is worth noting that due to the widespread code reuse and version evolution between different versions and manufacturers' firmware, how to efficiently migrate and verify vulnerabilities has become a core issue that needs to be addressed. Therefore, a new method that can fully utilize the firmware homology and realize automated vulnerability migration and verification is urgently needed to effectively improve the efficiency and accuracy of vulnerability mining. Summary of the Invention

[0005] To solve the above technical problems, the present invention provides a firmware homology vulnerability mining method based on multi-dimensional feature profiling, comprising the following steps:

[0006] Step S1: Obtain a set of firmware to be tested and a set of firmware with known vulnerabilities, and format, pre-process, and standardize the firmware samples for storage;

[0007] Step S2: Input the pre-processed firmware set to be tested and the firmware set with known vulnerabilities into the firmware multi-dimensional heterogeneous feature portrait extraction module to extract multi-dimensional feature portraits, specifically including five dimensions: unpacking signature sequence portrait, vulnerability sensitive parameter call chain portrait, external communication interface portrait, boundary communication component symbol portrait and file layout portrait, to form a standardized set of five-dimensional feature portraits;

[0008] Step S3: Based on the five-dimensional feature portrait, multiple algorithms are used to calculate the multi-semantic firmware similarity between the known vulnerable firmware and the firmware to be detected, and a global similarity score is obtained through weighted fusion;

[0009] Step S4: Based on the global similarity score, analyze and screen out high-risk firmware samples to be detected, automatically generate vulnerability verification tasks, perform basic environment configuration, task distribution and multi-node parallel verification, and output vulnerability verification results.

[0010] Beneficial effects:

[0011] 1. This invention conducts a multi-dimensional comparison analysis between the firmware set to be tested and the firmware set with known vulnerabilities, and adopts technologies such as static analysis, feature extraction, and function call chain analysis. It can efficiently identify high-risk firmware and output preliminary vulnerability matching results. Traditional methods often rely on a single analysis method, with limited detection coverage and low accuracy.

[0012] 2. The present invention automatically unpacks the firmware, uses a firmware multi-dimensional heterogeneous feature vector extraction module to perform multi-dimensional feature extraction, and adopts a variety of algorithms such as the Jaccard coefficient for comprehensive analysis to form a complete similarity analysis chain, thus overcoming the problems of single feature extraction and limited similarity calculation methods in the prior art.

[0013] 3. The present invention configures the basic environment by running node 1 and generates verification tasks by running node 2, thereby realizing multi-node parallel verification, supporting firmware simulation, dynamic adjustment of permissions and automated verification script execution, which greatly improves the efficiency and accuracy of vulnerability verification. Traditional verification methods are mostly manual operations, which make it difficult to achieve large-scale automated verification.

[0014] 4. The present invention uses containerized sandbox technology to achieve standardized deployment and operation of each analysis module, building a complete closed-loop system from firmware parsing, similarity analysis, vulnerability verification to tool evaluation, supporting batch processing of large-scale, multi-architecture firmware, significantly improving the system's scalability, stability and analysis efficiency, and breaking through the limitations of traditional methods in terms of automation and system integration. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a flow chart of a firmware homology vulnerability mining method based on multi-dimensional feature profiling according to the present invention;

[0016] Figure 2 Schematic diagram of the structure of the method of the present invention. DETAILED DESCRIPTION

[0017] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only intended to illustrate the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below may be combined with each other as long as they do not conflict with each other.

[0018] In order to better understand the following embodiments, the terms used therein are explained as follows:

[0019] Firmware: Special software used to control hardware operations in embedded devices or IoT devices, usually stored in read-only memory such as ROM or Flash.

[0020] Binary files: Executable files or library files stored in binary format, which require special tools to analyze.

[0021] Vulnerability: A security flaw in firmware or software that can be exploited by an attacker.

[0022] Static analysis: A method that discovers security risks by analyzing code or binary structure without running the program.

[0023] Dynamic analysis: A method of discovering security issues by monitoring the behavior of a program (such as system calls, memory access, etc.) while the program is actually running.

[0024] Emulation / Firmware Emulation: Using software to simulate the hardware environment so that the firmware can run on non-native hardware.

[0025] Containers / Docker: A lightweight virtualization technology that packages applications and their dependencies to ensure consistent operation in different environments. Docker is a mainstream container platform.

[0026] Image: A read-only template used to create a container instance, including an application and its running environment.

[0027] Runtime node: An automated work unit or process responsible for performing specific tasks in an automated analysis or verification process.

[0028] Automatic scheduling system: a system component that automatically allocates and manages analysis tasks and computing resources.

[0029] JSON: A lightweight data interchange format.

[0030] Function call chain / call graph: a structured representation that describes the calling relationship between functions in a program.

[0031] Hash / Signature: Converts data into a unique short string through an algorithm for comparison and duplication checking.

[0032] Signature / Feature Extraction: Extracting representative structural, content, or behavioral information from binary files or firmware.

[0033] Feature vector: A set of numerical values ​​that represents the multidimensional features of an object (such as firmware or file).

[0034] Feature space: The multidimensional space of all possible values ​​of the feature vector.

[0035] Feature fusion / feature normalization / feature splicing / feature encoding / feature aggregation: multiple feature processing and combination methods are used to unify, standardize and enhance feature expression capabilities.

[0036] n-gram: Splits a sequence into contiguous subsequences of length n for pattern modeling.

[0037] Jaccard coefficient / algorithm: An indicator to measure the similarity between two sets. The higher the value, the more similar they are.

[0038] Edit distance: The minimum number of operations required to transform one sequence into another.

[0039] ssdeep Fuzzy Hash: A fuzzy hash algorithm for detecting structural similarity between files.

[0040] Behavioral baseline monitoring / behavioral analysis: monitors the behavioral characteristics of the system or program during runtime to determine anomalies or attacks.

[0041] Sandbox: An isolated runtime environment for safely executing and analyzing programs.

[0042] Regular expression: An expression used to describe string matching rules.

[0043] Information entropy / Shannon entropy: a statistic that measures the uniformity of information distribution.

[0044] Natural number space / real number space: The set of all natural numbers / real numbers in mathematics, often used to describe the value range of eigenvectors.

[0045] Normalization: Standardize values ​​of different dimensions or ranges to a uniform interval.

[0046] Similarity matrix / comparison matrix: Use a two-dimensional table to record the similarity scores between different objects.

[0047] Control samples: Firmware samples with known vulnerabilities, used to evaluate tool accuracy.

[0048] Vulnerability propagation / migration: The reuse and spread of the same vulnerability across different firmware, versions, or manufacturers.

[0049] Priority sorting: Sort the order of vulnerability repair based on factors such as the severity of the vulnerability.

[0050] Multimodal / multidimensional fusion: Joint analysis of features and data of multiple different types or sources.

[0051] Taint analysis: A technique for tracking how untrusted input to a program (such as user input) affects the program's execution.

[0052] Maximum matching: Find the maximum number of pairings in a set or graph.

[0053] Top-k / Top-n: Select the top k / n elements.

[0054] Weighted average / weighted fusion: Different features or scores are combined according to weights to obtain a comprehensive result.

[0055] Normalized Euclidean distance / cosine similarity: a commonly used distance or similarity measurement method between vectors.

[0056] Multi-node parallel / distributed verification: Multiple computing nodes collaborate and process tasks simultaneously.

[0057] Containerization / Automated Closed Loop: Use container technology to achieve a fully automated, standardized, and traceable system architecture.

[0058] Example 1

[0059] like Figure 1 As shown, an embodiment of the present invention provides a firmware homology vulnerability mining method based on multi-dimensional feature profiling, comprising the following steps:

[0060] Step S1: Obtain a set of firmware to be tested and a set of firmware with known vulnerabilities, and format, pre-process, and standardize the firmware samples for storage;

[0061] Step S2: Input the pre-processed firmware set to be tested and the firmware set with known vulnerabilities into the firmware multi-dimensional heterogeneous feature portrait extraction module to extract multi-dimensional feature portraits, specifically including five dimensions: unpacking signature sequence portrait, vulnerability sensitive parameter call chain portrait, external communication interface portrait, boundary communication component symbol portrait and file layout portrait, to form a standardized set of five-dimensional feature portraits;

[0062] Step S3: Based on the five-dimensional feature portrait, multiple algorithms are used to calculate the multi-semantic firmware similarity between the known vulnerable firmware and the firmware to be detected, and a global similarity score is obtained through weighted fusion;

[0063] Step S4: Based on the global similarity score, analyze and screen out high-risk firmware samples to be detected, automatically generate vulnerability verification tasks, perform basic environment configuration, task distribution and multi-node parallel verification, and output vulnerability verification results.

[0064] Existing firmware vulnerability mining methods mostly rely on traditional technical routes such as feature matching or taint analysis. These methods are not only highly dependent on manual labor, but also have obvious deficiencies in detection efficiency and accuracy. In contrast, the present invention systematically extracts five-dimensional features of the firmware's unpacking signature sequence portrait, vulnerability-sensitive parameter call chain portrait, external communication interface portrait, boundary communication component symbol portrait, and file layout portrait, to achieve a comprehensive characterization of the firmware's deep structure and behavior. On this basis, the present invention further introduces the use of multiple similarity modeling algorithms to perform a fusion analysis of the five-dimensional features, fully exploring the homology and code reuse relationships between firmwares, thereby significantly improving the automation level and accuracy of vulnerability detection. In addition, for cross-architecture and diversified firmware scenarios, the present invention effectively breaks through the bottlenecks of traditional methods in feature mapping and model generalization through standardized feature vectors and multi-dimensional similarity metrics, achieving efficient and accurate vulnerability migration detection and verification.

[0065] In one embodiment, the above step S1: obtaining a set of firmware to be detected and a set of firmware with known vulnerabilities, and formatting, preprocessing and standardizing the firmware samples for storage;

[0066] First, data collection, formatting and preprocessing are performed on the firmware to be tested and the firmware with known vulnerabilities to construct a standardized firmware analysis dataset, laying the foundation for subsequent feature extraction and comparative analysis.

[0067] In one embodiment, the above step S2: inputs the pre-processed firmware set to be detected and the known vulnerability firmware set into the firmware vulnerability existence analysis module to extract multi-dimensional feature portraits, specifically including: unpacking signature sequence portrait, vulnerability sensitive parameter call chain portrait, external communication interface portrait, boundary communication component symbol portrait and file layout portrait five dimensions, forming a standardized five-dimensional feature portrait set, specifically including:

[0068] Step S21: Use recursive unpacking algorithm to perform hierarchical analysis on the firmware image, extract embedded binary components, calculate multi-dimensional hash values, and construct unpacking signature sequence portrait features , specifically including:

[0069] Embedded firmware typically encapsulates multiple structural content fragments in an aggregated or compressed format, such as file system images, kernel images, initialization scripts, configuration sections, or key storage areas. Unlike traditional operating system images, the nesting relationships and encapsulation order of embedded firmware are highly variably implemented, posing significant challenges to structural analysis and content reuse detection.

[0070] To this end, the present invention proposes an unpacking signature sequence portrait, which is used to extract the semantic behavior trajectory of the firmware image during its structural expansion process to model its nested pattern and component organization characteristics. Specifically, the present invention regards the firmware as a linear byte stream, identifies the structural boundaries of nested components through a semantic signature matching mechanism, and symbolically encodes their order of appearance, thereby constructing a discrete structural trajectory sequence representing the unpacking behavior. This sequence depicts the logical deconstruction path of the firmware in a stable manner, and can provide a cross-sample comparable structural behavior representation without relying on file system mounting or complete parsing.

[0071] To make the structural trajectory computable and operational, the present invention further introduces formal modeling to construct it as a vectorizable nested behavior representation in the structural feature space. This process is divided into the following three steps:

[0072] Step S211: Structural signature trace extraction: Let the given firmware image be F. The nested structural components contained therein are identified through the structural matching process, and a unique semantic signature identifier is assigned to each structural content. The extracted signatures are arranged in the order of their appearance in the byte stream to form a structural signature sequence: ;in, Represents a finite set of structural signature symbols, each symbol Corresponding to an identified nested structure (such as a compressed container, file system, kernel segment, certificate data, path identifier, etc.). This sequence can be viewed as the structural behavior trajectory of the firmware during the logical unpacking process, reflecting the nested order and organizational characteristics of its content. Because this process does not rely on file system mounting or complete extraction, it has good adaptability and versatility, and is applicable to firmware samples in various architectures and packaging formats;

[0073] Step S212: Structural behavior abstraction: To improve the expressiveness of trajectory sequences and the semantic alignment capability across firmware, each firmware’s A sequence is abstracted as a structural behavior path, representing the sequence of structural states that a nested component goes through during the deconstruction process. Corresponding to an explicit unpacking behavior, its combined pattern can reveal the packaging strategy, module partitioning, or distribution template adopted during the firmware construction process. This abstraction process does not care about the actual offset or size of the components in physical space, but focuses on the stability and commonality of their behavioral sequence, nesting hierarchy, and semantic patterns, providing a structural foundation for subsequent firmware structure clustering, template attribution judgment, and behavior reuse analysis.

[0074] Step S213: Sequence pattern modeling and vectorization: In order to transform the structural behavior representation into a computable feature vector, the sequence Perform n-gram modeling and construct all its lengths The set of subsequence patterns of : ,in, The total continuous length extracted from the structural trajectory is The local structure fragment of ; frequency statistics are performed on the set to generate a vectorized representation of the n-gram pattern: ,in, Indicates the The pattern in The number of occurrences in is the dimension of the feature space. Finally, the vector That is, the structural representation of the firmware in this dimension can be used for subsequent similarity measurement and cross-sample clustering analysis;

[0075] Step S22: Based on the taint analysis technology, trace the propagation path of sensitive parameters during program execution and construct the vulnerability sensitive parameter call chain portrait feature ;

[0076] The communication parameters in the embedded firmware serve as the core control entry for function triggering and protocol scheduling, and their propagation paths in the program constitute the key channels of the potential vulnerability trigger chain. When parameters are passed into the processing logic without sufficient verification, especially sensitive functions involving memory copying or command splicing, serious vulnerabilities such as buffer overflow or command injection are easily triggered. Therefore, from the perspective of vulnerability propagation, the present invention proposes a vulnerability-sensitive parameter call chain portrait, which is used to statically model the function-level propagation path associated with the communication parameters and capture their sensitive interactive behaviors within the boundary program. This portrait focuses on the parameter propagation path triggered by sensitive functions in the boundary binary program, and constructs a structured call chain set through a three-stage modeling process, namely: parameter-aware chain extraction, address normalization and path reconstruction, and path sampling and sequence modeling. This portrait provides a unified structural basis for vulnerability context reconstruction, cross-sample propagation chain comparison, and semantic path alignment;

[0077] Step S221: Parameter Perception Chain Extraction: First, in each top-n boundary binary program, a set of sensitive functions involved in typical vulnerability patterns (such as strcpy, system, memcpy, snprintf, etc.) are identified as potential vulnerability triggers. Subsequently, static taint analysis methods are used to reversely trace the input parameter sources of these sensitive functions and extract a subset of communication parameters that have dependencies on them, recorded as:

[0078] ;

[0079] in, The number of sensitive parameters obtained for extraction; Each of Indicates the parameter name that appears at least once in the sensitive function propagation path. , further trace its propagation path and build its function-level call chain collection:

[0080] ;

[0081] Among them, each path Represents a call chain from the parameter input point to the sensitive function, in the form of a function sequence:

[0082] ;

[0083] Each function node in the path This may include raw information such as function names and disassembled addresses, representing the specific process of parameter passing and inter-function dependencies. The path set constructed at this stage covers all observable propagation path branches;

[0084] Step S222: Address normalization and path reconstruction: Due to differences in compilation configuration, load address, and symbol recovery between different firmware samples, directly using the original path will cause the sequence structure to lose alignment in cross-sample comparison. In order to improve the consistency of the call chain structure across firmware, the present invention defines a normalization operation. , removing all address information and retaining only the semantically expressive function names:

[0085] ;

[0086] ;

[0087] in, represents the function symbol extraction function, Indicates the The firmware sample An original call chain (including address information), which consists of a sequence of function nodes; For the The number of function nodes in the call chain; Indicates the normalized function name or placeholder; Indicates the first function nodes, which may contain original addresses, offsets, or disassembly locations; when path nodes are anonymous addresses or unsigned instruction locations, they are uniformly handled with placeholders. The processed call chain set can be expressed as:

[0088] ;

[0089] in, represents the total number of raw call chains extracted from the k-th firmware. Each chain in this set contains only function identifiers, forming a path representation that can be aligned across architectures and samples, laying a consistent foundation for subsequent structural comparison and similarity modeling.

[0090] Step S223: Path sampling and sequence modeling: In actual analysis, the same parameter may trigger a large number of call paths. If directly included in the modeling, it will lead to representation redundancy and reduce comparison efficiency. Therefore, the present invention samples the call paths according to the length of the call chain. Group them and keep up to five representative paths in each length category. Let the set of all path lengths be , the final sampling set is defined as:

[0091] ;

[0092] in, It means extracting up to five representative paths from the same type of paths according to the path position or function appearance order; Indicates the target length of the call chain.

[0093] This sampling method significantly reduces representation redundancy while preserving path diversity.

[0094] Step S224: Define the vulnerability sensitive parameter call chain profile characteristics of the firmware in the call chain dimension as follows:

[0095] ;

[0096] The normalized propagation path aggregates all communication parameters, possessing excellent structural stability and semantic interpretation. In subsequent firmware comparison tasks, the present invention uses edit distance as a call chain similarity metric, supporting a variety of downstream applications such as path structure alignment, propagation chain clustering, and potential vulnerability migration analysis.

[0097] Step S23: Through static analysis technology, extract interface identifiers, structural levels, configuration parameters and exposure features to build external communication interface profile features , specifically including:

[0098] The communication interface in embedded firmware constitutes the core path for interaction between external entities and devices. Its interface path and parameter semantics directly reveal the exposure surface and input control boundaries of system functions. A typical communication interface is the Web communication interface. Unlike traditional software, embedded firmware often lacks interface documentation and source code information. Its communication interface is usually statically distributed in the file system in the form of configuration scripts, HTML forms, or hard-coded strings. To accurately restore the visibility and organizational structure of the communication input surface, this paper proposes a communication interface exposure profile, which is used to extract the external communication paths and their associated parameters in the firmware and model potential functional entry points and attack surface structures. The modeling process of this profile includes the following three stages: interface identifier extraction, interface structure summary modeling, and communication input surface profile representation:

[0099] Step S231: Interface Identifier Extraction: First, a static scan is performed on the unpacked firmware file system, focusing on string constants within HTML pages, CGI paths, shell scripts, and binary programs. Paths such as / cgi-bin / upload_firmware.cgi or boafrm / formUpload represent function triggering entries, while parameter keys such as action and modelName reflect the communication semantic structure. The extracted interface paths and parameter names are defined as follows:

[0100] ;

[0101] ;

[0102] in, Indicates firmware The set of all resolvable interface paths in , is the number of interfaces in the collection, Represents a set of parameter names. The present invention retains the original string representation of the path and parameters without vector embedding or vocabulary indexing to maximize the preservation of their semantic structure and naming consistency.

[0103] Step S232: Interface structure summary modeling: To support compact representation and horizontal comparison of input surface features, we further introduce communication interface structure summary features, statistically analyze the interface structure distribution pattern of each sample, and construct the following five-dimensional statistical feature vector:

[0104] 1) Number of interface paths: , represents the cardinality of the communication path set;

[0105] 2) Number of parameter names: , represents the size of the input parameter set;

[0106] 3) Average path depth , measures the structural nesting level of the communication path and is defined as:

[0107] ;

[0108] in, For the communication path; for The number of / in;

[0109] 4) Path naming prefix entropy : It is used to measure whether the path is concentrated in a certain type of interface module (such as cgi-bin, boafrm, goform, etc.), and is defined as the discrete distribution entropy of the path prefix, where Prefix category The probability of occurrence in the path set, the prefix can be obtained by extracting the first-level directory name in the interface path:

[0110] ;

[0111] Where k is the total number of prefix categories;

[0112] 5) Parameter naming character entropy : Measures the character diversity of all parameter names, reflecting naming consistency and semantic sparsity, and is defined as follows:

[0113] ;

[0114] in, Represents the set of all characters that appear in the parameter name. For characters Relative frequency of occurrence (counted after concatenating all parameter names into a string);

[0115] The structure summary vector constructed based on this is defined as:

[0116] ;

[0117] vector It provides an overall description of the firmware communication input surface in terms of scale, nested structure, and naming conventions, which is suitable for cross-sample structure clustering and complexity analysis tasks.

[0118] Step S233: Communication input interface portrait representation: Define the firmware's external communication interface portrait as:

[0119] ;

[0120] in, 、 Capture input semantic surface information, Providing structural summary features, the three work together to express the content, scope and morphological distribution of the firmware input surface structure. The external communication interface portrait feature has the following three characteristics. First, it retains the original identifier and has higher semantic integrity and traceability; second, it supports the expression and alignment of input structures such as new sample interfaces and parameters; third, the structural summary feature supports multi-granularity analysis tasks and can characterize the systematic differences in scale, depth and standardization of communication input surfaces. The external communication interface portrait feature will be used as an important input for firmware similarity calculations in the future to assist in revealing the input path hierarchy, parameter design style and potential functional clustering relationships;

[0121] Step S24: Analyze the symbol table structure and function call naming convention of the boundary communication component to construct the symbol portrait feature of the boundary communication component ;

[0122] In embedded firmware, the boundary binary program serves as the core hub connecting the external communication interface and the internal control logic, and undertakes the key tasks of input processing, protocol parsing and system interaction. The function definitions, symbol table structures and identifiable semantic information contained therein directly reflect the external behavioral entry and internal functional layout of the device. In particular, these programs are often at the forefront of the system execution path, and the characteristics of their symbol exposure not only reveal the functional boundaries between modules, but also constitute the core jump points for vulnerability access paths and attack surface spread. In order to systematically model the structural characteristics of such programs at the symbolic layer, the present invention proposes a symbolic portrait of the boundary communication component, which extracts multi-dimensional information such as its imported functions, exported symbols, reconstructed symbol tables and function signatures through static analysis to form a structured semantic representation. The modeling process relies on the path and parameter sets extracted from the aforementioned communication interface portrait, and preferentially selects the top-n boundary programs that cover the most communication exposure. , forming the binary set to be analyzed:

[0123] ;

[0124] Where n3 is the number of boundary binary programs;

[0125] Then, a static disassembly analysis tool is used to analyze each We analyze each one of them and extract four core structures under the symbol exposure dimension: import function table, export symbol table, symbol table reconstruction information and recognizable function signatures. The overall modeling process consists of the following four stages:

[0126] Step S241: Import function table modeling: from Extract the external function set it depends on from the import table, recorded as:

[0127] ;

[0128] This set reflects the library functions or system interfaces that the binary program needs to link to during initialization and operation, and has strong behavioral orientation. The original function names in this set are recorded to support subsequent cross-sample behavior comparison. At the same time, in order to introduce quantitative features, the number of functions in this set is calculated. ;

[0129] in, Indicates the Boundary Program The Import symbol functions;

[0130] Step S242: Export symbol table modeling: Extract The set of function interfaces exposed to the outside world is defined as:

[0131] ;

[0132] in, Indicates the Boundary Program The An export symbol function;

[0133] This set includes function entries and global symbol names visible to other programs or modules, and is an important basis for analyzing interactions between components and service exposure. The original function names are also retained, and their quantitative composition characteristics are recorded:

[0134] ;

[0135] Step S243: Symbol table recovery modeling: During the static analysis process, try to restore The symbol information of the recognizable functions in is used to obtain the symbol set:

[0136] ;

[0137] in, Indicates the function name obtained by symbol restoration or debugging information recovery;

[0138] This set includes functions that are not exported but have symbolic features, such as debug information remnants or static functions hit by symbol recovery algorithms; their occurrence count is used as a feature: ;

[0139] Step S244: Function signature modeling: Perform signature matching and fingerprint extraction on all included functions to obtain the set of identifiable functions:

[0140] ;

[0141] in, Represents the function identifier identified by signature matching;

[0142] This set can be used to build comparisons with known vulnerable functions, protocol processing logic, etc. We record the matching results and the total number of functions: ;

[0143] Step S245: Finally, for each , concatenate the four types of statistical feature vectors to construct their symbolic statistical portraits:

[0144] ;

[0145] At the same time, the original four types of function sets are retained:

[0146] ;

[0147] In order to support multiple strategies such as string equality and function set intersection in symbol-level similarity analysis, the image vectors of all boundary binaries in the set are concatenated and aggregated to form the overall symbolic feature representation of the firmware:

[0148] ;

[0149] Where n4 is the number of boundary communication binary programs selected in firmware F;

[0150] It has scalability and semantic resolution, providing quantitative statistics on the exposed surface of the firmware symbol layer while retaining the symbol name foundation required for structural comparison. It has important analytical value in component identification, protocol analysis, semantic attribution, and vulnerability propagation path modeling.

[0151] Step S25: Analyze the file system layout, sensitive resource distribution pattern and binary component deployment strategy to build a file layout profile feature , specifically including:

[0152] After unpacking, embedded firmware usually contains a complete or nearly complete file system structure, which not only undertakes the organization and scheduling functions of system components, but also exposes a large amount of static information that can be exploited by attackers through path naming, file content and resource layout. In order to capture the multi-dimensional structure and semantic behavior in the file system, the present invention proposes a file system semantic profile (Filesystem Semantic Profile) to model the static characteristics of firmware in terms of path topology, sensitive resources, configuration exposure and binary file distribution. The profile consists of three modeling stages, corresponding to structural layout modeling, sensitive resource annotation and modeling, and binary resource signature profiles, and is finally integrated into a unified structural feature vector to support similarity analysis and clustering modeling of firmware in deployment mode, information leakage risk and resource reuse behavior:

[0153] Step S251: Structural layout modeling: To depict the structural differences of the firmware file system in terms of component organization and directory deployment, the present invention records the root directory of the unpacked file system as , whose structure can be formally represented as a directed tree ,in is the set of all reachable directories, For each directory, , define four types of metrics: its depth , that is, from the root directory to The path length of , which indicates the proportion of executable files in all files in a directory; its aggregation degree , which measures the number of files and subdirectories contained in the current directory; and the global directory distribution entropy , used to quantify the deployment uniformity and organizational complexity of the entire file system. Statistical summary of these indicators (such as mean and standard deviation ), construct the structural feature vector:

[0154] ;

[0155] in, and Represent the mean and standard deviation of all directory depths, and represents the average value of global executable density and aggregation degree, and is the normalized result of the Shannon entropy function applied to the distribution of the number of files in the directory; the vector Characterizes the structural behavior of the firmware file system in terms of organization, which helps analyze its component deployment habits and path construction patterns;

[0156] Step S252: Sensitive Resource Labeling and Modeling: For static assets in the file system that could lead to information leakage, authentication bypass, or system exposure, this paper constructs a path labeling system for firmware semantic content. This system covers three high-risk resource categories: authentication assets, static information, and configuration files. Through a rule-driven labeling mechanism, the static attack surface structure of different firmware samples is uniformly modeled.

[0157] Define all reachable paths in the file system as a path set , where each path Represents a file or directory node generated after unpacking. To identify its potential sensitive meaning, a set of regular rules is designed. , where each rule is associated with a semantic label One-to-one correspondence, is a set of semantic tags. Specifically, define the pattern matching function , used to convert the path Mapped to the label it matches The labeling system is further divided into the following three categories:

[0158] 1) Authentication asset exposure: This tag primarily identifies path characteristics related to key materials in authentication mechanisms and encryption protocols. We focus on the following resource paths: First, key and certificate files, such as those with extensions like .key, .pem, .crt, .cer, and .p12; second, paths representing password storage, such as common system password files like .htpasswd, shadow, and passwd; and third, SSH and TLS-related configuration paths, such as .ssh / , sshd_config, ssl.conf, and authorized_keys. Once exposed, these resources directly impact the security boundaries of remote access control, encrypted communications, and device authentication within the firmware.

[0159] 2) Static Information Leakage Indicators: This family of tags captures hardcoded static information in the firmware that could be used by attackers for target identification, device fingerprinting, or targeted attacks. We designed a set of patterns to identify features such as IP addresses, hardcoded URLs, email addresses, MAC addresses, and unique device identifiers, and incorporated these into information leakage tags in the file system. While these paths may not directly lead to vulnerabilities, they are often used as side-channel resources in actual attacks to accurately locate targets and gather environmental intelligence.

[0160] 3) Configuration Exposure Indicators: These tags identify configuration paths closely related to system components, service modules, and operational logic. We have defined a set of rules covering web services, database connections, automated scripts, and startup items, matching typical file paths and naming conventions such as .conf, .ini, .sql, .db, and .sh. Exposing these paths could allow attackers to directly access service operational logic, hard-coded database passwords, or automated script entry points, thereby exposing attack paths or access surfaces.

[0161] For each label Count its path collection , and construct the semantic feature vector of sensitive resources:

[0162] ;

[0163] in, Representation Label Frequency of occurrence in the firmware file system, is the total dimension of the label space. It comprehensively depicts the semantic profile of firmware samples in static exposure surfaces such as authentication, configuration, and information, and can provide a quantitative basis for downstream similarity analysis tasks.

[0164] Step S253: Binary resource signature modeling: This step focuses on the deployment location, content structure and potential reuse characteristics of the binary program in the unpacked file system. The present invention proposes a binary resource signature dimension for static modeling of the path distribution, string characteristics and structural fingerprints of typical executable files in firmware to support binary resource similarity analysis and component clustering between firmwares. All executable files with execution permissions or significant path semantics are formed into a set , where each Represents an independent binary file. Define three types of feature functions to describe the basic properties of each binary file:

[0165] ;

[0166] in, Indicates the path semantic hit flag, Represents a collection of primitive printable strings, Represents a fuzzy hash fingerprint; specifically:

[0167] 1) Path semantic features are generated by matching a set of predefined path patterns ,judge Is it deployed in a typical location (such as / bin / httpd, / usr / sbin / telnetd, / lib / libcrypto.so, etc.)? If it is, set , otherwise 0. Count the number of binaries of all hit paths as a structural representation of the deployment location;

[0168] 2) String summary features are extracted by each The collection of ASCII printable strings in , and only retain the length greater than the threshold (default ) constitutes its original semantic content set;

[0169] 3) Fuzzy fingerprint features are calculated by ssdeep hash value , forming its original content fingerprint. All fingerprints are collected Serves as the feature basis for subsequent cross-firmware fuzzy comparison;

[0170] Finally, the three types of features are uniformly modeled as a resource signature vector:

[0171] ;

[0172] in, Represents the resource collection of all paths hit, Represents the set of all printable strings in binary, Represents the raw ssdeep fingerprint of all binary files; As input for subsequent resource comparisons between firmwares, it supports operations such as path alignment, string set intersection analysis, and fuzzy fingerprint similarity matching. Its lightweight modeling process and semantic stability make it suitable for functional reuse analysis and similarity clustering tasks in large-scale firmware sample environments.

[0173] Step S254: Feature fusion and portrait representation: In order to uniformly represent the structural and semantic features in the above three dimensions, the structural layout vector , sensitive resource vector With binary resource vector Splice them in sequence to construct the semantic portrait vector of the firmware in the file system dimension:

[0174] ;

[0175] in, Represents a vector concatenation operation. It is comparable and interpretable between different firmware samples and can directly participate in downstream tasks such as structural similarity calculation.

[0176] File layout profiling provides a multi-dimensional, lightweight, and highly interpretable modeling approach. Its construction does not rely on file content decryption, system mounting, or dynamic analysis capabilities, resulting in excellent adaptability and analytical efficiency. It plays an important role in supporting tasks such as structural reuse detection and configuration exposure assessment.

[0177] Step S26: Construct a quintuple based on the above five different dimensional features , used to represent the five-dimensional feature portrait of firmware F.

[0178] In order to apply the above semantic portraits to the similarity modeling and semantic alignment tasks between firmware, this paper proposes a unified multi-dimensional semantic portrait similarity calculation method. As input, for each type of semantic portrait Designing a customized similarity metric function , and adopts differentiated similarity calculation strategies based on their feature types (such as sequence sets, path structures, statistical vectors, or call chains). On this basis, a fusion mechanism is further introduced to integrate the multi-dimensional scoring results and ultimately output a global semantic similarity index.

[0179] In one embodiment, the above step S3: based on the five-dimensional feature profile, multiple algorithms are used to calculate the multi-semantic firmware similarity between the known vulnerable firmware and the firmware to be detected, and a global similarity score is obtained through weighted fusion, specifically including:

[0180] Step S31: Unpacking signature sequence portrait aims to capture the nested structural behavior characteristics of the firmware image during the deconstruction process. Its core representation is the structural signature sequence. , and a set of structural subsequences extracted based on n-gram patterns With its frequency vector In order to achieve structural similarity modeling of different firmware in this dimension, the present invention designs a two-level similarity calculation method combining set matching and frequency statistics:

[0181] First, the known vulnerabilities and the firmware to be tested and , let the corresponding structural n-gram pattern sets be: and , where each Indicates the length is The unpacked signature sequence portrait subsequence;

[0182] The Jaccard similarity coefficient is used to measure the similarity of the unpacked signature sequence set;

[0183] ;

[0184] Secondly, for the n-gram pattern set Constructing a global unified vocabulary , and generate the frequency vector accordingly and ,in Indicates the Firmware structure fragment The frequency of occurrence of ; calculate the cosine similarity between the two in frequency space:

[0185] ;

[0186] in, Represents the inner product operation of two vectors; and are the Euclidean norms of the corresponding vectors;

[0187] Calculate the similarity of the unpacked signature sequence portrait features :

[0188] ;

[0189] The dual-level computational framework designed in this paper takes into account both the semantic structural consistency and behavioral frequency preferences of unpacked behavior, resulting in excellent stability, interpretability, and cross-sample versatility. In the subsequent multidimensional feature fusion process, this metric will serve as a key component of the structural expansion dimension and contribute to the overall firmware similarity modeling.

[0190] Step S32: Vulnerability-Sensitive Parameter Call Chain Profiling captures the semantic reach chain of potential vulnerabilities in embedded firmware by recording the parameter propagation paths associated with sensitive functions. To compare the structural similarities of such propagation chains across different firmwares, this paper uses edit distance as a chain-level similarity metric based on normalized function sequences and introduces a cross-set matching strategy to calculate firmware-level path similarity.

[0191] Step S321: Set firmware and The call chain portraits are and ;in, and Represents a single normalized function call chain, defined as an ordered sequence of function names and ;

[0192] Calculate the normalized similarity of the call chain path-level edit distance of the vulnerability sensitive parameters:

[0193] ;

[0194] in, and Respectively and The Article and A vulnerability sensitive parameter call chain, It is the edit distance between two vulnerability-sensitive parameter call chains, which is used to measure the minimum transformation cost between two function sequences. Operations include insertion, deletion, and replacement. and are the lengths of the call chains corresponding to the vulnerability sensitive parameters; The value of interval, where 1 indicates perfect agreement and 0 indicates no comparability;

[0195] Step S322: Calculate the similarity of vulnerability sensitive parameter call chain portrait features :

[0196] ;

[0197] in, and Respectively and The set of vulnerability sensitive parameter call chains extracted from for The total number of vulnerability sensitive parameter call chains, Indicates firmware The A vulnerability sensitive parameter call chain, express Middle Vulnerability sensitive parameter call chain and The maximum similarity value of all vulnerability sensitive parameter call chains in ;

[0198] While maintaining the accuracy of structural semantic comparisons, the system reduces the risk of mismatches caused by path misalignment, inconsistent quantities, and naming differences. By using call chain similarity as a semantic representation of function propagation behavior, the system can effectively identify firmware samples with similar vulnerability access paths, providing a structural foundation for cross-architecture vulnerability migration modeling and recurrence analysis.

[0199] Step S33: External communication interface exposure profile It aims to capture the external communication paths and parameter name structures in embedded firmware and describe the organization and complexity of its input boundaries through a structure summary vector. The portrait consists of three parts: interface path set , parameter name collection and structure summary feature vector Therefore, when calculating the similarity of the communication interface dimension between firmware, the present invention considers two types of features: semantic identifier set similarity (including path similarity and parameter similarity) and structural vector similarity, and fuses them in a unified metric space to construct a complete similarity index.

[0200] Step S331: Calculate path similarity:

[0201] ;

[0202] in, and Respectively and The communication interface path set extracted from for and The total number of interface paths, for and The union number of all interface paths;

[0203] Step S332: Calculate parameter similarity:

[0204] ;

[0205] in, and Respectively and The communication interface parameter keyword set extracted from for and The total number of parameter keywords, for and The union number of all parameter keywords;

[0206] and Effectively measure the degree of overlap between different firmware in terms of external exposure paths and input variable naming, providing a basis for interface structure alignment and functional commonality identification;

[0207] Step S333: At the structural level, the present invention uses the communication interface structure summary vector They respectively represent the number of interface paths, the number of parameter names, the average path depth, the path naming prefix entropy, and the parameter naming character entropy.

[0208] Compute the cosine similarity of the structural summary vectors:

[0209] ;

[0210] in, and They are and The communication interface structure summary feature vector, represents the inner product operation of two eigenvectors, and Corresponding to and The Euclidean norm of ;

[0211] Step S334: Calculate the similarity of external communication interface portrait features :

[0212] ;

[0213] in, 、 、 are the fusion weights of path similarity, parameter similarity, and structural summary vector cosine similarity, satisfying the normalization constraint ;

[0214] This measurement method offers three advantages: First, the Jaccard similarity of the original string set captures commonalities in interface naming and parameter semantics, making it suitable for cross-vendor path structure classification and cluster analysis. Second, the statistical summary vector provides a computable representation of the macroscopic structural outline, helping to characterize deployment complexity and naming consistency. Third, the fusion design supports collaborative modeling of multi-source features, enhancing the expressive power of semantic alignment and structural comparison of cross-architecture communication interfaces. This metric will be included in the global fusion score in subsequent firmware similarity assessments.

[0215] Step S34: The boundary binary program plays a key role in communication parsing and system interaction in embedded firmware. Its symbolic structure reflects the program's external dependencies, internal function organization, and identifiable behavioral signatures. In step S24, for each Top-n boundary program Constructed statistical feature vector With original symbol collection , used to express its exposure characteristics in four dimensions: imported functions, exported symbols, reconstructed symbol tables, and function signatures. To measure the structural similarity of different firmware along this semantic dimension, this paper models and integrates them from two perspectives: statistical features and symbol content.

[0216] Step S341: For any two firmware and , let their boundary program sets be , , the four-dimensional statistical vector for each program Perform average pooling to generate an overall statistical representation: and ;

[0217] Statistical vector average pooling after cosine similarity:

[0218] ;

[0219] in, and Respectively and The statistical feature vector of the boundary binary symbols after average pooling; Represents the inner product operation of two eigenvectors; and are the L2 norms of the corresponding vectors respectively;

[0220] Step S342: In order to further utilize the original function identification information, the four types of function sets of all boundary programs in each firmware are extracted and merged, which are recorded as:

[0221] ;

[0222] ;

[0223] Calculate the similarity of a set of symbols:

[0224] ;

[0225] in, and Respectively and The set of boundary binary symbols extracted from ; for and The total number of symbols, for and The number of unions of all symbols;

[0226] Step S343: Calculate the similarity of boundary communication component symbol image features :

[0227] ;

[0228] in, is the weight coefficient of the cosine similarity after statistical vector average pooling, is the corresponding weight of the symbol set similarity, and both satisfy the normalization constraint ;

[0229] The design takes into account both the structural statistical stability and the semantic integrity of the function set while maintaining computational efficiency. It is suitable for module function comparison and semantic behavior clustering between firmware sample pairs of different complexities.

[0230] Step S35: The file system semantic portrait statically depicts the deployment mode and attack surface structure of the embedded firmware from three aspects: structural organization, sensitive resource exposure, and binary deployment behavior. In order to measure the structural similarity of different firmware samples in this dimension, the present invention represents its overall characteristics. The features are broken down into three types of heterogeneous sub-features, and similarity calculations are performed using targeted measurement strategies for each of them. These features are then fused into an overall score at the vector level. The specific method is as follows:

[0231] Step S351: Firmware and The structural layout feature vectors are:

[0232] and

[0233] in, and Respectively The mean and standard deviation of all directory depths, and express The average value of the global executable density and aggregation degree, is the Shannon entropy function acting on The normalized result of the distribution of the number of files in the directory;

[0234] Normalized Euclidean distance is used to calculate the similarity of file system structure layout:

[0235] ;

[0236] in, and Respectively and The structural layout feature vector of is the L2 norm of the difference between two eigenvectors;

[0237] The result is in the interval The larger the value, the more similar the structural deployment features are. Normalization avoids the comparison bias caused by the difference in feature scale and is suitable for direct comparison of low-dimensional dense vectors.

[0238] Step S352: Sensitive resources are modeled as frequency vectors in a unified label space:

[0239] and , among which, dimension Representation Label exist The frequency of occurrence in . Since the label set To predefine a unified space, the dimensions of the two vectors remain consistent;

[0240] Calculate the cosine similarity of sensitive resource labels:

[0241] ;

[0242] in, and They are and Sensitive resource semantic feature vector, Represents the inner product operation of two vectors; and are the L2 norms of the corresponding vectors respectively;

[0243] The value range is , which is suitable for evaluating the directional consistency between high-dimensional sparse vectors and can effectively reflect the similarity of the types and quantity distributions of sensitive resources.

[0244] Step S353: The binary resource is represented by the path hit set , string collection and fuzzy hash sets It consists of three parts, describing the semantics of binary resources from the perspectives of deployment location, text content, and file structure:

[0245] Calculate the weighted fusion similarity of binary resource signatures:

[0246] ;

[0247] ;

[0248] ;

[0249] ;

[0250] in, Represents path semantic similarity, which is used to quantify the consistency of key binary file deployment locations between firmwares; 、 Represents the set of paths that hit the semantic label;

[0251] Indicates the similarity of string content, reflecting the degree of overlap of text semantic information between firmwares; 、 Represents a collection of printable strings;

[0252] It represents fuzzy hash similarity, which evaluates the structural similarity of binary files between firmwares; It is the hash similarity function provided by ssdeep; 、 Represents the set of raw ssdeep fingerprints of all binary files, express The number of elements in the collection;

[0253] Weight coefficient 、 、 The importance weights corresponding to path semantic similarity, string content similarity, and fuzzy hash similarity respectively, satisfying the normalization constraints ;

[0254] Step S354: Calculate the similarity of file layout image features :

[0255] ;

[0256] in, 、 、 They are the weights of structural layout similarity, cosine similarity of sensitive resource labels, and weighted fusion similarity of binary resource signatures, satisfying the normalization constraint conditions. ;

[0257] It ensures the collaborative modeling capability of multi-source features and provides a stable and reliable measurement basis for structural attribution judgment and behavior clustering at the file system level.

[0258] Step S36: Perform weighted fusion on the similarities of the five dimensions to obtain a global similarity score, specifically:

[0259] ;

[0260] in, is the weight coefficient of the similarity of each dimension, satisfying .

[0261] Because the file system semantic profile Because of its stable directory topology and high-dimensional static information density, it shows good discrimination and robustness in various scenarios, and it is recommended to give it a relatively high fusion weight. The remaining dimensions are equally important in expressing the program function exposure, input structure characteristics and vulnerability propagation path, and a balanced configuration is adopted to achieve complementary enhancement. In the embodiment of the present invention, .

[0262] In one embodiment, the above step S4: based on the global similarity score, analyzes and screens high-risk firmware samples to be detected, automatically generates vulnerability verification tasks, performs basic environment configuration, task distribution and multi-node parallel verification, and outputs vulnerability verification results, specifically including:

[0263] Step S41: Through the distributed verification agent, run node 1 to configure the basic environment, including operating system image pulling, dependency library installation, and firmware simulation tool preparation, and run node 2 to generate verification tasks, including firmware simulation and vulnerability verification task distribution;

[0264] In this step, running node 1 is responsible for building the basic environment and preparing the basic operating environment for subsequent vulnerability verification tasks, including but not limited to automatically pulling and configuring the operating system image, installing the necessary dependent libraries, and preparing the tools and scripts required for firmware simulation, etc., to ensure that each verification node can independently and stably run the firmware sample. Running node 2 simulates these high-risk firmware based on the basic operating environment built by running node 1, and automatically generates specific vulnerability verification tasks based on the previous vulnerability analysis report. Each task will describe in detail the type of vulnerability to be verified, verification method, input data, expected behavior, etc., and distribute these tasks to multiple running nodes to achieve parallel processing. In other words, a dedicated vulnerability environment is provided for each vulnerability corresponding to a high-risk firmware.

[0265] Step S42: Multi-node parallel verification process, where each running node independently performs binary firmware simulation, resource access authorization request, and vulnerability exploit success measurement;

[0266] Each running node can be regarded as an independent verification workstation, capable of processing different firmware samples and vulnerability verification tasks simultaneously. The main process of each running node includes:

[0267] 1) Binary firmware emulation: The node uses firmware emulation technology (such as QEMU or a dedicated emulator) to restore the firmware's actual operating environment within a dedicated environment provided by Runtime Node 2, based on the firmware's unique verification mechanism. This allows the firmware to run as if it were running on real hardware. This step is crucial for discovering actual vulnerability behavior.

[0268] 2) Resource access authorization request: In a simulation environment, some vulnerability verification may require higher system permissions or special access controls. The system automatically detects and dynamically adjusts permission settings as needed to ensure that the verification process covers all attack surfaces without compromising system security.

[0269] 3) Vulnerability exploit success measurement: This includes the following steps:

[0270] Step S421: Automatically execute the vulnerability verification script to attempt to trigger the target vulnerability, including but not limited to sending specific network data packets, constructing abnormal input, simulating attack behavior, etc.;

[0271] Step S422: Observe whether the firmware has any abnormal phenomena such as crash, unauthorized access, or sensitive data leakage;

[0272] Step S423: Based on the observation results, the accuracy of the vulnerabilities identified by different tools in the high-risk firmware is calculated.

[0273] Step S43: Result collection and determination: collect logs, abnormal events, and behavior data of each node in real time, determine whether the vulnerability is successfully triggered through the automated behavior analysis module, and perform credibility scoring on the verification results.

[0274] In one embodiment, the firmware homology vulnerability mining method based on multi-dimensional feature profiling further includes the following steps:

[0275] Containerized Verification Sandbox and Baseline Environment: The verification process is performed in a containerized sandbox. To ensure environmental consistency and reproducibility for each verification, all verification processes are performed within the sandbox container. Each node launches one or more containers with built-in standardized behavioral baseline verifiers that automatically record each step of the operation and results for subsequent analysis and traceability.

[0276] Result collection and assessment: During the verification process, the system collects logs, abnormal events, and behavioral data from each node in real time. Through the automated behavioral analysis module, the system can determine whether the vulnerability has been successfully triggered and assign a credibility score to each verification result.

[0277] Efficient Scalability and Coverage: The entire verification architecture supports horizontal scalability, dynamically increasing or decreasing runtime nodes based on the number of firmware samples and task complexity, enabling large-scale parallel verification. This not only significantly improves verification efficiency but also ensures comprehensive coverage of firmware of different types and architectures.

[0278] Through the above process, automated, batch, and standardized verification of high-risk firmware vulnerabilities can be achieved, greatly improving the accuracy and efficiency of vulnerability detection, and providing solid data support for subsequent vulnerability repair and security reinforcement.

[0279] Figure 2 Schematic diagram of the structure of the method of the present invention.

[0280] Example 2

[0281] The embodiment of the present invention provides a firmware homology vulnerability mining system based on multi-dimensional feature profiling, including the following modules:

[0282] The preprocessing module is used to obtain the firmware set to be tested and the firmware set with known vulnerabilities, and format, preprocess and standardize the firmware samples for storage;

[0283] The firmware multi-dimensional heterogeneous feature portrait extraction module is used to input the pre-processed firmware set to be tested and the firmware set with known vulnerabilities into the firmware vulnerability analysis module for multi-dimensional feature extraction. Specifically, it includes five dimensions: unpacking signature sequence portrait, vulnerability sensitive parameter call chain portrait, external communication interface portrait, boundary communication component symbol portrait and file layout portrait, forming a standardized set of five-dimensional feature portraits;

[0284] The firmware multi-dimensional feature portrait similarity calculation module is used to calculate the multi-semantic firmware similarity between the known vulnerable firmware and the firmware to be tested based on the five-dimensional feature portrait, using multiple algorithms, and obtains the global similarity score through weighted fusion;

[0285] The firmware security vulnerability verification module is used to analyze and screen high-risk firmware samples to be tested based on the global similarity score, automatically generate vulnerability verification tasks, perform basic environment configuration, task distribution and multi-node parallel verification, and output vulnerability verification results.

[0286] A firmware homologous vulnerability mining device based on multi-dimensional feature profiling includes one or more electronic devices, wherein the one or more electronic devices are used to implement a firmware homologous vulnerability mining method based on multi-dimensional feature profiling.

[0287] An electronic device includes: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement a firmware homology vulnerability mining method based on multi-dimensional feature profiling.

[0288] A computer-readable storage medium stores executable instructions, which, when executed by a processor, enable the processor to implement a firmware homology vulnerability mining method based on multi-dimensional feature profiling.

[0289] The foregoing description is intended only to provide specific embodiments of the present invention, which will enable those skilled in the art to understand and implement the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features of the present invention.

Claims

1. A firmware homology vulnerability mining method based on multi-dimensional feature profiling, characterized in that: include: Step S1: Obtain a set of firmware to be tested and a set of firmware with known vulnerabilities, and format, pre-process, and standardize the firmware samples for storage; Step S2: The pre-processed firmware set to be tested and the firmware set with known vulnerabilities are input into the firmware multi-dimensional heterogeneous feature portrait extraction module for multi-dimensional feature portrait extraction, specifically including five dimensions: unpacking signature sequence portrait, vulnerability sensitive parameter call chain portrait, external communication interface portrait, boundary communication component symbol portrait and file layout portrait, forming a standardized five-dimensional feature portrait set, specifically including: Step S21: Use recursive unpacking algorithm to perform hierarchical analysis on the firmware image, extract embedded binary components, calculate multi-dimensional hash values, and construct unpacking signature sequence portrait features ; Step S22: Based on the taint analysis technology, trace the propagation path of sensitive parameters during program execution and construct the vulnerability sensitive parameter call chain portrait feature ; Step S23: Through static analysis technology, extract interface identifiers, structural levels, configuration parameters and exposure features to build external communication interface profile features ; Step S24: Analyze the symbol table structure and function call naming conventions of the boundary communication component to construct the symbol portrait features of the boundary communication component ; Step S25: Analyze the file system layout, sensitive resource distribution pattern and binary component deployment strategy to build a file layout profile feature ; Step S26: Construct a quintuple based on the above five different dimensional features , used to represent the five-dimensional feature portrait of firmware F; Step S3: Based on the five-dimensional feature portrait, multiple algorithms are used to calculate the multi-semantic firmware similarity between the known vulnerable firmware and the firmware to be detected, and a global similarity score is obtained through weighted fusion; Step S4: Based on the global similarity score, analyze and screen out high-risk firmware samples to be detected, automatically generate vulnerability verification tasks, perform basic environment configuration, task distribution and multi-node parallel verification, and output vulnerability verification results.

2. The firmware homology vulnerability mining method based on multi-dimensional feature profiling according to claim 1 is characterized in that: Step S3: Based on the five-dimensional feature portrait, multiple algorithms are used to calculate the multi-semantic firmware similarity between the known vulnerable firmware and the firmware to be detected, and a global similarity score is obtained through weighted fusion, specifically including: Step S31: First, the known vulnerabilities and the firmware to be tested are and , let the corresponding structural n-gram pattern sets be: and , where each Indicates the length is The unpacked signature sequence portrait subsequence; The Jaccard similarity coefficient is used to measure the similarity of the unpacked signature sequence set; ； Secondly, for the n-gram pattern set Constructing a global unified vocabulary , and generate the frequency vector accordingly and ,in, Indicates the Firmware structure fragment The frequency of occurrence of ; calculate the cosine similarity between the two in frequency space: ； in, Represents the inner product operation of two vectors; and are the Euclidean norms of the corresponding vectors; Calculate the similarity of the unpacked signature sequence portrait features : ； Step S32: Calculate the normalized similarity of the vulnerability sensitive parameter call chain path level edit distance: ； in, and Respectively and The Article and A vulnerability sensitive parameter call chain, is the edit distance between two vulnerability-sensitive parameter call chains, and are the lengths of the call chains corresponding to the vulnerability sensitive parameters; Calculate the similarity of vulnerability sensitive parameter call chain portrait features : ； in, and Respectively and The set of vulnerability sensitive parameter call chains extracted from for The total number of vulnerability sensitive parameter call chains, Indicates firmware The A vulnerability sensitive parameter call chain, express Middle Vulnerability sensitive parameter call chain and The maximum similarity value of all vulnerability sensitive parameter call chains in ; Step S33: Calculate path similarity: ； in, and Respectively and The communication interface path set extracted from for and The total number of interface paths, for and The union number of all interface paths; Calculate parameter similarity: ； in, and Respectively and The communication interface parameter keyword set extracted from for and The total number of parameter keywords, for and The union number of all parameter keywords; Compute the cosine similarity of the structural summary vectors: ； in, and They are and The communication interface structure summary feature vector, represents the inner product operation of two eigenvectors, and Corresponding to and The Euclidean norm of ; Calculate the similarity of external communication interface portrait features : ； in, 、 、 are the fusion weights of path similarity, parameter similarity, and structural summary vector cosine similarity, satisfying the normalization constraint ; Step S34: Calculate the cosine similarity of the statistical vector average pooling: ； in, and Respectively and The statistical feature vector of the boundary binary symbols after average pooling; Represents the inner product operation of two eigenvectors; and are the L2 norms of the corresponding vectors respectively; Symbol set similarity: ； in, and Respectively and The set of boundary binary symbols extracted from ; for and The total number of symbols, for and The number of unions of all symbols; Calculate the similarity of boundary communication component symbol portrait features : ； in, is the weight coefficient of the cosine similarity after statistical vector average pooling, is the corresponding weight of the symbol set similarity, and both satisfy the normalization constraint ; Step S35: Calculate the similarity of the file system structure layout using normalized Euclidean distance: ； in, and Respectively and The structural layout feature vector of is the L2 norm of the difference between two eigenvectors; Calculate the cosine similarity of sensitive resource labels: ； in, and They are and Sensitive resource semantic feature vector, Represents the inner product operation of two vectors; and are the L2 norms of the corresponding vectors respectively; Calculate the weighted fusion similarity of binary resource signatures: ； ； ； ； in, Represents path semantic similarity, which is used to quantify the consistency of key binary file deployment locations between firmwares; 、 Represents the set of paths that hit the semantic label; Indicates the similarity of string content, reflecting the degree of overlap of text semantic information between firmwares; 、 Represents a collection of printable strings; It represents fuzzy hash similarity, which evaluates the structural similarity of binary files between firmwares; It is the hash similarity function provided by ssdeep; 、 Represents the set of raw ssdeep fingerprints of all binary files, express The number of elements in the collection; Weight coefficient 、 、 The importance weights corresponding to path semantic similarity, string content similarity, and fuzzy hash similarity respectively, satisfying the normalization constraints ; Calculate the similarity of file layout image features : ； in, 、 、 They are the weights of structural layout similarity, cosine similarity of sensitive resource labels, and weighted fusion similarity of binary resource signatures, satisfying the normalization constraint conditions. ; Step S36: Perform weighted fusion on the similarities of the five dimensions to obtain a global similarity score, specifically: ； in, is the weight coefficient of the similarity of each dimension, satisfying .

3. The firmware homology vulnerability mining method based on multi-dimensional feature profiling according to claim 1 is characterized in that: The step S4: based on the global similarity score, analyze and screen out high-risk firmware samples to be detected, automatically generate vulnerability verification tasks, perform basic environment configuration, task distribution and multi-node parallel verification, and output vulnerability verification results, specifically including: Step S41: Through the distributed verification agent, run node 1 to configure the basic environment, including operating system image pulling, dependency library installation, and firmware simulation tool preparation, and run node 2 to generate verification tasks, including firmware simulation and vulnerability verification task distribution; Step S42: Multi-node parallel verification process, where each running node independently performs binary firmware simulation, resource access authorization request, and vulnerability exploit success measurement; Step S43: Result collection and determination: collect logs, abnormal events, and behavior data of each running node in real time, determine whether the vulnerability is successfully triggered through the automated behavior analysis module, and perform credibility scoring on the verification results.

4. The firmware homology vulnerability mining method based on multi-dimensional feature profiling according to claim 3 is characterized in that: The vulnerability exploitation success measurement in step S42 specifically includes: Step S421: Automatically execute the vulnerability verification script to try to trigger the target vulnerability; Step S422: Observe whether the firmware has any abnormal phenomena such as crash, unauthorized access, or sensitive data leakage; Step S423: Based on the observation results, the accuracy of the vulnerabilities identified by different tools in the high-risk firmware is calculated.

5. The firmware homology vulnerability mining method based on multi-dimensional feature profiling according to claim 1 is characterized in that: The step S4: based on the global similarity score, analyzing and screening high-risk firmware samples to be detected, automatically generating vulnerability verification tasks, performing basic environment configuration, task distribution and multi-node parallel verification, and outputting vulnerability verification results, further includes: All verification processes are carried out in a containerized sandbox; operations and results are automatically recorded through a built-in standardized behavioral baseline verifier; a dynamic expansion mechanism dynamically adjusts the number of running nodes based on the number of firmware samples and task complexity.

6. A firmware homology vulnerability mining system based on multi-dimensional feature profiling, characterized in that: Includes the following modules: The preprocessing module is used to obtain the firmware set to be tested and the firmware set with known vulnerabilities, and format, preprocess and standardize the firmware samples for storage; The firmware multi-dimensional heterogeneous feature portrait extraction module is used to input the pre-processed firmware set to be detected and the firmware set with known vulnerabilities into the firmware vulnerability analysis module for multi-dimensional feature extraction. Specifically, it includes five dimensions: unpacking signature sequence portrait, vulnerability sensitive parameter call chain portrait, external communication interface portrait, boundary communication component symbol portrait and file layout portrait, forming a standardized five-dimensional feature portrait set, specifically including: Step S21: Use recursive unpacking algorithm to perform hierarchical analysis on the firmware image, extract embedded binary components, calculate multi-dimensional hash values, and construct unpacking signature sequence portrait features ; Step S22: Based on the taint analysis technology, trace the propagation path of sensitive parameters during program execution and construct the vulnerability sensitive parameter call chain portrait feature ; Step S23: Through static analysis technology, extract interface identifiers, structural levels, configuration parameters and exposure features to build external communication interface profile features ; Step S24: Analyze the symbol table structure and function call naming conventions of the boundary communication component to construct the symbol portrait features of the boundary communication component ; Step S25: Analyze the file system layout, sensitive resource distribution pattern and binary component deployment strategy to build a file layout profile feature ; Step S26: Construct a quintuple based on the above five different dimensional features , used to represent the five-dimensional feature portrait of firmware F; A firmware multi-dimensional feature portrait similarity calculation module is used to perform multi-semantic firmware similarity calculation on the known vulnerability firmware and the firmware to be detected based on the five-dimensional feature portrait using multiple algorithms, and obtain a global similarity score through weighted fusion; The firmware security vulnerability verification module is used to analyze and screen high-risk firmware samples to be detected based on the global similarity score, automatically generate vulnerability verification tasks, perform basic environment configuration, task distribution and multi-node parallel verification, and output vulnerability verification results.

7. A firmware homology vulnerability mining device based on multi-dimensional feature profiling, characterized in that: The method comprises one or more electronic devices, wherein the one or more electronic devices are configured to implement the method according to any one of claims 1 to 5.

8. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method according to any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that Executable instructions are stored thereon, and when the instructions are executed by a processor, the processor implements the method according to any one of claims 1 to 5.

Images