Improved convolutional neural network for detecting firmware vulnerabilities of power side-end equipment and detection method

Abstract

The invention relates to the technical field of electric power information security and embedded system detection, in particular to an improved convolutional neural network for detecting firmware vulnerabilities of electric power side-end equipment and a detection method. According to the improved convolutional neural network, the improved convolutional neural network comprising a multi-scale convolution parallel module, a dynamic weight distribution module and an attention enhancement module is constructed, so that the problem that a traditional convolution kernel receptive field is fixed is solved. The improved convolutional neural network uses parallel convolution kernels of different scales to synchronously extract features, the dynamic weight module adaptively fuses multi-scale features according to input content, and the attention module further focuses on a key area. According to the method, the limitation of a single receptive field is broken through, the local byte anomaly and the global structure defect of the firmware vulnerability can be accurately captured at the same time, and the detection precision and the model generalization ability are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of power information security and embedded system detection technology, specifically to an improved convolutional neural network and detection method for detecting firmware vulnerabilities in power edge devices. Background Technology

[0002] With the rapid development of new power systems and the energy internet, the number of smart edge devices deployed in the power internet of things has surged. The security of their internal firmware has become a key factor affecting the stable operation of the power system. If firmware vulnerabilities are exploited, they may lead to device malfunction, data leakage, or even the spread of cyberattacks. Therefore, achieving automated and high-precision vulnerability detection of power edge device firmware is of great practical significance.

[0003] Currently, firmware vulnerability detection mainly relies on two types of technologies: one is the static parsing method, which locates vulnerabilities through disassembly and symbol analysis. However, it heavily depends on firmware symbol information, is ineffective for encrypted or obfuscated firmware, and has low analysis efficiency. The other is the binary image detection method based on deep learning, which converts firmware into images and uses convolutional neural networks for classification, achieving end-to-end detection. However, existing models generally use convolutional kernels with fixed receptive fields, making it difficult to simultaneously capture the subtle local features and global structural patterns of vulnerabilities. Furthermore, the feature fusion methods for different types of firmware are limited, and there is a lack of a mechanism to dynamically adjust weights based on the input content, which restricts the model's generalization ability and detection accuracy.

[0004] Therefore, existing technologies still have significant shortcomings when applied to power edge scenarios: first, they cannot effectively model multi-scale vulnerability features; second, the feature fusion mechanism lacks adaptability; and third, the high model complexity makes them difficult to deploy in resource-constrained edge environments. How to design a vulnerability detection method that can balance multi-scale feature extraction, dynamic weight fusion, and lightweight deployment has become an urgent technical problem to be solved in this field. Summary of the Invention

[0005] To address the technical problem that traditional convolutional kernels, with their fixed receptive fields, cannot simultaneously capture both the local fine-grained patterns and global macroscopic structural features of firmware vulnerabilities, this invention provides an improved convolutional neural network for firmware vulnerability detection in power edge devices. Based on this improved convolutional neural network, this invention also provides a method and system for detecting firmware vulnerabilities in power edge devices.

[0006] To achieve the above objectives, the present invention provides the following technical solution: An improved convolutional neural network for detecting firmware vulnerabilities in power edge devices includes an input layer, a basic convolutional layer, a multi-scale convolutional parallel module, a dynamic weight allocation module, an attention enhancement module, a pooling layer, a fully connected layer, and a classification output layer connected in sequence. The multi-scale convolution parallel module includes multiple parallel convolution branches, each of which uses convolution kernels of different scales to extract features from the feature maps output by the base convolutional layer. The dynamic weight allocation module is used to generate dynamic weight coefficients corresponding to each convolutional branch based on the feature maps output by the basic convolutional layer, and to use the dynamic weight coefficients to perform weighted summation on the output feature maps of each convolutional branch to obtain a fused feature map. The attention enhancement module is used to perform channel attention and spatial attention calculations on the fused feature map and output the enhanced feature map to the pooling layer.

[0007] As a further aspect of the present invention: the dynamic weight allocation module includes: The global pooling unit is used to perform global average pooling on the feature maps output by the basic convolutional layers to generate global context feature vectors. The weight generation unit is used to generate the original weight vector based on the global context feature vector. The weight normalization unit is used to normalize the original weight vector to obtain the corresponding dynamic weight coefficients.

[0008] As a further aspect of the present invention: the weight generation unit includes a first fully connected layer and a second fully connected layer connected in sequence. The first fully connected layer is used to map the global context feature vector to an intermediate feature vector, and the second fully connected layer is used to map the intermediate feature vector to the original weight vector.

[0009] As a further aspect of the present invention: the attention enhancement module includes: The channel attention submodule is used to calculate the attention weights of each channel in the fused feature map and to weight the features of each channel. The spatial attention submodule is used to calculate the attention weights at each spatial location in the fused feature map; The spatial attention submodule generates a spatial attention weight map by performing global average pooling and global max pooling on the fused feature map, concatenating the pooling results along the channel dimension, and then performing convolution operations.

[0010] As a further aspect of the present invention: each parallel convolutional branch includes at least a convolutional branch using 3×3, 5×5 and 7×7 convolutional kernels.

[0011] This invention also provides a method for detecting firmware vulnerabilities in power edge devices, comprising the following steps: Obtain the binary file of the power edge device firmware and convert it into a grayscale image of uniform size; The grayscale image is input into the improved convolutional neural network described above for processing; Based on the output of the classification output layer of the improved convolutional neural network, determine whether the firmware of the power edge device contains vulnerabilities.

[0012] As a further aspect of the present invention, the steps for converting a binary file into a grayscale image are as follows: Parse a binary file into a one-dimensional array based on its byte sequence; Fill or truncate a one-dimensional array so that its length is equal to the product of the preset image height and width; The processed array is reshaped into a two-dimensional matrix and normalized to a grayscale image.

[0013] As a further aspect of the present invention: the preset image height and width are both 2000 pixels.

[0014] This invention further provides a firmware vulnerability detection system for power edge devices, comprising: The data preprocessing module is used to convert the input binary file into a grayscale image of uniform size; The vulnerability detection module has the aforementioned improved convolutional neural network built in and executes the aforementioned detection method to analyze grayscale images and output vulnerability detection results. The results output module is used to display or transmit the vulnerability detection results.

[0015] As a further aspect of the present invention: the data preprocessing module and the vulnerability detection module are deployed on the power edge device or on the adjacent edge computing node.

[0016] Compared with the prior art, the beneficial effects of the present invention are: 1. By simultaneously extracting local fine-grained features and global structural features of firmware vulnerabilities through a multi-scale parallel structure, the limitation of fixed receptive fields in traditional CNNs is overcome. An adaptive feature fusion based on input content is achieved through a dynamic weight allocation module, significantly improving the model's generalization ability to different types of firmware samples. Furthermore, an attention enhancement module focuses on key feature regions and suppresses irrelevant noise. These three elements work synergistically to achieve high-precision, highly adaptive end-to-end detection of firmware vulnerabilities in power edge devices without the need for manual feature design.

[0017] 2. Global average pooling is used to quickly capture global contextual information of the image, and then weights are generated by mapping through fully connected layers. Finally, normalization is used to ensure the rationality and stability of weight allocation. With low computational overhead, intelligent weighting of the output of different convolutional branches is achieved, enabling the network to dynamically adjust the contribution of multi-scale features according to the inherent features of the current firmware image, thereby effectively improving the detection robustness of the model under multiple samples and multiple device types.

[0018] 3. By introducing a non-linear mapping hierarchy, the model's ability to express global context features and the flexibility of weight generation are enhanced. The first fully connected layer performs feature compression and abstraction, while the second layer is dedicated to generating weight vectors corresponding to the number of branches. This structure is simple and effective, easy to train and deploy, and ensures that the dynamic weight allocation mechanism is not only highly adaptive but also highly feasible and stable in engineering practice.

[0019] 4. The spatial attention submodule integrates global average pooling and global max pooling to generate a spatial attention map. Average pooling focuses on the overall feature distribution, while max pooling focuses on the most salient features. The concatenation of the two can more comprehensively represent the spatial importance of the feature map, and more accurately locate key regions related to vulnerabilities in firmware images, significantly improving the model's ability to locate vulnerability features and its classification accuracy. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the structure of the improved convolutional neural network in this invention.

[0021] Figure 2 This is a flowchart of the detection method in this invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] I. Improved Convolutional Neural Networks like Figure 1 As shown, the improved convolutional neural network in this embodiment is used for firmware vulnerability feature extraction and classification of power edge devices. Its structure consists of an input layer, a basic convolutional layer, a multi-scale convolutional parallel module, a dynamic weight allocation module, an attention enhancement module, a pooling layer, a fully connected layer, and a classification output layer. The specific implementation of each module is as follows: 1. Input layer The input layer receives a preprocessed grayscale image of the power edge device firmware. The input tensor format is:

[0024] N For sample batch size, C in This represents the number of image channels (C=1 for grayscale images). H , WThe height and width of the image are standardized (2000×2000 pixels in this embodiment) to achieve unified reception and format adaptation of firmware image data.

[0025] 2. Basic Convolutional Layer The core function of the basic convolutional layer is to extract the basic features of the firmware image. Its operation process is convolution operation + batch normalization + ReLU non-linear activation, and the specific formula is as follows:

[0026] in, W 0 represents the initial convolutional kernel weights. b 0 represents the initial bias term; BN (·) represents batch normalization operation; Conv 0(·) represents the initial convolution operation; Re LU (·) is an activation function that enhances the nonlinear expressive power.

[0027] The activation function can be replaced with non-linear activation functions such as LeakyReLU and GELU.

[0028] 3. Multi-scale convolution parallel module This module contains multiple parallel convolutional branches. In this embodiment, at least three types of convolutional kernels with different scales—3×3, 5×5, and 7×7—are set up, denoted as... K One branch, K ≥3, each branch independently outputs a feature map from the base convolutional layer. X For feature extraction, the formula for a single branch is:

[0029]

[0030] in, W k For the first k The convolution kernel weights of each branch, b k This corresponds to the bias term. F k For the first k Feature maps output by each branch For the first k The intermediate feature map output by each branch. Conv k (·) is the first k Convolution operation of each branch.

[0031] Multi-scale branching can simultaneously capture the local fine-grained features (3×3 branch) and global macro-structural features (7×7 branch) of firmware vulnerabilities, achieving multi-level feature representation.

[0032] 4. Dynamic weight allocation module The dynamic weight allocation module is used to achieve adaptive fusion of multi-scale features. It includes three sub-units: a global pooling unit, a weight generation unit, and a weight normalization unit. The specific process is as follows: Global pooling unit: Performs global average pooling (GAP) on the feature map X output by the base convolutional layer to generate a global context feature vector, as shown in the formula:

[0033] In the formula, g Represents the global context feature vector of each sample Weight generation unit: Contains a first fully connected layer and a second fully connected layer connected in sequence. First, it generates the global context feature vector. g The vector is mapped to an intermediate feature vector and then converted back to the original weight vector.

[0034] (1) First layer fully connected mapping:

[0035] (2) Generation of second-layer weights:

[0036] (3) Softmax normalization:

[0037] in, W dw1 , W dw2 All are dynamic weight network weight matrices. b dw1 , b dw2 These are the corresponding bias terms; α n,k For the sample n Multi-scale weights. It uses dynamic weighted networks as samples n Branches k The original output score is then subjected to an exponential transformation and used for subsequent normalization.

[0038] (4) Weighted fusion: based on dynamic weights α n,k Output to each branch F k Perform weighted fusion to obtain the output fused features:

[0039] In the formula, F fusion [ n] indicates the first n Feature maps of fused samples. K This represents the total number of branches in a multi-scale convolution. F k [ n ]No. n The sample, the first k The original feature map extracted by each convolutional branch.

[0040] This operation enables the network to automatically balance the contributions of local and global features based on the input samples.

[0041] 5. Attention Enhancement Module This module enhances key vulnerability features and suppresses background noise through channel attention and spatial attention submodules, as specifically implemented below: (1) Channel Attention Submodule: Calculate and weight the attention weights of each channel in the fused feature map, using the following formula:

[0042] in, W ca1 , W ca2 All are channel attention weights. b ca1 , b ca2 These are the corresponding bias terms. σ This is the Sigmoid function. GAP For global average pooling; A c The feature map after channel attention weighting. F fusion This represents the feature map after fusion.

[0043] (2) Spatial attention submodule: First, for A c Perform global average pooling respectively to obtain F avg Global max pooling is obtained F max The two are then concatenated along the channel dimension, and a spatial attention weight map is generated through convolution operation, ultimately outputting an enhanced feature map. Z .

[0044] Average pooling feature map F avg :

[0045] in, C For the number of channels, c For channel indexing.

[0046] Max pooling feature map F max :

[0047] Will F avg and F max The final spatial attention weight map is obtained by splicing and calculating along the channel dimension. A S :

[0048] in, W sa Here is the spatial attention convolution kernel weight matrix. b sa This is its bias term. Conv 3×3 (•) represents a 3×3 convolution operation.

[0049] Enhanced features are obtained after feature enhancement. Z :

[0050] 6. Categorized Output Enhance features Z Classification is performed after global pooling and a fully connected layer:

[0051]

[0052] in, W cls This is the classification layer weight matrix. b cls For its bias term, Z final This is the final global pooled feature map; This is the firmware vulnerability detection result (normal / containing vulnerabilities).

[0053] II. Methods for Detecting Firmware Vulnerabilities in Power Edge Equipment like Figure 2 As shown, based on the improved convolutional neural network described above, the firmware vulnerability detection method in this embodiment includes three core steps: firmware binary file preprocessing, neural network inference, and vulnerability result determination, as detailed below: 1. Steps to convert firmware binary files to uniform-size grayscale images Obtain the bin format firmware binary file of the power edge device, distinguish between "normal" and "vulnerable" samples, and parse the binary file into a one-dimensional byte array according to the byte sequence.

[0054] The one-dimensional array is padded (with zeros) or truncated to make its length equal to the preset image height × width. In this embodiment, 2000 × 2000 = 4 × 10⁻⁶. 6 byte.

[0055] The processed one-dimensional array is reshaped into a 2000×2000 two-dimensional matrix, and the matrix elements are then standardized to the grayscale range of [0,255] to generate a firmware grayscale image of uniform specifications.

[0056] 2. Neural Network Inference The standardized firmware grayscale image is input into the improved convolutional neural network in the first part. It passes through the input layer for receiving, the basic convolutional layer for feature extraction, the multi-scale convolutional parallel feature capture, the dynamic weight adaptive fusion, the attention feature enhancement, the pooling dimensionality reduction, and the fully connected layer feature mapping in sequence. Finally, the classification output layer outputs the classification probability.

[0057] 3. Vulnerability Result Determination A probability threshold is set, which is 0.5 in this embodiment. If the probability of the "containing vulnerability" category in the classification output layer is ≥0.5, the firmware is determined to have a vulnerability; if the probability is <0.5, it is determined to be normal firmware. At the same time, the model performance indicators such as accuracy, true pass rate, and F1 score can be output synchronously.

[0058] III. Implementation and Deployment of a Firmware Vulnerability Detection System for Power Edge Equipment The detection system in this embodiment includes a data preprocessing module, a vulnerability detection module, and a result output module, and supports lightweight edge deployment, as detailed below: 1. Functional Implementation of Each Module (1) Data preprocessing module: It has the above-mentioned binary file to grayscale image algorithm built in. It can receive the bin format firmware file of power edge devices (smart meters, distribution terminals, edge gateways, etc.), automatically complete parsing, filling / truncating, matrix reshaping and grayscale standardization, and output image data that meets the input requirements of neural networks.

[0059] (2) Vulnerability detection module: The improved convolutional neural network in the first part above is built in. The network is called to execute the inference process, perform vulnerability analysis on the preprocessed grayscale image and generate detection results.

[0060] (3) Result output module: It supports two result display / transmission formats. One is to visualize the "normal / vulnerable" judgment result and model performance indicators on the local terminal (such as the edge device operation and maintenance screen); the other is to transmit the result to the remote security management platform through the power Internet of Things communication protocol to realize the centralized management of vulnerability information.

[0061] 2. System Deployment Scheme: The data preprocessing module and vulnerability detection module of this system are preferentially deployed on the local power edge device or its adjacent edge computing nodes. The computing resources of the edge nodes are used to complete localized detection, reducing data transmission latency and network bandwidth consumption. The result output module can be flexibly deployed on the local or remote platform according to the operation and maintenance needs.

[0062] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. An improved convolutional neural network for detecting firmware vulnerabilities in power edge devices, characterized in that, It includes an input layer, a basic convolutional layer, a multi-scale convolutional parallel module, a dynamic weight allocation module, an attention enhancement module, a pooling layer, a fully connected layer, and a classification output layer, which are connected in sequence. The multi-scale convolution parallel module includes multiple parallel convolution branches, each of which uses convolution kernels of different scales to extract features from the feature maps output by the base convolutional layer. The dynamic weight allocation module is used to generate dynamic weight coefficients corresponding to each convolutional branch based on the feature maps output by the base convolutional layer, and to use the dynamic weight coefficients to perform weighted summation on the output feature maps of each convolutional branch to obtain a fused feature map. The attention enhancement module is used to perform channel attention and spatial attention calculations on the fused feature map and output the enhanced feature map to the pooling layer.

2. The improved convolutional neural network for firmware vulnerability detection in power edge devices according to claim 1, characterized in that, The dynamic weight allocation module includes: The global pooling unit is used to perform global average pooling on the feature maps output by the basic convolutional layers to generate global context feature vectors. The weight generation unit is used to generate the original weight vector based on the global context feature vector. The weight normalization unit is used to normalize the original weight vector to obtain the corresponding dynamic weight coefficients.

3. An improved convolutional neural network for firmware vulnerability detection in power edge devices according to claim 2, characterized in that, The weight generation unit includes a first fully connected layer and a second fully connected layer connected in sequence. The first fully connected layer is used to map the global context feature vector to the intermediate feature vector, and the second fully connected layer is used to map the intermediate feature vector to the original weight vector.

4. An improved convolutional neural network for firmware vulnerability detection in power edge devices according to claim 3, characterized in that, The attention enhancement module includes: The channel attention submodule is used to calculate the attention weights of each channel in the fused feature map and to weight the features of each channel. The spatial attention submodule is used to calculate the attention weights at each spatial location in the fused feature map; The spatial attention submodule generates a spatial attention weight map by performing global average pooling and global max pooling on the fused feature map, concatenating the pooling results along the channel dimension, and then performing convolution operations.

5. An improved convolutional neural network for firmware vulnerability detection in power edge devices according to claim 4, characterized in that, Each parallel convolutional branch includes at least one convolutional branch using 3×3, 5×5, and 7×7 convolutional kernels.

6. A method for detecting firmware vulnerabilities in power edge devices, characterized in that, Includes the following steps: Obtain the binary file of the power edge device firmware and convert it into a grayscale image of uniform size; The grayscale image is input into an improved convolutional neural network for detecting firmware vulnerabilities in power edge devices as described in any one of claims 1-5 for processing; Based on the output of the classification output layer of the improved convolutional neural network, determine whether the firmware of the power edge device contains vulnerabilities.

7. The method for detecting firmware vulnerabilities in power edge devices according to claim 6, characterized in that, The steps to convert a binary file to a grayscale image are as follows: Parse a binary file into a one-dimensional array based on its byte sequence; Fill or truncate a one-dimensional array so that its length is equal to the product of the preset image height and width; The processed array is reshaped into a two-dimensional matrix and normalized to a grayscale image.

8. The method for detecting firmware vulnerabilities in power edge devices according to claim 7, characterized in that, The default image height and width are both 2000 pixels.

9. A firmware vulnerability detection system for power edge devices, characterized in that, include: The data preprocessing module is used to convert the input binary file into a grayscale image of uniform size; The vulnerability detection module has a built-in improved convolutional neural network for detecting firmware vulnerabilities in power edge devices as described in any one of claims 1-5, and executes a method for detecting firmware vulnerabilities in power edge devices as described in any one of claims 6-8 to analyze grayscale images and output vulnerability detection results. The results output module is used to display or transmit the vulnerability detection results.

10. A firmware vulnerability detection system for power edge devices according to claim 9, characterized in that, The data preprocessing module and the vulnerability detection module are deployed on power edge devices or adjacent edge computing nodes.

Images