Research on security assessment method of vulnerability indicators for container images and firmware of power edge devices

doi:10.3969/j.issn.1671-1122.2026.10.002

Abstract

Abstract:

With the accelerated advancement of the digital transformation of power systems, the number of edge devices has shown exponential growth trend. However, the container images and firmware of power edge devices are facing increasingly severe security threats, and these vulnerabilities pose great hidden risks to the safe and stable operation of power systems. Therefore, how to effectively evaluate the vulnerabilities of container images and firmware and detect their security loopholes in advance is an urgent issue to be solved in current power system security. Existing studies have not yet formed an effective paradigm compatible with the vulnerability assessment of container images and firmware for power edge devices, making it difficult to establish unified evaluation standards. In view of this, this paper proposed a security assessment method of vulnerability indicators for container images and firmware of power edge devices, constructed a three-level vulnerability indicator system of “basic-image-firmware”, which fully covered the common risks and exclusive characteristics of container images and firmware, and combined the Bayesian optimization method to build an evaluation method based on the XGBoost model. To verify the effectiveness of the proposed indicator system and evaluation method, this paper collected and aggregated 295 experimental samples of power firmware and container images for testing. The experimental results show that the accuracy rate of the proposed method reaches 96%, indicating that this method has high reliability and effectiveness in practical applications.

Key words: power edge devices, container images, firmware, security assessment

CLC Number:

TP309

Jiang Delong, Guo Jiacheng, Guo Jing, Gu Zhimin, Wang juan, Li Jun’e. Research on security assessment method of vulnerability indicators for container images and firmware of power edge devices[J]. Netinfo Security, 2026, 26(10): 1526-1537.

Figures/Tables 7

References 30

[1]	张绚. 电子设备在智能电网边设备中的集成硬件设计研究[EB/OL].(2024-05-26)[2025-12-17]. https://cpfd.cnki.com.cn/Article/CPFDTOTAL-ZHGY202405001078.htm.
[2]	许鹏, 何霖. 新型电力系统下5G+云边端协同的源网荷储架构及关键技术初探[J]. 四川电力技术, 2021, 44(6): 67-73.
[3]	朱峰辰, 翁嘉明, 刘东, 等. 网格化配电网的控制设备即插即用关键技术探讨[J]. 供用电, 2024, 41(5): 18-27.
[4]	王钰童, 顾进广. 边缘场景下基于DDQN的容器组调度策略[J]. 计算机技术与发展, 2024, 34(9): 16-22.
[5]	白鑫. 基于容器技术的云边协同工业互联网平台[J]. 科技与创新, 2024(21): 52-55.
[6]	杨婷, 张嘉元, 黄在起, 等. 工业控制系统安全综述[J]. 计算机研究与发展, 2022, 59(5): 1035-1053.
[7]	Shi Hequan, Ying Lingyun, Chen Libo, et al. Dr. docker: a large-scale security measurement of docker image ecosystem[C]// The ACM on Web Conference 2025. New York: ACM, 2025: 2813-2823.
[8]	李本恕, 王汉雄, 陈浩. 云原生下供应链安全的思考与实践[J]. 工业信息安全, 2022(8): 71-75.
[9]	徐胜超. 基于历史数据分析的容器云安全风险评估方法[J]. 计算机测量与控制, 2022, 30(11): 265-271.
[10]	夏懿航, 张志龙, 王木子, 等. 基于依赖关系的容器供应链脆弱性检测方法[J]. 信息网络安全, 2023, 23(2): 76-84.
[11]	Aldiabat M, Yaseen Q M, Abu E Q. An efficient random forest classifier for detecting malicious docker images in docker hub repository[J]. IEEE Access, 2024(12): 185586-185604.
[12]	GitHub. 镜像安全扫描工具trivy[EB/OL]. (2020-01-03)[2025-12-17]. https://github.com/aquasecurity/trivy.
[13]	GUARD. 配置安全分析工具coguard[EB/OL]. (2021-08-01)[2025-12-17]. https://www.coguard.io/.
[14]	王思琪, 缪思薇, 张小玲, 等. 基于D-S证据理论的嵌入式固件Web代码静态漏洞检测技术[J]. 北京邮电大学学报, 2019, 42(5): 91-99.
[15]	张乐. 物联网固件脆弱性分析系统的研究与实现[D]. 北京: 北京邮电大学, 2020.
[16]	Shen Quanjiang, Song Yan, Yu Xiaohu, et al.Large scale firmware analysis for open source components, hard coding and weak passwords[C]//2021 IEEE International Conference on Consumer Electronics and Computer Engineering (ICCECE). New York: IEEE, 2021: 232-236.
[17]	GitHub. 固件分析工具Binwalk[EB/OL]. (2018-07-26)[2025-12-17]. https://github.com/ReFirmLabs/binwalk.
[18]	GitHub. 固件安全分析工具firmwalker[EB/OL]. (2020-11-06)[2025-12-17]. https://github.com/zhibx/firmwalker_pro.
[19]	王伟, 朱江, 魏兴慎, 等. 面向新型配电系统的网络安全脆弱性评估[J]. 电力信息与通信技术, 2024, 22(8): 37-44.
[20]	Alzahrani F A, Ahmad M, Ansari M T J. Towards design and development of security assessment framework for Internet of medical things[EB/OL]. (2022-08-15)[2025-12-17]. https://doi.org/10.3390/app12168148.
[21]	Liu Puzhuo, Fang Dongliang, Qin Chuan, et al. Finding vulnerabilities in internal-binary of firmware with clues[C]// ICC 2022-IEEE International Conference on Communications. New York: IEEE, 2022: 5397-5402.
[22]	Li Yingzheng, Zou Nan, Cai Muliang, et al. Study of lightweight virtualization techniques combined with deep learning in the power Internet of things (IoT)[EB/OL]. (2025-06-20)[2025-12-17]. https://ieeexplore.ieee.org/document/11034560.
[23]	Feng Xiaotao, Zhu Xiaogang, Han Qinglong, et al. Detecting vulnerability on IoT device firmware: a survey[J]. IEEE, 2023, 10(1): 25-41.
[24]	刘沛宇. 物联网系统云端容器镜像及终端设备的安全与隐私分析技术研究[D]. 杭州: 浙江大学, 2022.
[25]	Yin Siwei, Dai Zhitao.A method for detecting secret-key leaks in public container images on DockerHub[C]//2023 the 9th International Conference on Computer and Communications (ICCC). New York: IEEE, 2023: 2068-2073.
[26]	Wang Jiapeng, Zheng Zhihan, Qiu Kefan, et al. A framework for BMC firmware vulnerability analysis and exploitation[C]// 2024 IEEE International Conferences on Internet of Things (iThings) and IEEE Green Computing & Communications (GreenCom) and IEEE Cyber, Physical & Social Computing (CPSCom) and IEEE Smart Data (SmartData) and IEEE Congress on Cybermatics. New York: IEEE, 2024: 9-16.
[27]	Zhao Binbin, Ji Shouling, Xu Jiacheng, et al. A large-scale empirical analysis of the vulnerabilities introduced by third-party components in IoT firmware[C]// The 31st ACM SIGSOFT International Symposium on Software Testing and Analysis. New York: ACM, 2022: 442-454.
[28]	Ma Xiaocheng, Yan Cheyu, Wang Yunchao, et al. A vulnerability scanning method for web services in embedded firmware[EB/OL]. (2024-03-12)[2025-12-17]. https://doi.org/10.3390/app14062373.
[29]	江子锐, 梁辰, 张子龙, 等. 一种面向异构固件的高效靶向分析技术[J]. 计算机工程, 2025, 51(11): 171-185.
[30]	Hou Qinsheng, Diao Wenrui, Wang Yanhao, et al. Large-scale security measurements on the android firmware ecosystem[C]// The 44th International Conference on Software Engineering. New York: ACM, 2022: 1257-1268.

指标类别	指标名称	指标描述
基础	特殊关键字	admin、password等特殊关键字的数量
	漏洞组件	已被暴露漏洞的组件数量
	弱加密口令	shadow、passwd等弱加密口令文件的数量
	SSH/SSL相关文件	.pub、.crt等SSH/SSL相关文件的数量
	敏感信息	匹配检索ip、url、email敏感信息的数量
	配置文件	.conf、.ini等配置文件的数量
	数据库文件	.db、.sqlite等数据库文件的数量
	关键二进制文件	ssh、busybox等关键二进制文件的数量
	第三方软件	/opt目录下第三方软件的数量
	shell脚本	shell脚本的数量
	常见Web组件	apache、weblogic等Web组件的数量
镜像	镜像暴露层数	容器镜像层的数量
镜像	镜像配置文件漏洞	镜像配置文件中违反规则的命令数量，规则包括“配置文件中最多有一个CMD指令”“配置文件中最多有一个ENTRYPOINT指令”等
固件	固件加密及签名校验	固件是否加密，签名是否检验，若是，则输出1；否则，输出0
固件	敏感APK文件	固件中权限不安全的APK数量

模型	准确率	Macro-F1	精确率
随机森林	86.44%	0.8524	87.60%
支持向量机	61.02%	0.4393	52.13%
逻辑回归	74.58%	0.7722	78.51%
XGBoost（移除贝叶斯优化）	84.75%	0.8217	86.10%
XGBoost+贝叶斯优化	96.61%	0.9753	96.75%