智慧电力物联网固件多粒度漏洞检测方法OA

[Objective]Firmware security in power Internet of Things(IoT)devices is crucial for ensuring the stable operation of critical infrastructure.However,existing vulnerability detection methods suffer from limited accuracy and adaptability due to complex firmware characteristics and reliance on a single analysis dimension.To address these issues,a multi-granularity vulnerability detection method for smart power IoT firmware suitable for the ubiquitous IoT background was proposed to improve the comprehensiveness and accuracy of vulnerability detection.[Methods]First,an i2vBi model was designed to map address space operands into eight classes to control the loading base address range,thus accurately generating instruction word vectors.The Softmax function was used to calculate contextual word probabilities,a maximum likelihood estimation model was trained,and instruction vectors were aggregated through a bidirectional long short-term memory(BiLSTM)network to obtain basic block embedding vectors containing forward and backward semantic information.Second,basic block embeddings were used to construct attribute control flow graphs to extract fine-grained structural features within functions.Furthermore,the principal neighborhood aggregation(PNA)algorithm was adopted,combining multiple aggregators and node-degree-based scalers to adaptively aggregate node neighbourhood information,generating more expressive graph embedding vectors and achieving function-level meso-granularity feature extraction.Subsequently,a convolutional neural network(CNN)and a self-attention mechanism were used to extract local pattern features of function execution order from graph embedding vectors,and these sequential features,together with attribute control flow graph features constructed from basic block embeddings,were input into a multilayer perceptron for fusion to form the final comprehensive feature vector.Finally,a semantic analysis dimension was introduced,in which known vulnerable functions were transformed into natural language text.A semantic embedding model based on bidirectional encoder representations from transformers(BERT)was used for masked modeling and mean pooling to generate semantic vectors.The cosine similarity between the semantic vectors and the comprehensive feature vectors of target functions was computed,and multi-granularity vulnerability detection based on semantic similarity was achieved by setting a threshold.[Results]To verify the effectiveness of the proposed method,experiments were conducted on a dataset containing real power IoT firmware images.The experimental results show that the AUC value of the proposed method remains stable between 0.85 and 0.95,which is significantly higher than that of comparative methods,demonstrating excellent overall classification performance.The Kappa coefficient lies in the high range of 0.85-0.95,indicating a high degree of consistency between detection results and actual conditions.The Hamming distance remains at a low level,indicating that false positive and false negative rates are effectively controlled,and prediction results are more accurate.[Conclusions]The proposed method effectively overcomes the limitation of a single feature dimension by integrating multiple levels of features,including instructions,basic blocks,function control flow,and semantics.This method not only significantly improves the accuracy and robustness of vulnerability detection but also exhibits better environmental adaptability due to its understanding of code semantics.The research results provide a reliable technical approach for automated and intelligent security analysis of smart power IoT firmware and have positive significance for enhancing the overall security and stability of power IoT systems.