Firmware cryptographic algorithm verification method and system based on dynamic behavior analysis
By combining dynamic behavior analysis and machine learning models, the problem of firmware password verification being easily cracked and subject to dynamic attacks has been solved, achieving more efficient security verification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHANGHAI UNI SENTRY INTELLIGENT TECH CO LTD
- Filing Date
- 2026-02-10
- Publication Date
- 2026-05-08
AI Technical Summary
Existing firmware password verification methods are easily cracked by attackers and cannot identify dynamic attack behavior, resulting in insufficient firmware security.
A dynamic behavior analysis-based approach is adopted, combining environmental parameters and multi-dimensional dynamic behavior data. The model is validated using a machine learning approach, including data preprocessing, feature extraction, and comprehensive validation. Anomaly identification is performed using a CNN-BiLSTM hybrid deep learning model.
It improves the comprehensiveness and security of firmware password verification, effectively identifies abnormal information, and enhances protection against complex attack scenarios.
Smart Images
Figure CN122001591A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information security technology, and in particular to a firmware cryptographic algorithm verification method and system based on dynamic behavior analysis. Background Technology
[0002] Firmware, as the core control program of embedded devices, smart terminals, and other electronic devices, directly determines the overall security of the device. Password verification is a crucial aspect of firmware security, preventing unauthorized users from accessing or tampering with firmware functions by validating the legitimacy of user-entered passwords.
[0003] Existing firmware password verification methods mostly employ a static verification model. This involves pre-installing the password verification logic and valid password information within the firmware. When a user enters a password, a fixed algorithm is used to process the input, and the result is compared to a pre-defined valid password to complete the verification. However, this static verification method has several drawbacks: First, the fixed verification logic makes it vulnerable to reverse engineering by attackers, allowing them to crack the verification algorithm and valid password information, leading to unauthorized firmware intrusion. Second, static verification only focuses on the validity of the password itself and cannot identify attacks launched by attackers using dynamic attack methods such as brute-force attacks or time-series attacks, making it difficult to handle complex firmware attack scenarios. Summary of the Invention
[0004] The purpose of this invention is to provide a firmware cryptographic algorithm verification method and system based on dynamic behavior analysis to solve the technical problems mentioned in the background art.
[0005] To achieve the above objectives, this invention provides a firmware cryptographic algorithm verification method based on dynamic behavior analysis, comprising the following steps: S1. Obtain plaintext information input by the user, environmental parameters at the current moment, ciphertext information obtained by encrypting plaintext based on cryptographic algorithms, and multi-dimensional dynamic behavior data during the encryption process of cryptographic algorithms; S2. Preprocess the acquired data; S3. Use static verification method to verify the encrypted information and obtain the verification result of the encrypted information; S4. Perform feature extraction on the preprocessed data; S5. Input the feature data into the trained machine learning model to verify the firmware cryptographic algorithm execution process and obtain the firmware cryptographic algorithm verification result. S6. Combine the ciphertext information verification result and the firmware cryptographic algorithm verification result to obtain the final verification result.
[0006] Preferably, the plaintext information in step S1 includes the user's identity identifier and the original data to be encrypted, the environmental parameters include login time, IP location, network latency, and memory usage, and the multi-dimensional dynamic behavior data includes the cryptographic algorithm call sequence, the instruction stream sequence during algorithm execution, the basic block execution order, the memory read / write address distribution, the number of accesses, and the timing pattern.
[0007] Preferably, the preprocessing of the obtained data in step S2 includes normalization, data cleaning, and timestamp alignment.
[0008] Preferably, step S3 specifically includes: S31. Based on the cryptographic algorithm type, verify whether the ciphertext length conforms to the algorithm output specification and whether the ciphertext conforms to the encoding specification. If it conforms, proceed to step S32. If it does not conform, it is judged as abnormal. S32. Use the firmware cryptographic algorithm to decrypt. If the decrypted information obtained is consistent with the plaintext information entered by the user, the verification is successful. If the decrypted information obtained is inconsistent with the plaintext information entered by the user, it is determined to be abnormal.
[0009] Preferably, the feature extraction of the preprocessed data in step S4 specifically includes: S41. Extracting features from ciphertext information: Calculating the cryptographic entropy value based on the ciphertext information. The formula is: ; In the formula, =2, Represents the global single-byte information entropy. Indicates the first The actual probability of occurrence of this byte For the set of bytes that did not appear, The smoothing probability of not appearing. Indicates the number of bytes; S42. Extract environmental parameter features: extract the time period to which the login time belongs, extract the IP regional code, extract the mean, variance and standard deviation of network latency, and extract the instantaneous value and moving average of memory usage. S43. Extract dynamic behavioral data features: Extract the duration of cryptographic algorithm call timing, the proportion of subfunction execution time, and the temporal correlation of instruction stream sequence; extract the frequency and proportion of each opcode in the instruction stream, the similarity of basic block execution paths, the entropy value of memory read and write addresses, the mean, peak, and valley values of access times; extract the temporal patterns of memory read and write, and the Markov chain state transition probability of the instruction stream.
[0010] Preferably, the machine learning model training process in step S5 includes: Collect normal and abnormal dynamic behavior data during the execution of cryptographic algorithms, as well as corresponding environmental parameters and ciphertext information; The obtained data is preprocessed, and features are extracted from the preprocessed data to construct a feature dataset; The feature dataset is divided into a training set and a test set; The machine learning model is trained using the training set and validated using the test set to obtain the trained machine learning model.
[0011] Preferably, the machine learning model employs a CNN-BiLSTM hybrid deep learning model.
[0012] Preferably, the CNN-BiLSTM hybrid deep learning model includes: The feature extraction module includes multiple parallel depthwise separable convolutional layers, concatenation layers, and global average pooling layers, used to extract multi-scale features from the input feature sequence; The BiLSTM temporal feature extraction module includes a bidirectional BiLSTM layer, a normalization layer, and a residual connection layer, which are used to capture temporal features in multi-scale features. The attention fusion module includes an attention layer, which calculates the weights of multi-scale features and temporal features through an attention mechanism, and obtains the fused features by weighted summation of the attention weights; The output module includes an output layer, which outputs the two types of verification results and their corresponding confidence levels. The two types of results include normal and abnormal.
[0013] Preferably, step S6 specifically includes: The formula is derived by combining the results of the encrypted information verification and the firmware cryptographic algorithm verification: ; In the formula, This indicates the weight of the encrypted information verification result. =0.4, Weights for firmware cryptographic algorithm verification results. =0.6, The score represents the result of the encrypted information verification; 1 indicates a normal result, and 0 indicates an abnormal result. The firmware cryptographic algorithm verification score is used when the firmware is working properly. When it is abnormal, , Indicates the confidence level of the corresponding result; when A value ≥ 0.8 is considered normal and the verification passes; when 0.7 ≤ <0.8, suspected anomaly, requires secondary verification; when If the value is less than 0.7, the verification fails.
[0014] This invention also provides a firmware cryptographic algorithm verification system based on dynamic behavior analysis, comprising: The data acquisition module is used to acquire plaintext information input by the user, environmental parameters at the current moment, ciphertext information obtained by encrypting plaintext based on cryptographic algorithms, and multi-dimensional dynamic behavior data during the encryption process of cryptographic algorithms. The data preprocessing module is used to preprocess the acquired data; The encrypted information verification module is used to verify encrypted information; The firmware cryptographic algorithm action verification module is used to analyze the action behavior during the execution of the firmware cryptographic algorithm and obtain the firmware cryptographic algorithm verification result. The comprehensive verification module is used to make a comprehensive judgment based on the verification results of the ciphertext information and the firmware cryptographic algorithm to obtain the final verification result.
[0015] Therefore, the firmware cryptographic algorithm verification method and system based on dynamic behavior analysis described above, as used in this invention, have the following beneficial effects: (1) By introducing environmental parameters and dynamic behavior data of the execution process, a multi-dimensional and multi-level verification system was constructed, which improved the comprehensiveness of the verification. (2) By combining machine learning models to perform behavioral analysis on the algorithm execution process, abnormal information can be effectively identified, thus improving security.
[0016] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description
[0017] Figure 1 This is a flowchart of a method according to an embodiment of the present invention; Figure 2 This is a system framework diagram of an embodiment of the present invention. Detailed Implementation
[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can be arranged and designed in various different configurations, and therefore should not be construed as limiting the present invention.
[0019] Example like Figure 1 As shown, this invention provides a firmware cryptographic algorithm verification method based on dynamic behavior analysis, including the following steps: S1. Obtain the plaintext information input by the user, the current environmental parameters, the ciphertext information obtained by encrypting the plaintext using a cryptographic algorithm, and multi-dimensional dynamic behavior data during the cryptographic algorithm's encryption execution. The plaintext information includes the user's identity identifier and the original data to be encrypted. The environmental parameters include login time, IP address, network latency, and memory usage. The multi-dimensional dynamic behavior data includes the cryptographic algorithm call sequence, the instruction stream sequence during algorithm execution, the basic block execution order, memory read / write address distribution, access frequency, and timing patterns.
[0020] S2. Preprocess the acquired data. Specifically, preprocessing includes normalization, data cleaning, and timestamp alignment. Data cleaning includes handling missing values and outliers. For text-based data, one-hot encoding or label encoding is used to convert it into numerical features.
[0021] S3. The ciphertext information is verified using a static verification method to obtain the verification result. Specifically: S31. Based on the cryptographic algorithm type, verify whether the ciphertext length conforms to the algorithm output specification and whether the ciphertext conforms to the encoding specification. If it conforms, proceed to step S32. If it does not conform, it is judged as abnormal. S32. Use the firmware cryptographic algorithm to decrypt. If the decrypted information obtained is consistent with the plaintext information entered by the user, the verification is successful. If the decrypted information obtained is inconsistent with the plaintext information entered by the user, it is determined to be abnormal.
[0022] S4. Perform feature extraction on the preprocessed data. Specifically, this includes: S41. Extracting features from ciphertext information: Calculating the cryptographic entropy value based on the ciphertext information. The formula is: ; In the formula, =2, Represents the global single-byte information entropy. Indicates the first The actual probability of occurrence of this byte For the set of bytes that did not appear, The smoothing probability of not appearing. Indicates the number of bytes; S42. Extract environmental parameter features: extract the time period to which the login time belongs, extract the IP regional code, extract the mean, variance and standard deviation of network latency, and extract the instantaneous value and moving average of memory usage. S43. Extract dynamic behavioral data features: Extract the duration of cryptographic algorithm call timing, the proportion of subfunction execution time, and the temporal correlation of instruction stream sequence; extract the frequency and proportion of each opcode in the instruction stream, the similarity of basic block execution paths, the entropy value of memory read and write addresses, the mean, peak, and valley values of access times; extract the temporal patterns of memory read and write, and the Markov chain state transition probability of the instruction stream.
[0023] S5. Input the feature data into the trained machine learning model to verify the firmware cryptographic algorithm execution process and obtain the firmware cryptographic algorithm verification result.
[0024] The machine learning model training process includes: Collect normal and abnormal dynamic behavior data during the execution of cryptographic algorithms, as well as corresponding environmental parameters and ciphertext information; The obtained data is preprocessed, and features are extracted from the preprocessed data to construct a feature dataset; The feature dataset is divided into a training set and a test set; The machine learning model is trained using the training set and validated using the test set to obtain the trained machine learning model.
[0025] The machine learning model employs a CNN-BiLSTM hybrid deep learning model, which includes: The feature extraction module includes three parallel depthwise separable convolutional layers, a concatenation layer, and a global average pooling layer, used to extract multi-scale features from the input feature sequence; The BiLSTM temporal feature extraction module includes a bidirectional BiLSTM layer, a normalization layer, and a residual connection layer, which are used to capture temporal features in multi-scale features. The attention fusion module includes an attention layer, which calculates the weights of multi-scale features and temporal features through an attention mechanism, and obtains the fused features by weighted summation of the attention weights; The output module includes an output layer, which outputs the two types of verification results and their corresponding confidence levels. The two types of results include normal and abnormal.
[0026] S6. Combining the encrypted information verification results and the firmware cryptographic algorithm verification results, the final verification result is obtained. Specifically, this includes: The formula is derived by combining the results of the encrypted information verification and the firmware cryptographic algorithm verification: ; In the formula, This indicates the weight of the encrypted information verification result. =0.4, Weights for firmware cryptographic algorithm verification results. =0.6, The score represents the result of the encrypted information verification; 1 indicates a normal result, and 0 indicates an abnormal result. The firmware cryptographic algorithm verification score is used when the firmware is working properly. When it is abnormal, , This indicates the confidence level of the corresponding result.
[0027] Specifically, when A value ≥ 0.8 is considered normal and the verification passes; when 0.7 ≤ <0.8, suspected anomaly, requires secondary verification; when If the value is less than 0.7, the verification fails.
[0028] like Figure 2 As shown, the present invention also provides a firmware cryptographic algorithm verification system based on dynamic behavior analysis, comprising: The data acquisition module is used to acquire plaintext information input by the user, environmental parameters at the current moment, ciphertext information obtained by encrypting plaintext based on cryptographic algorithms, and multi-dimensional dynamic behavior data during the encryption process of cryptographic algorithms. The data preprocessing module is used to preprocess the acquired data; The encrypted information verification module is used to verify encrypted information; The firmware cryptographic algorithm action verification module analyzes the actions and behaviors during the execution of the firmware cryptographic algorithm to obtain the verification result. The module includes a feature extraction unit and an action verification unit. The feature extraction unit extracts features from the preprocessed data and passes the extracted feature data to the action verification unit. The action verification unit uses a trained machine learning model to analyze the feature data and obtain classification results.
[0029] The comprehensive verification module is used to make a comprehensive judgment based on the verification results of the ciphertext information and the firmware cryptographic algorithm to obtain the final verification result.
[0030] Therefore, the present invention adopts the above-mentioned firmware cryptographic algorithm verification method and system based on dynamic behavior analysis. By combining static verification method with dynamic behavior verification method, the comprehensiveness of verification is improved and the security of execution is enhanced.
[0031] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.
Claims
1. A firmware cryptographic algorithm verification method based on dynamic behavior analysis, characterized in that, Including the following steps: S1. Obtain plaintext information input by the user, environmental parameters at the current moment, ciphertext information obtained by encrypting plaintext based on cryptographic algorithms, and multi-dimensional dynamic behavior data during the encryption process of cryptographic algorithms; S2. Preprocess the acquired data; S3. Use static verification method to verify the encrypted information and obtain the verification result of the encrypted information; S4. Perform feature extraction on the preprocessed data; S5. Input the feature data into the trained machine learning model to verify the firmware cryptographic algorithm execution process and obtain the firmware cryptographic algorithm verification result. S6. Combine the ciphertext information verification result and the firmware cryptographic algorithm verification result to obtain the final verification result.
2. The firmware cryptographic algorithm verification method based on dynamic behavior analysis according to claim 1, characterized in that: The plaintext information mentioned in step S1 includes the user's identity identifier and the original data to be encrypted. The environmental parameters include login time, IP location, network latency, and memory usage. The multi-dimensional dynamic behavior data includes the cryptographic algorithm call sequence, the instruction stream sequence during algorithm execution, the basic block execution order, the memory read / write address distribution, the number of accesses, and the timing pattern.
3. The firmware cryptographic algorithm verification method based on dynamic behavior analysis according to claim 1, characterized in that: Step S2 involves preprocessing the obtained data, including normalization, data cleaning, and timestamp alignment.
4. The firmware cryptographic algorithm verification method based on dynamic behavior analysis according to claim 1, characterized in that, Step S3 is as follows: S31. Based on the cryptographic algorithm type, verify whether the ciphertext length conforms to the algorithm output specification and whether the ciphertext conforms to the encoding specification. If it conforms, proceed to step S32. If it does not conform, it is judged as abnormal. S32. Use the firmware cryptographic algorithm to decrypt. If the decrypted information obtained is consistent with the plaintext information entered by the user, the verification is successful. If the decrypted information obtained is inconsistent with the plaintext information entered by the user, it is determined to be abnormal.
5. The firmware cryptographic algorithm verification method based on dynamic behavior analysis according to claim 1, characterized in that, Step S4, which involves feature extraction from the preprocessed data, specifically includes: S41. Extracting features from ciphertext information: Calculating the cryptographic entropy value based on the ciphertext information. The formula is: ； In the formula, =2, Represents the global single-byte information entropy. Indicates the first The actual probability of occurrence of this byte For the set of bytes that did not appear, The smoothing probability of not appearing. Indicates the number of bytes; S42. Extract environmental parameter features: extract the time period to which the login time belongs, extract the IP regional code, extract the mean, variance and standard deviation of network latency, and extract the instantaneous value and moving average of memory usage. S43. Extract dynamic behavioral data features: Extract the duration of cryptographic algorithm call timing, the proportion of subfunction execution time, and the temporal correlation of instruction stream sequence; extract the frequency and proportion of each opcode in the instruction stream, the similarity of basic block execution paths, the entropy value of memory read and write addresses, the mean, peak, and valley values of access times; extract the temporal patterns of memory read and write, and the Markov chain state transition probability of the instruction stream.
6. The firmware cryptographic algorithm verification method based on dynamic behavior analysis according to claim 1, characterized in that, Step S5, the machine learning model training process, includes: Collect normal and abnormal dynamic behavior data during the execution of cryptographic algorithms, as well as corresponding environmental parameters and ciphertext information; The obtained data is preprocessed, and features are extracted from the preprocessed data to construct a feature dataset; The feature dataset is divided into a training set and a test set; The machine learning model is trained using the training set and validated using the test set to obtain the trained machine learning model.
7. The firmware cryptographic algorithm verification method based on dynamic behavior analysis according to claim 6, characterized in that: The machine learning model uses a CNN-BiLSTM hybrid deep learning model.
8. The firmware cryptographic algorithm verification method based on dynamic behavior analysis according to claim 7, characterized in that, The CNN-BiLSTM hybrid deep learning model includes: The feature extraction module includes multiple parallel depthwise separable convolutional layers, concatenation layers, and global average pooling layers, used to extract multi-scale features from the input feature sequence; The BiLSTM temporal feature extraction module includes a bidirectional BiLSTM layer, a normalization layer, and a residual connection layer, which are used to capture temporal features in multi-scale features. The attention fusion module includes an attention layer, which calculates the weights of multi-scale features and temporal features through an attention mechanism, and obtains the fused features by weighted summation of the attention weights; The output module includes an output layer, which is used to output the two types of verification results and their corresponding confidence levels. The two types of results include normal and abnormal.
9. The firmware cryptographic algorithm verification method based on dynamic behavior analysis according to claim 1, characterized in that, Step S6 specifically includes: The formula is derived by combining the results of the encrypted information verification and the firmware cryptographic algorithm verification: ； In the formula, This indicates the weight of the encrypted information verification result. Weights for firmware cryptographic algorithm verification results. The score represents the result of the encrypted information verification; 1 indicates a normal result, and 0 indicates an abnormal result. The firmware cryptographic algorithm verification score is used when the firmware is working properly. When it is abnormal, , Indicates the confidence level of the corresponding result; when A value ≥ 0.8 is considered normal and the verification passes; when 0.7 ≤ <0.8, suspected anomaly, requires secondary verification; when If the value is less than 0.7, the verification fails.
10. A firmware cryptographic algorithm verification system based on dynamic behavior analysis, executing the firmware cryptographic algorithm verification method based on dynamic behavior analysis as described in any one of claims 1-9, characterized in that, include: The data acquisition module is used to acquire plaintext information input by the user, environmental parameters at the current moment, ciphertext information obtained by encrypting plaintext based on cryptographic algorithms, and multi-dimensional dynamic behavior data during the encryption process of cryptographic algorithms; The data preprocessing module is used to preprocess the acquired data; The encrypted information verification module is used to verify encrypted information; The firmware cryptographic algorithm action verification module is used to analyze the action behavior during the execution of the firmware cryptographic algorithm and obtain the firmware cryptographic algorithm verification result. The comprehensive verification module is used to make a comprehensive judgment based on the verification results of the ciphertext information and the firmware cryptographic algorithm to obtain the final verification result.