Adaptive fusion attention-based convolutional neural network firmware vulnerability detection method

Abstract

The invention relates to a convolutional neural network firmware vulnerability detection method based on adaptive fusion attention. According to the firmware vulnerability detection method, a firmware vulnerability detection model based on a convolutional neural network is adopted to evaluate whether a firmware binary file of power edge equipment is normal firmware or vulnerability-containing firmware. The self-adaptive attention feature calculation in the firmware vulnerability detection model is improved as follows: calculating a channel attention feature Achannel and a space attention feature Aspatial according to an input convolution feature graph X, calculating a dynamic fusion weight alpha dyn by using a layer of full connection through a calibrated global feature Fglobal, and obtaining a weighted attention fusion feature Aadaptive by self-adaptive fusion of the Achannel and the space attention feature, and multiplying with X element by element, and finally outputting an enhanced attention fusion feature map. The technical problems that local and global features are difficult to consider in firmware vulnerability detection by the existing CNN, different vulnerability type features cannot be self-adapted, and vulnerability key features cannot be effectively represented are solved.

Description

Technical Field

[0001] This invention relates to a firmware vulnerability detection method, and more particularly to a firmware vulnerability detection method based on an adaptive fusion attention convolutional neural network, and a firmware vulnerability detection device employing the aforementioned firmware vulnerability detection method. Background Technology

[0002] Firmware vulnerability detection plays a crucial role in key areas such as industrial control, smart terminals, the Internet of Things (IoT), automotive electronics, and aerospace. Firmware vulnerabilities can lead to malicious attacks on devices, privilege escalation, and even disruption of normal system operation. Therefore, timely and efficient detection of firmware vulnerabilities is a critical means of ensuring system security. For example, power edge devices (such as smart meters, distribution terminals, and edge computing gateways) are widely deployed in new power systems. Vulnerabilities in their embedded firmware programs can lead to remote control breaches, data tampering, or service interruptions, seriously threatening power grid security. Currently, firmware vulnerability detection methods mainly include analytical model-based methods and data-driven methods.

[0003] The analytical model-based approach relies on reverse engineering, symbolic execution, and static code analysis. It requires accurate firmware modeling and complete code information acquisition. If the firmware architecture changes, it needs to be remodeled, resulting in low applicability.

[0004] Data-driven approaches acquire a large number of firmware samples through data mining and train them using deep learning models to achieve automated vulnerability detection. This method does not rely on precise physical models and can adapt well to different firmware environments. For example, firmware vulnerability detection methods based on convolutional neural networks (CNNs) have powerful local feature extraction capabilities, effectively identifying vulnerability patterns in firmware. However, CNNs still have limitations in vulnerability detection tasks; relying solely on convolutional layers to extract features may not fully capture the global and local information of vulnerabilities, leading to limited detection accuracy. To improve the performance of CNNs in firmware vulnerability detection, attention mechanisms are introduced, enabling the network to focus on more important vulnerability feature regions.

[0005] However, traditional attention mechanisms mainly include channel attention. feature and spatial attention feature Channel attention feature By calculating the weights of different channels, the model focuses on more discriminative channel information, while spatial attention... feature This enhances the feature representation of key regions by calculating the importance of different spatial locations. The The attention mechanism still has some limitations in firmware vulnerability detection tasks. First, in fusion channel attention... feature Spatial attention feature The current approach uses a fixed fusion strategy, which cannot adaptively adjust to different types of firmware vulnerabilities, resulting in insufficient feature extraction. Secondly, due to the complexity of firmware data structures, the distribution of vulnerability features varies significantly across different categories. Optimizing the attention mechanism to maintain good generalization ability across different vulnerability detection tasks is a pressing issue that needs to be addressed. Summary of the Invention

[0006] (1) Technical problems to be solved

[0007] To address the technical problems of existing CNNs in firmware vulnerability detection, such as difficulty in taking into account both local and global features, inability to adapt to different vulnerability types, and inability to effectively characterize key vulnerability features, this invention provides a firmware vulnerability detection method based on adaptive attention-fusion convolutional neural networks and a firmware vulnerability detection device employing the aforementioned method.

[0008] (2) Technical solution

[0009] This invention provides a firmware vulnerability detection method based on adaptive fusion attention feature enhancement using a convolutional neural network. It employs a convolutional neural network-based firmware vulnerability detection model to evaluate whether the firmware binary file of a power edge device is normal or contains vulnerabilities. The adaptive attention feature calculation in the firmware vulnerability detection model calculates channel attention features A based on the input convolutional feature map X. channel Spatial attention feature A spatial The attention fusion feature map is output based on the fusion weights. The adaptive attention feature calculation is improved by using the calibrated global feature F. global Dynamic fusion weights αdyn are computed using a single fully connected layer to adaptively fuse A. channel and A spatial Obtain weighted attention fusion feature A adaptive Then multiply it element-wise with X to output the enhanced attention fusion feature map Z;

[0010]

[0011] α dyn =σ(W α ·F global +b α )

[0012] A adaptive =α dyn ·A channel +(1-α dyn )·A spatial

[0013] Z = X⊙A adaptive

[0014] In the formula, H and W are the total length and total width in pixels of X, respectively; i1 and j represent the index values ​​from 1 to H and from 1 to W, respectively; X(i,j,c,n) is the feature of sample n in X at pixel position (i1,j) in channel c; σ(·) is the Sigmoid activation function, W α It is a fully connected weight matrix, b α It is W α The bias term.

[0015] As a further improvement to the above solution, firmware vulnerability detection methods include:

[0016] Convert the firmware binary files of power edge devices into firmware image datasets in a format that can be accepted by convolutional neural networks.

[0017] A firmware vulnerability detection model based on convolutional neural networks is adopted. The firmware image dataset is processed sequentially as follows: convolution + batch normalization + ReLU activation → adaptive attention feature calculation → pooling → fully connected → classification. The classification result is output. The input of the adaptive attention feature calculation is the convolutional feature map X, and the output is the enhanced attention fusion feature map Z.

[0018] Furthermore, the firmware image data conversion method includes the following steps:

[0019] Read firmware data in bin format from the firmware binary file and parse it in binary mode, during which byte padding is required;

[0020] The parsed one-dimensional binary data is then converted into a two-dimensional matrix format. At the same time, all firmware data in the two-dimensional matrix format is converted into standardized grayscale images and uniformly adjusted to the calibrated pixel size, finally outputting a firmware image dataset of uniform specifications.

[0021] As a further improvement to the above scheme, two fully connected layers are used to compress and expand the channel information of the convolutional feature map X to obtain the channel attention feature A. channel .

[0022] As a further improvement to the above scheme, channel attention feature A channel The calculation method includes the following steps:

[0023] The convolutional feature map X is reshaped to flatten its spatial dimensions, forming a tensor of shape [L,C,N], where L represents the total spatial length, C is the number of channels, and N is the batch dimension.

[0024] Perform channel-wise 1D convolution on the tensor and use TD-Conv1D to compute the global features of each channel;

[0025] The channel attention feature A is obtained by computing the global features through two fully connected layers. channel .

[0026] Furthermore, tensor X reshape for:

[0027] X reshape =reshape(X,[L,C,N]) (1)

[0028] Where X is the convolutional feature map;

[0029] The global feature of the c-th channel is:

[0030]

[0031] Among them, X reshape (i,c) represents the feature at the c-th channel and the i-th spatial length of the tensor, K(i,c) represents the TD-Conv1D convolution kernel at the c-th channel and the i-th spatial length of the tensor, and B(c) is the bias term of K(i,c); Channel attention feature A channel for:

[0032]

[0033] Where σ(·) is the Sigmoid activation function, and It is the weight matrix for channel compression and expansion. and It corresponds to W c 1 and W c 2 The bias term, PReLU, is used as an activation function to introduce nonlinear features, F TD For channel_feature(c).

[0034] As a further improvement to the above scheme, spatial features of the convolutional feature map X are extracted through 3×3 convolution, and spatial attention weights are calculated by combining the bias term to obtain spatial attention features A. spatial .

[0035] As a further improvement to the above scheme, spatial attention feature A spatial The calculation method includes the following steps:

[0036] Calculate global pooling features for the convolutional feature map X, and perform channel average pooling to obtain channel average features; calculate the maximum value of each pixel in the channel dimension of the convolutional feature map, and perform channel max pooling to obtain channel maximum features.

[0037] The final spatial attention feature A is obtained by concatenating channel average pooling and channel max pooling. spatial .

[0038] Furthermore, the channel average characteristics are as follows:

[0039]

[0040] Where C is the number of channels, spatial_avg(i,j,n) is the average channel feature of sample n at position (i,j) in all channels, and X(i,j,c,n) is the feature of sample n at position (i,j) in channel c in the convolutional feature map.

[0041] The most prominent feature of a channel is:

[0042]

[0043] Where spatial_max(i,j,n) is the maximum channel feature of sample n at position (i,j) in all channels;

[0044] Spatial attention feature A spatial for:

[0045] A spatial =σ(Conv2D(conact(F) avg, F max )),W s ,b s (6)

[0046] Where σ(·) is the Sigmoid activation function, contact(·) is the concatenation function, Conv2D(·) is the convolution function, and F avg It is spatial_avg(i,j,n), F max It is spatial_max(i,j,n), W s It is a 3×3 convolution kernel; b s It is W s The bias.

[0047] The present invention also provides a firmware vulnerability detection device based on adaptive fusion attention feature enhancement convolutional neural network, comprising:

[0048] The conversion module is used to convert the firmware binary files of power edge devices into firmware image datasets in a format that can be accepted by convolutional neural networks.

[0049] The firmware vulnerability detection module is used to evaluate whether the firmware binary file of the power edge device is normal firmware or contains vulnerabilities, using a firmware vulnerability detection model based on convolutional neural networks. The firmware vulnerability detection model includes: input layer → "convolution + batch normalization + ReLU activation" layer → adaptive attention calculation layer → pooling layer → fully connected layer → classification layer.

[0050] The adaptive attention computation layer is used to compute the enhanced attention fusion feature map Z and output it to the pooling layer using any of the above-mentioned adaptive fusion attention feature enhancement convolutional neural network firmware vulnerability detection methods, on the convolutional feature map X output by the "convolution + batch normalization + ReLU activation" layer.

[0051] (3) Beneficial effects

[0052] Compared with the prior art, this invention, on the one hand, dynamically fuses channel attention features A channel Spatial attention feature A spatial This effectively improves the generalization ability of firmware vulnerability detection models based on convolutional neural networks. On the other hand, the weighted attention fusion feature A adaptive Element-wise multiplication with the convolutional feature map X yields an enhanced attention fusion feature map Z. TD-Conv1D is used to improve the expressive power of channel features and avoid information loss. Thirdly, the channel attention feature A... channel Spatial attention feature A spatial Derived from convolutional feature map X, and dynamically fused with it, it works synergistically with convolutional feature map X to effectively characterize key vulnerability features, achieving a lightweight spatial attention mechanism, improving detection efficiency, and adapting to edge devices. Therefore, this invention solves the technical problems of existing CNNs in firmware vulnerability detection, such as difficulty in simultaneously considering local and global features, inability to adapt to different vulnerability types, and inability to effectively characterize key vulnerability features. Attached Figure Description

[0053] Figure 1 This is a flowchart of the firmware vulnerability detection method based on adaptive fusion attention feature enhancement of convolutional neural networks provided in Embodiment 1 of the present invention.

[0054] Figure 2 yes Figure 1 A flowchart of the adaptive attention feature calculation method used in the firmware vulnerability detection method.

[0055] Figure 3 yes Figure 2 The adaptive attention feature calculation method uses channel attention feature A. channel The calculation method flowchart.

[0056] Figure 4yes Figure 2 The spatial attention feature A used in the adaptive attention feature calculation method spatial The calculation method flowchart.

[0057] Figure 5 Is adopted Figure 1 A schematic diagram of the simulation results of the firmware vulnerability detection method. Detailed Implementation

[0058] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] It should be noted that when a component is said to be "installed on" another component, it can be directly on the other component or it may be in a component that is centered on it. When a component is said to be "set on" another component, it can be directly set on the other component or it may also be in a component that is centered on it. When a component is said to be "fixed to" another component, it can be directly fixed to the other component or it may also be in a component that is centered on it.

[0060] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the specification of this invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "or / and" as used herein includes any and all combinations of one or more of the associated listed items.

[0061] Example 1

[0062] Please see Figure 1 , Figure 1 This is a flowchart of the firmware vulnerability detection method based on adaptive fusion attention feature enhancement of convolutional neural networks provided in Embodiment 1 of the present invention. The convolutional neural network firmware vulnerability detection method employs a firmware vulnerability detection model based on convolutional neural networks. The process involves inputting the preprocessed firmware binary file of the power edge device → convolution + batch normalization + ReLU activation → adaptive attention feature calculation → pooling → fully connected layer → classification and outputting the classification result: evaluating whether the firmware binary file is normal firmware or contains vulnerabilities. Generally, the adaptive attention feature calculation calculates the channel attention feature A based on the input convolutional feature map X. channel Spatial attention feature A spatial The adaptive attention feature calculation of this invention is improved by using the calibrated global feature F, and outputting an attention fusion feature map based on the fusion weight.global Dynamic fusion weights αdyn are computed using a single fully connected layer to adaptively fuse A. channel and A spatial Obtain weighted attention fusion feature A adaptive Then, multiply it element-wise with X to output an enhanced attention fusion feature map Z.

[0063] This embodiment of the firmware vulnerability detection method based on adaptive fusion attention feature enhancement of convolutional neural network (CNN) includes the following steps: converting the firmware binary file of the power edge device into a firmware image dataset in a format that can be accepted by the convolutional neural network; using a firmware vulnerability detection model based on convolutional neural network, sequentially performing → convolution + batch normalization + ReLU activation → adaptive attention feature calculation → pooling → fully connected → classification on the firmware image dataset, and outputting the classification result: evaluating whether the firmware binary file is normal firmware or firmware containing vulnerabilities.

[0064] Preprocessing of firmware binary files can employ traditional binary file conversion methods to process the firmware data. For example, the conversion method for firmware image data may include the following steps: reading firmware data in bin format from the firmware binary file and parsing it in binary mode, requiring byte padding during the parsing process; subsequently, converting the parsed one-dimensional binary data into a two-dimensional matrix format; simultaneously, converting all firmware data in the two-dimensional matrix format into standardized grayscale images and uniformly adjusting them to a calibrated pixel size, such as 2000×2000 pixels, finally outputting a firmware image dataset of uniform specifications.

[0065] Before use, the firmware vulnerability detection model of this invention needs to be trained with training set data until the model is stable, and then the accuracy of the model is verified with test set data. For example, firmware files in bin format can be read from the "normal" firmware folder and the "vulnerable" firmware folder containing firmware binary files, respectively, and parsed in binary mode. The read firmware data is preprocessed, including byte padding to ensure data integrity, and the one-dimensional binary data is converted into a two-dimensional matrix format to meet the input requirements of the subsequent deep learning model. At the same time, to ensure the consistency of input data, all firmware data is converted into standardized grayscale images and adjusted to a uniform size of 2000×2000 pixels as model input samples. A portion of the model input samples is used as training set data, and the other portion is used as test set data.

[0066] The firmware vulnerability detection model may include an input layer, convolutional layers, batch normalization layers, ReLU activation layers, an attention mechanism module, pooling layers, fully connected layers, and a softmax layer (i.e., a classification layer). The input layer takes firmware images from a firmware image dataset as input. The attention mechanism module enhances the network's focus on features within the firmware images. The pooling layer uses 2x2 max pooling with a stride of 2. The fully connected layer maps the network's output to the classification result, and the classification layer is used for final classification. This invention employs an improved attention mechanism module to optimize the firmware vulnerability detection model, enabling the convolutional neural network to pay more attention to features in important regions during feature learning, resulting in an optimized firmware vulnerability detection model.

[0067] For adaptive attention feature calculation of the attention mechanism module in the firmware vulnerability detection model, please refer to [link / reference]. Figure 2 , Figure 2 This is a flowchart of the adaptive attention feature calculation method of the present invention. The adaptive attention feature calculation method includes the following steps:

[0068] Calculate channel attention features: Compress and expand the channel information of the convolutional feature map output by ReLU activation using two fully connected layers to obtain channel attention features;

[0069] Calculate spatial attention features: Extract spatial features from the convolutional feature map through 3×3 convolution, and calculate spatial attention weights by combining the bias term to obtain spatial attention features;

[0070] Calculate dynamic fusion weights: Calculate dynamic fusion weights using a fully connected layer on the labeled global features;

[0071] Based on the dynamic fusion weights, channel attention features and spatial attention features are fused to obtain weighted attention feature fusion feature A. adaptive The feature map is multiplied element-wise with the convolutional feature map to output an enhanced attention fusion feature map Z for subsequent pooling.

[0072] Therefore, this invention improves the firmware vulnerability detection model based on convolutional neural networks. The improvement lies in adaptive attention feature calculation. The input to adaptive attention feature calculation is the convolutional feature map X, and the output is an enhanced attention fusion feature map Z. That is, the enhanced attention fusion feature map Z is obtained by calculating the convolutional feature map X output by ReLU activation. Please refer to [link to relevant documentation]. Figure 2 The improvement of the firmware vulnerability detection model based on convolutional neural networks lies specifically in: using the calibrated global features F global Dynamic fusion weights αdyn are computed using a single fully connected layer to adaptively fuse A. channel and A spatial Obtain weighted attention fusion feature A adaptiveThen, the enhanced attention fusion feature map Z is obtained by multiplying it element-wise with X, and then the classification result is processed.

[0073]

[0074] α dyn =σ(W α ·F global +b α )

[0075] A adaptive =α dyn ·A channel +(1-α dyn )·A spatial

[0076] Z = X⊙A adaptive

[0077] Where H and W are the total length and total width in pixels of X, respectively; i1 and j represent the index values ​​from 1 to H and from 1 to W, respectively; X(i,j,c,n) is the feature of sample n in X at pixel position (i1,j) within channel c; σ(·) is the Sigmoid activation function; W α It is a fully connected weight matrix, b α It is W α The bias term.

[0078] Therefore, this invention sets parameters for an adaptive attention mechanism. The hyperparameters of the adaptive attention mechanism are initialized, including channel attention, spatial attention, PReLU activation layers, dynamic fusion weight calculation, and TD-Conv1D parameters. The channel attention part uses a two-layer fully connected structure for channel information compression and expansion, where Wc1 and bc1 are responsible for channel feature compression, and Wc2 and bc2 are responsible for channel feature expansion. The spatial attention part extracts spatial features through a 3×3 convolution (Ws) and calculates spatial attention weights by combining a bias term (bs). The PReLU activation function (alpha) further enhances the nonlinear expressive power of the model. Furthermore, a dynamic fusion mechanism is introduced, learning the optimal fusion method between channel attention and spatial attention through alpha_fc and beta_fc. To optimize the computational efficiency of channel attention, a TD-Conv1D structure is designed, where TDConvKernel serves as a one-dimensional convolution kernel for compressing channel information, while TDConvBias serves as a bias term to further adjust the channel feature representation.

[0079] Compared to traditional techniques (which employ a firmware vulnerability detection model based on convolutional neural networks to identify channel attention features A of the convolutional feature map X from the firmware binary file of power edge devices), this method utilizes a different approach. channel Spatial attention feature Aspatial Compared to the previous method (which outputs a classification result after processing the attention fusion features obtained by fusion weight fusion), this invention, on the one hand, dynamically fuses channel attention features A channel Spatial attention feature A spatial This effectively improves the generalization ability of firmware vulnerability detection models based on convolutional neural networks. On the other hand, the weighted attention fusion feature A adaptive Element-wise multiplication with the convolutional feature map X yields an enhanced attention fusion feature map Z. TD-Conv1D is used to improve the expressive power of channel features and avoid information loss. Thirdly, the channel attention feature A... channel Spatial attention feature A spatial Derived from convolutional feature map X, and dynamically fused with it, it works synergistically with convolutional feature map X to effectively characterize key vulnerability features, achieving a lightweight spatial attention mechanism, improving detection efficiency, and adapting to edge devices. Therefore, this invention solves the technical problems of existing CNNs in firmware vulnerability detection, such as difficulty in simultaneously considering local and global features, inability to adapt to different vulnerability types, and inability to effectively characterize key vulnerability features.

[0080] Please see Figure 3 It is the channel attention feature A channel Flowchart of the calculation method, channel attention feature A channel The calculation method includes the following steps:

[0081] The convolutional feature map X is reshaped to flatten its spatial dimensions, forming a tensor of shape [L,C,N], where L represents the total spatial length, C is the number of channels, and N is the batch dimension.

[0082] Perform channel-wise 1D convolution on the tensor and use TD-Conv1D to compute the global features of each channel;

[0083] The channel attention feature A is obtained by computing the global features through two fully connected layers. channel .

[0084] In this embodiment, to enhance information interaction between channels, TD-Conv1D (temporal convolution) is introduced to replace the global average pooling (GAP) of the traditional attention mechanism, thus extracting channel features more accurately. First, the input is reshaped to flatten the spatial dimensions, forming a tensor X of shape [L,C,N]. reshape The specific formula is as follows:

[0085] X reshape =reshape(X,[L,C,N])(1)

[0086] Where L represents the total spatial length, C is the number of channels, N is the batch dimension, and X is the convolutional feature map.

[0087] Subsequently, a channel-wise 1D convolution is performed, and TD-Conv1D is used to calculate the global features of each channel. The specific formula is as follows:

[0088]

[0089] Among them, X reshape (i,c) represents the feature at the c-th channel and the i-th spatial length of the tensor, K(i,c) represents the TD-Conv1D convolution kernel at the c-th channel and the i-th spatial length of the tensor, and B(c) is the bias term of K(i,c).

[0090] After obtaining the channel feature (channel_feature(c)), the channel attention A is calculated through two fully connected layers. channel The calculation formula is as follows:

[0091]

[0092] in and W c 2 These are the weight matrices for channel compression and expansion, respectively; and is the corresponding bias term; PReLU is used as the activation function to introduce nonlinear features; σ(·) is the Sigmoid activation function.

[0093] Please see Figure 4 It is a spatial attention feature A spatial Flowchart of the computational method, spatial attention feature A spatial The calculation method includes the following steps:

[0094] Calculate global pooling features on the convolutional feature map, and perform channel average pooling to obtain channel average features;

[0095] Calculate the maximum value of each pixel in the channel dimension of the convolutional feature map, and perform channel max pooling to obtain the channel maximum feature.

[0096] The final spatial attention features are obtained by concatenating the channels using average pooling and maximum pooling.

[0097] In this embodiment, spatial attention is calculated as follows. To further enhance the model's ability to capture local spatial features, the spatial attention weights are calculated using the following method. First, the global pooling features are calculated, where the formula for calculating the channel average feature is as follows:

[0098]

[0099] Where C is the number of channels, spatial_avg(i,j,n) is the average channel feature of sample n at position (i,j) in all channels, and X(i,j,c,n) is the feature of sample n at position (i,j) in channel c in the convolutional feature map.

[0100] Channel max pooling calculates the maximum channel feature of each pixel along the channel dimension, and its calculation formula is as follows:

[0101]

[0102] Where spatial_max(i,j,n) is the maximum channel feature of sample n at position (i,j) across all channels.

[0103] After completing the calculations for channel average pooling and channel max pooling, in order to fully utilize the global statistical information of average pooling and the salient feature information of max pooling, the two are concatenated, and the final spatial attention input feature A is calculated according to the following formula. spatial The calculation formula is as follows:

[0104] A spatial =(σConv2D(conact(F)) avg, F max ),W s ,b s (6)

[0105] Where σ(·) is the Sigmoid activation function, contact(·) is the concatenation function, Conv2D(·) is the convolution function, and F avg It is spatial_avg(i,j,n), F max It is spatial_max(i,j,n), W s It is a 3×3 convolution kernel; b s It is W s The bias.

[0106] This invention uses the calibrated global feature F global The dynamic fusion weight α is calculated using a fully connected layer. dyn Adaptive fusion of A channel and A spatial Obtain weighted attention fusion feature A adaptive To enable the model to dynamically adjust the ratio of channel attention to spatial attention based on global features, this design employs global average pooling (GAP) to extract global features F. global The dynamic fusion weights are calculated through a learnable linear transformation. Global features F globalIt is the mean of the input feature X in the spatial dimension, defined as follows:

[0107]

[0108] Where H is the length of the convolutional feature map, W is the width of the convolutional feature map, i1 and j represent the index values ​​from 1 to H and from 1 to W respectively, and X(i,j,c,n) is the feature of sample n in the convolutional feature map at position (i,j) within channel c.

[0109] After obtaining the global feature F global Then, a fully connected layer is used to compute the dynamic fusion weight α using a single fully connected layer. dyn The calculation formula is as follows:

[0110] α dyn =σ(W α ·F global +b α (8)

[0111] Where σ(·) is the Sigmoid activation function, α dyn W represents the dynamic fusion weights. α It is the fully connected weight matrix used in the dynamic fusion process, b α It is W α The bias term.

[0112] Complete the fusion weight α dyn After calculation, channel attention feature A is used. channel Spatial attention feature A spatial To calculate the final weighted attention fusion feature A adaptive The calculation formula is as follows:

[0113] A adaptive =α dyn ·A channel +(1-α dyn )·A spatial (9)

[0114] Among them, A channel For channel attention features, A spatial It is a spatial attention feature, α dyn This indicates the dynamic fusion weights.

[0115] The final weighted attention fusion feature A is obtained. adaptive Then, it is multiplied element-wise with the input feature X to obtain the enhanced attention fusion feature map Z, calculated as follows:

[0116] Z = X⊙A adaptive (10)

[0117] Please see Figure 5 This is a simulation diagram of the firmware vulnerability detection method. The test set contains 57 real samples, of which 34 are normal samples and 23 are vulnerable samples. Using the firmware vulnerability detection method of this invention, 33 normal samples were correctly predicted as normal samples by the model, while 1 normal sample was misclassified as a vulnerable sample, with an accuracy rate of 97.1% and a false positive rate of 2.9%; while all 23 vulnerable samples were correctly identified as vulnerable samples, with an accuracy rate of 100%. Therefore, the firmware vulnerability detection method of this invention can basically achieve 100% identification of vulnerable samples.

[0118] Example 2

[0119] This embodiment discloses a firmware vulnerability detection device based on adaptive fusion attention feature enhancement convolutional neural network, which includes a conversion module and a firmware vulnerability detection module. The conversion module is used to convert the firmware binary file of the power edge device into a firmware image dataset in a format that can be accepted by the convolutional neural network. The firmware vulnerability detection module is used to evaluate whether the firmware binary file of the power edge device is normal firmware or firmware containing vulnerabilities using a firmware vulnerability detection model based on convolutional neural network.

[0120] The firmware vulnerability detection model includes: input layer → "convolution + batch normalization + ReLU activation" layer → adaptive attention calculation layer → pooling layer → fully connected layer → classification layer. In this embodiment, the adaptive attention calculation layer is used to calculate the enhanced attention fusion feature map Z from the convolutional feature map X output by the "convolution + batch normalization + ReLU activation" layer, using the convolutional neural network firmware vulnerability detection method of Embodiment 1, and output it to the pooling layer.

[0121] The firmware vulnerability detection device based on adaptive fusion attention feature enhancement of convolutional neural networks in this embodiment has the following advantages:

[0122] 1. An adaptive attention mechanism structure that integrates channel attention and spatial attention;

[0123] 2. The TD-Conv1D convolutional structure replaces the traditional GAP channel attention calculation method;

[0124] 3. A spatial attention mechanism combining channel average pooling and channel max pooling;

[0125] 4. Adaptively adjust the ratio of the two types of attention by dynamically fusing weights;

[0126] 5. Using the firmware binary-to-grayscale image as input, construct a CNN for classification and detection.

[0127] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0128] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of this invention patent should be determined by the appended claims.

Claims

1. A firmware vulnerability detection method based on adaptive fusion attention feature enhancement convolutional neural network, which uses a convolutional neural network-based firmware vulnerability detection model to evaluate whether the firmware binary file of a power edge device is normal firmware or contains vulnerabilities. The adaptive attention feature calculation in the firmware vulnerability detection model calculates the channel attention feature A based on the input convolutional feature map X. channel Spatial attention feature A spatial And based on the fusion weights, the attention fusion feature map is output. Its features are, The adaptive attention feature calculation is improved to: using the calibrated global feature F global Dynamic fusion weights αdyn are computed using a single fully connected layer to adaptively fuse A. channel and A spatial Obtain weighted attention fusion feature A adaptive Then multiply it element-wise with X to output the enhanced attention fusion feature map Z; a dyn =σ(W α ·F global +b α ) A adaptive =a dyn ·A channel +(1-a dyn )·A spatial Z=X⊙A adaptive Where H and W are the total length and total width in pixels of X, respectively; i1 and j represent the index values ​​from 1 to H and from 1 to W, respectively; X(i,j,c,n) is the feature of sample n in X at pixel position (i1,j) within channel c; σ(·) is the Sigmoid activation function; W α It is a fully connected weight matrix, b α It is W α The bias term.

2. The firmware vulnerability detection method based on adaptive fusion attention feature enhancement of convolutional neural networks according to claim 1, characterized in that, Firmware vulnerability detection methods include: Convert the firmware binary files of power edge devices into firmware image datasets in a format that can be accepted by convolutional neural networks. A firmware vulnerability detection model based on convolutional neural networks is adopted. The firmware image dataset is processed sequentially as follows: convolution + batch normalization + ReLU activation → adaptive attention feature calculation → pooling → fully connected → classification. The classification result is output. The input of the adaptive attention feature calculation is the convolutional feature map X, and the output is the enhanced attention fusion feature map Z.

3. The firmware vulnerability detection method based on adaptive fusion attention feature enhancement of convolutional neural networks according to claim 2, characterized in that, The firmware image data conversion method includes the following steps: Read firmware data in bin format from the firmware binary file and parse it in binary mode, during which byte padding is required; The parsed one-dimensional binary data is then converted into a two-dimensional matrix format. At the same time, all firmware data in the two-dimensional matrix format is converted into standardized grayscale images and uniformly adjusted to the calibrated pixel size, finally outputting a firmware image dataset of uniform specifications.

4. The firmware vulnerability detection method based on adaptive fusion attention feature enhancement convolutional neural network according to claim 1, characterized in that, Two fully connected layers are used to compress and expand the channel information of the convolutional feature map X to obtain the channel attention feature A. channel .

5. The firmware vulnerability detection method based on adaptive fusion attention feature enhancement of convolutional neural networks according to claim 1, characterized in that, Channel attention feature A channel The calculation method includes the following steps: The convolutional feature map X is reshaped to flatten its spatial dimensions, forming a tensor of shape [L,C,N], where L represents the total spatial length, C is the number of channels, and N is the batch dimension. Perform channel-wise 1D convolution on the tensor and use TD-Conv1D to compute the global features of each channel; The channel attention feature A is obtained by computing the global features through two fully connected layers. channel .

6. The firmware vulnerability detection method based on adaptive fusion attention feature enhancement of convolutional neural networks according to claim 5, characterized in that, Tensor X reshape for: X reshape =reshape(X,[L,C,N]) (1) Where X is the convolutional feature map; The global feature of the c-th channel is: Among them, X reshape (i,c) represents the feature at the c-th channel and the i-th spatial length of the tensor, K(i,c) represents the TD-Conv1D convolution kernel at the c-th channel and the i-th spatial length of the tensor, and B(c) is the bias term of K(i,c). Channel attention feature A channel for: Where σ(·) is the Sigmoid activation function, and It is the weight matrix for channel compression and expansion. and It corresponds and The bias term, PReLU, is used as an activation function to introduce nonlinear features, F TD For channel_feature(c).

7. The firmware vulnerability detection method based on adaptive fusion attention feature enhancement convolutional neural network according to claim 1, characterized in that, Spatial features of the convolutional feature map X are extracted using 3×3 convolution, and spatial attention weights are calculated by combining the bias term to obtain spatial attention features A. spatial .

8. The firmware vulnerability detection method based on adaptive fusion attention feature enhancement of convolutional neural networks according to claim 1, characterized in that, Spatial attention feature A spatial The calculation method includes the following steps: Calculate global pooling features on the convolutional feature map X, and perform channel average pooling to obtain channel average features; Calculate the maximum value of each pixel in the channel dimension of the convolutional feature map, and perform channel max pooling to obtain the channel maximum feature. The final spatial attention feature A is obtained by concatenating channel average pooling and channel max pooling. spatial .

9. The firmware vulnerability detection method based on adaptive fusion attention feature enhancement of convolutional neural networks according to claim 8, characterized in that, The channel average characteristic is: Where C is the number of channels, spatial_avg(i,j,n) is the average channel feature of sample n at position (i,j) in all channels, and X(i,j,c,n) is the feature of sample n at position (i,j) in channel c in the convolutional feature map. The most prominent feature of a channel is: Where spatial_max(i,j,n) is the maximum channel feature of sample n at position (i,j) in all channels; Spatial attention feature A spatial for: A spatial =σ(Conv2D(conact(F avg, F max )),W s ,b s ) (6) Where σ(·) is the Sigmoid activation function, contact(·) is the concatenation function, Conv2D(·) is the convolution function, and F avg It is spatial_avg(i,j,n), F max It is spatial_max(i,j,n), W s It is a 3×3 convolution kernel; b s It is W s The bias.

10. A firmware vulnerability detection device based on adaptive fusion attention feature enhancement convolutional neural network, comprising: The conversion module is used to convert the firmware binary files of power edge devices into firmware image datasets in a format that can be accepted by convolutional neural networks. The firmware vulnerability detection module is used to evaluate whether the firmware binary file of the power edge device is normal firmware or contains vulnerabilities by using a firmware vulnerability detection model based on convolutional neural networks. The firmware vulnerability detection model includes: input layer → "convolution + batch normalization + ReLU activation" layer → adaptive attention calculation layer → pooling layer → fully connected layer → classification layer; The feature is that the adaptive attention calculation layer is used to calculate the enhanced attention fusion feature map Z and output it to the pooling layer using the convolutional feature map X output by the "convolution + batch normalization + ReLU activation" layer, which is based on the convolutional neural network firmware vulnerability detection method according to any one of claims 1 to 9.

Images