A graph neural network based efficient firmware information extraction method for IoT devices

The firmware information for IoT devices includes the manufacturer, the device type, the device model and the firmware version, etc. Identifying firmware information helps build firmware knowledge graph for many security applications, such as homologous analysis and vulnerability detection of firmware. The traditional firmware information identifying method only utilizes the content-based information, lacks the utilization of the structure information of the firmware, and more importantly, it lacks the use of timing information. Lacking of structural information can reduce prediction accuracy, and lacking of timing information will make it difficult to predict the firmware version. In order to address the disadvantages of the existing method, this paper abstracts the directories or files (components) of the firmware into the nodes of the graph and abstracts the relationships between the nodes into the edges of the graph. Timing information such as component creation time and component version are also attached to the node properties to introduce the time sequence features. As a result, the experimental results show that the accuracy of our method is better than that of random forest for the all four tasks (manufacture, device type, device model and firmware version identification). Particularly, and the accuracy rate is greatly improved in the firmware version identification task.