Advanced Security Strategies for Software Vulnerability Protection: A Multi-Scale Detection Model With FPGA-RFID

Construction of RF System

RFID is a non-contact automatic identification technology based on inductance or electromagnetic coupling, which often plays an intelligent role in various fields such as monitoring and tracking. The key technology of RFID system is to obtain tag information quickly and accurately, and monitor it in real time (Mares et al., 2023). RFID systems in different communication bands have a great impact on the identification of label information, usually divided into categories such as Low Frequency, High Frequency, Ultra High Frequency (UHF), and microwave. Among them, UHF-RFID system is the most widely used, which can achieve a communication distance of 40–80 m. Meanwhile, it has long-distance identification and high reliability, so it is applied in software vulnerability detection model to improve the identification performance. The UHF-RFID system mainly uses electromagnetic coupling, in which the reader continuously sends the carrier through the dipole antenna. The instructions sent by the upper computer are attached. Part of the RF energy is absorbed at the tag and then converted into DC energy through the rectifier circuit to activate the tag chip. Meanwhile, the other part of the radio frequency energy uses the tag demodulation circuit and converts it into a digital signal (Pekarcikova et al., 2022). By adjusting the impedance of the circuit to change the matching condition of the antenna, the tag can scatter the corresponding data in different directions with various strengths. Then, the reader receives the scattered signal from different directions to obtain the tag information, thus collecting and identifying the tag information. The transmission and reception of radio frequency signals are both the collection and preprocessing of information or data. When the target tag receives the electromagnetic wave sent by the reader, the chip is activated and then transmitted to the reader in reverse. The distance of the radio frequency signal propagated is twice the distance between the reader and the tag.

In equation (7), λ represents the wavelength of the frequency signal and λ = c f . d is the distance from the transmitter to the receiver. ϕ ant is the additional phase shift introduced by the antenna. ϕ tag is the additional phase shift introduced by the label. Two additional phase shifts are merged, as shown in equation (8).

In equation (8), ϕ div represents the additional phase shift introduced by the device. In addition, the relationship between amplitude and signal strength is shown in equation (9).

In equation (9), r ( t ) and R ( t ) represent amplitude and signal strength, respectively. The signal of the reader/writer is transmitted in a periodic manner. The transmitted signal undergoes a jump of 0 to 2 π, which affects the model experiment. Therefore, the collected data is phase unwrapped. If a set of phase values φ = { θ 1 , θ 2 , . . . , θ n } is collected, θ i is the phase value of the i -th sampling point. The difference between two consecutive phase values is ϕ i = θ i + 1 − θ i . Whether to add or subtract 2 π based on the magnitude of ϕ i to balance the phase jump is determined. The judgment is shown in equation (10).

In equation (10), θ i + 1 − θ i is the difference between two consecutive phase values. Unwrapping solves the phase jump problem, thereby obtaining a continuous and uninterrupted phase curve. In addition to the interference of phase data, there are also external environmental factors that affect data smoothing. The Savitzky–Golay filter (S-G filter) is used to filter out noise, thereby maintaining the shape and width of the signal unchanged. The phase information after phase unwrapping is φ = { θ 1 , θ 2 , . . . , θ n } , which is divided into a single small window. An n-order polynomial ( n ≤ 2 m + 1 ) is constructed to fit this set of data, as shown in equation (11).

In equation (11), the data for each window is x [ i ] , i = − m , . . . , 0 , . . . m . The value range for i is 2 m + 1 integers. The S-G filter smoothing expression is shown in equation (12).

In equation (12), h i H represents the smoothing coefficient, which is obtained by fitting a polynomial using the least squares method. Finally, the phase data is normalized to observe the data change trend. The phase data of a label is { θ 1 , θ 2 , . . . , θ n } . n is the total phases. The normalization calculation of the i -th phase value θ i is shown in equation (13).

In equation (13), θ ∼ represents the new phase after normalization processing. θ i is the old phase before normalization processing. argmin θ k and argmax θ k stand for the minimum and maximum values of all samples before phase processing, respectively.

Construction of Field-Programmable Gate Array

As a universal user programmable device, FPGA has the high integration and versatility of gate array devices, the flexibility of field-programmable logic devices, short development cycles, and is easy to upgrade and maintain (Kara et al., 2022). Due to the above advantages of FPGA module, it is applied to software vulnerability detection model for improving the processing efficiency of the model. According to the FPGA chip design process and architecture developed by Xilinx, the security detection issues are thoroughly studied. The overall design process of FPGA is shown in Figure 1.OPEN IN VIEWER

From Figure 1, FPGA is mainly divided into design input, design synthesis, design implementation, and download verification. The design input can be achieved through methods such as drawing schematic diagrams and writing hardware programming languages. Simulation verification can be divided into RTL simulation, comprehensive simulation, timing simulation, and board level simulation according to different stages. Design synthesis is combined with constraints to optimize the design, obtaining the best solution. The design implementation distributes the obtained logic to the actual chip devices. The final download verification is to load the configuration bitstream data into the FPFA chip, which is to ensure the operation of the circuit. The architecture of Xilinx FPGA chips includes Input Output Block (IOB), Configurable Logic Block (CLB), Switch Box (SB), Connecting Box (CB), and Built in Random Access Memory (BRAM). The specific structure is shown in Figure 2.OPEN IN VIEWER

In Figure 2, the FPGA circuit design mainly consists of combinational logic and sequential logic. The combinational circuit is the data input of the sequential circuit. Data output can drive other sequential logics. The only logical function that determines the FPGA is the configuration data stored in an internal static storage unit. The numerical selection can configure the status options of logical units and the connection methods between each unit. In the architecture of FPGA chips, it is important to understand the main functions of each module (Şahin, 2023). Firstly, the IOB module serves as the external pin of the chip, mainly for inputting or outputting signals. The CLB module is the core circuit logic block of FPGA chips, which contains most of the resources. It can implement combinational logic, carry logic, and arithmetic logic, thereby completing logic carry and other operations. Secondly, BRAM is divided into single-port RAM, dual-port RAM, and first-in, first-out (FIFO) in FPGA chips. RAM can read and write data by address, while FIFO can only read and write data in order. Then, the digital clock management module completes clock phase adjustment and clock comprehensive management in the chip. Finally, FPGA chips contain rich wiring resources, including global wiring resources, long line resources, short line resources, and distributed resources. It mainly connects various logic units within the chip or completes signal control. The power supply of FPGA is relatively complex. Therefore, the power-on sequence and isolation need to be considered. As the power chips are all switching power chips, phase control is performed. The optimized Least Mean Square (LMS) algorithm and Coordinate Rotation Digital Computer (CORDIC) based on Euclidean distance can achieve phase correction. When FPGA processes signals and data, the binary form is often used. The expression of binary numbers includes fixed point numbers and floating-point numbers. Compared with floating-point numbers, the position of the decimal places remains unchanged, as shown in equation (1).

{ a B − 1 a B − 2 . . . a 1 a 0 △ a − 1 a − 2 . . . a − b D = ∑ i = − b B − 1 a i 2 i

(1)

In equation (1), B + b constitutes a fixed point number. B and b are integers and decimals, respectively. D represents the decimal representation. The numerical expression of floating-point numbers is shown in equation (2).

A = m × b e

(2)

In equation (2), A is a floating-point value. m is the mantissa, which is a positive number. The representation of the decimal part is the m and e -th power of b and the cardinality E. The binary representation can easily affect algorithm performance. Floating-point computing has low efficiency and high energy consumption. The high efficiency of fixed point calculation can meet the data processing requirements. In short, FPGA hardware has strong flexibility, which can efficiently construct any circuit. It can also adapt to circuit requirements in specific networks, with low processing power consumption.

Construction of Software Vulnerability Detection Model

With the development of information technology, the scale of software application is getting larger, and its architecture is also more complex, which leads to more common hidden security risks and more frequent malicious attacks (Zhang, 2024). Therefore, the detection and protection technology of software vulnerabilities is a research hotspot in the software security at present (Gültekin et al., 2023; Kavitha et al., 2023). The intelligent detection method for software vulnerabilities is usually based on deep learning computing hardware platforms and then analyzes the design, production, and computing patterns of the hardware platform to discuss the possibility of vulnerabilities (Kurnianto Hidayat & Wang, 2023). Therefore, for software vulnerability detection methods, multi-scale code measurement and feature extraction network are used to analyze the accuracy and efficiency of software vulnerability detection. The vulnerability type that its detection system can detect is Common Weakness Enumeration (CWE). Two representative vulnerability types, CWE-119 and CWE-399, are selected from it to verify the effectiveness of the detection system. After using RFID technology to process data and building FPGA successfully, an SVDM is proposed based on the two. SVDM mainly consists of three parts, namely, parser module, feature extraction module, and representation learning network model. In the feature extraction module, FPGA-RFID technology is used to improve the extraction efficiency and accuracy. The SVDM based on FPGA-RFID technology is shown in Figure 3.OPEN IN VIEWER

The model architecture of SVDM is designed to enable efficient and scalable vulnerability detection, where the parser module is responsible for parsing data (such as source code and binary files) into a vector representation. Therefore, the parser module can lay the foundation for subsequent processing. From these vectors, the feature extraction module extracts key features related to software vulnerabilities (code complexity, function call graphs, control flow graphs, etc.). The complexity of the control flow is evaluated by calculating the cyclomatic complexity of the code. By analyzing the function call graph, potential function level vulnerabilities are identified. Static code analysis tools are also used to extract features related to specific vulnerability patterns. These features are effectively integrated into the SVDM to improve the accuracy of vulnerability detection. In the representational learning phase, these features are combined effectively to form a more comprehensive and distinguishable feature set. In addition, hyper-parameter tuning is critical to the performance of deep learning models. The hyper-parameters (learning rate, batch size, and regularization parameters) of SVDM are fine-adjusted by cross validation, grid search, and Bayesian optimization. Through hyper-parameter tuning, the research can find the most suitable model configuration for the current dataset and vulnerability detection task. Finally, in order to verify the effectiveness of SVDM, two common vulnerability types are selected in the CWE list: CWE-119 (buffer error) and CWE-399 (resource leakage). To demonstrate the accuracy and feasibility of vulnerability detection models, the vulnerability detection methods based on semantics and code metrics are compared. Evaluation indicators usually use precision, recall, FNR, FPR, and F1 score to determine the accuracy of vulnerability detection models. The FNR is the rate at which negative results are mistakenly detected as positive, as shown in equation (3).

FNR = FN TP + FN

(3)

In equation (3), FN represents that a negative sample is mistakenly detected as a positive sample. TP is the negative sample that is correctly detected. The FPR is the proportion of falsely detecting positive as negative, as shown in equation (4).

FPR = FP FP + TN

(4)

In equation (4), FP stands for a positive sample that is mistakenly detected as a negative sample. TN stands for a positive sample that is correctly tested. The F1 score refers to the weighted harmonic average of accuracy and recall, which synthesizes the contradiction between the two, as shown in equation (5) (Al-Azzawi et al., 2022).

F = ( x 2 + 1 ) × Pr e cision × Re call x 2 ( Pr e cision + Re call )

(5)

In equation (5), x is the parameter. When the parameter is 1, the equation is expressed as the common F1 score, as shown in equation (6).

F 1 = 2 × Pr e cision × Re call Pr e cision + Re call

(6)

In equation (6), F 1 represents F1 score. According to the evaluation indicators, the best indicators for vulnerability detection models should be high precision, high recall, high F1 score, low FNR, and FPR.

Network Model Training Results for Vulnerability Datasets

The vulnerability data used in software vulnerability model testing mainly comes from the National Vulnerability Database (NVD) in the United States. NVD is a representative source code for open-source software projects in the real world, with 61,638 vulnerability samples selected. The CWE-119 vulnerability type contains 10,440 positive samples and 29,313 negative samples. CWE-399 vulnerability types include 7285 positive samples and 14,600 negative samples. The comparison indicators of this experiment mainly include precision, recall, FNR, FPR, and F1 score. Among them, precision refers to the proportion of samples correctly detected as positive samples in all samples tested as positive samples, which measures the accuracy of test results. The recall is the proportion of samples that are correctly tested positive to all samples that are actually positive, reflecting the completeness of the test results. The FNE describes the rate at which a negative sample is wrongly tested as positive. The FPR is the rate at which a positive sample is wrongly tested as negative. F1 score is the harmonic average of precision and recall, which is used for comprehensive evaluation of detection performance. Overall, these metrics provide a comprehensive assessment of the model performance.

The parameter settings of the vulnerability detection model are important for experimental operation. The neural network settings for the feature extraction module mainly include Bidirectional-Long Short Term Memory Network (Bi-LSTM) for semantic metrics, Convolutional Neural Network (CNN) for function granularity, and CNN for row granularity. The vulnerability characterization learning module utilizes the Bi-LSTM. Subsequently, to demonstrate the feasibility of SVDM, the multi-scale code measurement dataset is uniformly divided. Then it is used for training and testing vulnerability detection models. Additionally, several vulnerability detection tools and methods are selected for comparison, namely, Flawfinder, RIPS, VCCFinder, VPM, VulExplore, and VulDeePecker. The training dataset is derived from the CWE-119 and CWE-399 (Galić et al., 2024; Mohammad et al., 2022). The two are differentiated and mixed for training and testing to demonstrate the universal applicability of the detection model. Then, CWE-119-SET, CWE-399-SET, and the mixed dataset Multi-SET are selected for detection. The results are shown in Figure 4.OPEN IN VIEWER

From Figure 4, the precision, recall, and F1 indicators of the CWE-399 vulnerability dataset in the SVDM vulnerability detection model were 85.15%, 85.12%, and 84.79%, respectively, which were much higher than the CWE-119 dataset and the mixed dataset Multi-SET. In the detection results of FPR and FNR, the CWE-119 dataset had the highest FPR and FNR of 17.79% and 17.31%, respectively. This indicated poor dataset detection results. The CWE-399 dataset showed better detection results, with 15.23% and 14.69%, respectively. Overall, the deviation of the three datasets was still within an acceptable range. The significant difference was the F1 score of 2.74%, which verified the universal applicability on different vulnerability types. The mixed dataset Multi-SET was selected. It was trained and tested using different methods. The detection results are shown in Figure 5 (Kim et al., 2021).OPEN IN VIEWER

From Figure 5, the overall detection results of the SVDM were superior to other detection methods. The precision, recall, and F1 score of the mixed dataset Multi-SET on the model were 84.32%, 83.48%, and 84.18%, respectively. The FPR and FNR were 17.49% and 16.35%, respectively. Although higher than the 15.16% and 16.37% of VulDeePecker detection methods, it was far lower than other detection methods (Saminathan et al., 2023). To further demonstrate the complete detection results of different vulnerability detection methods, the Receiver Operating Characteristic Curves (ROCs) are tested for different detection methods and network models, as displayed in Figure 6.OPEN IN VIEWER

From Figure 6, the SVDM detection method used a Scalable Feature Network (SFN). The Deep Neural Network (DNN) was added for comparison. The ROC of the SVDM was closer to the upper left corner according to the Figure 6(a). It used a feature extraction module of Bi-LSTM + CNN + CNN to extract features from multi-scale code metrics (Al-Hassan et al., 2022). The long-term memory performance is applied to perform deep representation learning on feature vectors, thereby preserving features of different granularity in vulnerability code. The SFN model in Figure 6(b) emphasized the semantic information of the code context, which also focused on the correlation between metric attributes. Furthermore, the ROC curve was higher than other curves. The performance was superior to other models.

Performance Analysis of Software Vulnerability Detection Model

Afterward, the SVDM vulnerability detection model was improved to enhance the detection performance. The network structure of the model was replaced with a DNN structure. The detection structures of different models are compared, as displayed in Figure 7.OPEN IN VIEWER

From Figure 7(a), the SVDM vulnerability detection model was subjected to variant retesting. The precision, recall, and F1 score of the SVDM vulnerability detection model were 84.31%, 83.42%, and 84.18%, respectively, which were superior to other variant models. In Figure 7(b), the FPR and FNR were 17.28% and 16.31%, respectively, which were lower than other detection models. Based on all indicators, the SVDM vulnerability detection model using SFN had strong advantages in efficiency and precision. The code metric attributes were validated to enhance the practicality of the SVDM. Therefore, the control variable method is used to classify and combine multi-scale code measurement datasets (Guo et al., 2022; Kara et al., 2022). The measurement granularity of row granularity, function granularity, and semantic granularity is adopted. They are divided into 7 combination types, as shown in Table 1.

OPEN IN VIEWER

Table 1.

Combination Types of Control Variables and Structure of Feature Extraction Model

Combination Type	Measurement Granularity	Structure of Feature Extraction Model
1	Row granularity	CNN
2	Function granularity	CNN
3	Semantic granularity	Bi-LSTM
4	Function granularity + row granularity	CNN + CNN
5	Semantic granularity + row granularity	Bi-LSTM + CNN
6	Semantic granularity + function granularity	Bi-LSTM + CNN
7 (Control group)	Row granularity + semantic granularity + function granularity	Bi-LSTM + CNN + CNN

From Table 1, the feature extraction model structures corresponding to the seven combination types were different. The datasets used were subsets of the mixed dataset Multi-SET to govern different granularity code metrics. Afterward, the combination types 1–6 are used as the experimental group. The combination 7 is used as the control group for testing. The results of precision, recall, and F1 score are shown in Figure 8.OPEN IN VIEWER

From Figure 8(a), the precision, recall, and F1 indicators of experimental group 3 were 81.47%, 81.32%, and 81.79%, respectively, and the performance indicators of experimental groups 1–4 were all below 82%. In Figure 8(b), the precision, recall, and F1 score of combination type 6 were the best in the experimental group, with values of 84.76%, 83.11%, and 83.56%, respectively, while the precision, recall, and F1 score of control combination 7 were 84.63%, 83.21%, and 84.51%, respectively, which was much higher than all experimental combination types. Afterward, the FPR and FNR of the combination type are shown in Figure 9.OPEN IN VIEWER

From Figure 9, the combination 6 had the lowest FPR and FNR in the experimental group, with 17.34% and 16.24%, respectively. The FPR and FNR of combination type 7 in the control group were 17.25% and 16.14%, respectively, which were below the experimental group. Based on the performance indicators of the SVDM vulnerability detection model and the combined feature extraction model, it was found that the highest performance indicators of the former were 84.31%, 83.42%, and 84.18%, while the best results of the latter were 84.76%, 83.11%, and 83.56%. Through overall comparison, it is demonstrated that the combination of code metrics can better improve detection results.

Finally, in order to analyze the performance superiority of the optimized vulnerability detection model, multiple standardized benchmark test and comparison experiments are conducted with the current excellent vulnerability detection model based on code similarity and the vulnerability detection model based on machine learning and deep learning. The detection effect score, detection time score, and detection consumption score of the three models are taken as comparison indicators. A high score indicates better performance. The test results of the three models are shown in Table 2.

OPEN IN VIEWER

Table 2.

Test Results of the Three Models

Number of Tests	Model Type	Average Test Effect Score	Average Detection Time Score	Average Detection Consumption Score
3	The optimized model	95.2	90.3	85.1
	A model based on code similarity	80.1	75.2	70.2
	Models based on machine learning and deep learning	85.3	80.8	75.9
6	The optimized model	96.2	92.2	88.6
	A model based on code similarity	82.6	77.6	72.4
	Models based on machine learning and deep learning	87.1	83.1	78.6
9	The optimized model	97.2	93.2	90.1
	A model based on code similarity	83.6	79.6	74.0
	Models based on machine learning and deep learning	89.7	85.9	80.5

In Table 2, the detection effect score, detection time score, and detection consumption score of the optimized model were superior to those of the two comparison models. When the number of tests was 9, all the scores were the highest, among which the average test effect score, detection time score, and detection consumption score were 97, 90, and 93 points, respectively. The results show that the optimized vulnerability detection model has superior performance and can be applied in practice.