Anomaly Detection Method for Integrated Electronic System Based on Deep Packet Analysis

Abstract

The invention discloses an abnormal detection oriented to a comprehensive electronic system based on deep packet analysis. The method comprises the following steps: collecting bus data; monitoring andcollecting a bus transmission data packet; extracting periodical data packet features; extracting a feature value of content change in the collected periodic data packet; training different applications under different subsystems to generate multiple decision trees; training different applications under different subsystems to generate corresponding decision trees; detecting an abnormal data packet through code of conduct; providing the decision tree corresponding to information selection according to the periodical data packet, and predicting a legal operation of the current periodic data packet by utilizing the decision tree, if an instruction in the to-be-checked non-periodic data packet content meets a decision tree prediction result, enabling a message to pass, or regarding that thedata packet is abnormal, and performing abnormal processing. The attack between the bus controller and a subsystem can be detected, thereby effectively resisting replay attack, forgery attack, denialof service and various attacks.

Description

technical field [0001] The invention belongs to the technical field of intrusion detection, and in particular relates to a lightweight intrusion detection method capable of resisting replay attacks, fake subsystem attacks and denial-of-service attacks by in-depth packet analysis and behavior specification detection of abnormal data packets. Background technique [0002] Integrated electronic systems are usually located in physically isolated networks, and their security issues have not been taken seriously. Since the advent of the Stuxnet virus, people have gradually conducted security research on physically isolated networks. Prior to this, people focused on the realization of the functions of the integrated electronic system, and basically did not conduct safety tests on the integrated electronic system. At present, security incidents occur frequently, APT attacks are becoming more and more rampant, and the threat of backdoor programs is becoming more and more severe. Ther...

AI Technical Summary

Problems solved by technology

[0003] Integrated electronic systems are limited by hardware, power consumption, and size, and their memory and CPU frequency are very small. Most integrated electronic systems will make full use of limited hardware resources to meet the requirements of system reliability design, with little consideration for safety. sex design

Images