US Patent 10977367 Detecting malicious firmware modification

It is determined whether an installed firmware of a device matches a reference firmware for the device. In response to a determination that the installed firmware of the device does not match the reference firmware for the device, different types of content sections of the installed firmware of the device are extracted. At least one of the content sections is identified as a dynamic section. A portion of the installed firmware selected to exclude at least the dynamic section is compared with a corresponding portion of the reference firmware to determine a comparison result. A security action is performed based at least in part on the comparison result.