A fine-grained framework for online IoT device firmware identification via version evolution analysis

The rapid expansion of IoT networks has outpaced the capabilities of firmware management protocols, leaving numerous Internet-connected devices operating on outdated firmware that contains exploitable vulnerabilities. As vulnerabilities are closely tied to specific firmware versions, fine-grained version identification is critical for effective device management and security risk assessment. However, high firmware heterogeneity and subjective biases in feature selection pose significant challenges to online firmware version identification (OFVI) of IoT devices. To address these challenges, we first construct a dataset comprising 444,195 embedded web pages extracted from 1,000 successfully simulated firmware images. Through analyzing update patterns of embedded web interfaces during firmware version evolution, we propose FirmID, a novel OFVI framework for IoT devices that utilizes directory and content changes in embedded web interfaces. To handle the heterogeneity of firmware across different vendors, we introduce the Hierarchical Multimodal Attention Network (HMANet), a machine learning model specifically designed to capture differences across structural, textual, and functional modalities. To overcome the challenge of distinguishing hard samples caused by the frequent reuse of web pages in firmware iteration versions, we design a Hard Negative Mining Contrastive Loss that enhances intra-class compactness and inter-class separability. Moreover, to improve identification efficiency under uncertain network conditions, FirmID incorporates a complementary heuristic search algorithm, Firmware Identification with Monte Carlo Tree Search (FIMCTS). Experimental results demonstrate that FirmID surpasses state-of-the-art methods by 30.2% in accuracy and reduces file requests by 23.3% in recognition efficiency.