RDP graphic rendering instruction stream high-risk operation real-time blocking method under Loongson architecture

Abstract

The invention provides an RDP graphic rendering instruction stream high-risk operation real-time blocking method under a Loongson architecture, and relates to the technical field of computers, and the method comprises the following steps: intercepting a graphic rendering instruction stream transmitted by an RDP protocol in real time, analyzing each graphic rendering instruction in the graphic rendering instruction stream one by one, generating structural features, and storing the structural features in a database; comprising single instruction features and context-level features, calling and traversing a static rule base, matching the single instruction feature of each graphic rendering instruction with the static rule base, and if at least one single instruction feature is successfully matched, judging that the operation is a high-risk operation and triggering blocking; and if the matching is not successful, performing dynamic behavior analysis on the graphic rendering instruction stream based on the context-level features, and if a judgment result of the dynamic behavior analysis is abnormal, triggering blocking. According to the scheme, the static rule base and the dynamic analysis work cooperatively, so that the risk of missed judgment is reduced, excessive dependence on static rules is avoided, and the protection capability on system-level high-risk operation is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and specifically relates to a method for real-time blocking of high-risk operations in the RDP graphics rendering instruction stream under the LoongArch architecture. Background Art

[0002] The current security protection technology for the Remote Desktop Protocol (RDP) mainly focuses on image content protection. For example, the invention patent with the publication number CN117349890A discloses a technical solution that parses the image information in the RDP communication data packet, identifies the coordinates of sensitive areas and performs blurring processing, and triggers a control strategy when the user clicks or operates on the sensitive areas.

[0003] This solution relies on image feature matching (such as three-dimensional feature point extraction and sensitive area selection) and a static rule library (such as preset operations bound to sensitive levels). Although it can effectively prevent the leakage of sensitive image data, its protection mechanism is completely based on the static feature matching of image content (such as the extraction and blurring of sensitive area coordinates), and can only target the explicit risk of image information leakage, unable to cover non-image attack behaviors (such as underlying memory out-of-bounds access, covert instruction injection, etc.). Moreover, the preset static rule library used in the matching is prone to false negatives when facing unknown attack means or attack path disguises, all of which result in insufficient protection capabilities for system-level high-risk operations. Summary of the Invention

[0004] In view of the above defects or deficiencies in the prior art, this application aims to provide a method for real-time blocking of high-risk operations in the RDP graphics rendering instruction stream under the LoongArch architecture to enhance the protection capabilities for system-level high-risk operations; the method includes the following steps: Real-time intercept the graphics rendering instruction stream transmitted by the RDP protocol, and the graphics rendering instruction stream includes multiple graphics rendering instructions; Parse each of the graphics rendering instructions in the graphics rendering instruction stream one by one to generate the structured features of the graphics rendering instruction stream; the structured features include single-instruction features and context-level features. The single-instruction features include the operation type, target address, and permission range of each graphics rendering instruction, and the context-level features include the timing correlation index, operation logic continuity result, and sensitive operation density within a preset time window among multiple graphics rendering instructions; Retrieve and traverse the static rule library, and match the single-instruction features of each graphics rendering instruction with the static rule library. The static rule library includes multiple known attack patterns and the pattern features corresponding to each known attack pattern; If at least one of the single-instruction features matches successfully, it is determined as a high-risk operation and blocking is triggered; if all of the single-instruction features do not match successfully, dynamic behavior analysis is performed on the graphics rendering instruction stream based on the context-level features, and if the determination result of the dynamic behavior analysis is abnormal, blocking is triggered.

[0005] According to the technical solution provided by the present application, parsing each of the graphics rendering instructions in the graphics rendering instruction stream one by one to generate the structural features of the graphics rendering instruction stream includes the following steps: Based on the window size and sliding step of a preset time window, dividing the graphics rendering instruction stream into multiple consecutive instruction windows; For multiple graphics rendering instructions within each instruction window, analyzing the execution order and time interval between instructions to generate a timing correlation index; Verifying whether the operations within the instruction window meet the preset logic rules to obtain the operation logic continuity result; the preset logic rules include that the video memory allocation instruction is executed before the drawing instruction, and permission verification is required after the system call instruction; Counting the number of sensitive operations within each instruction window to obtain the sensitive operation density within the preset time window; the sensitive operations include out-of-bounds access to video memory, system memory writing, and modification of non-standard protocol fields; The timing correlation index, the operation logic continuity result, and the sensitive operation density constitute the context-level features.

[0006] According to the technical solution provided by the present application, the dynamic behavior analysis of the graphics rendering instruction stream based on the context-level features includes the following steps: Based on the timing correlation index, the operation logic continuity result, and the sensitive operation density, obtaining an anomaly score; If at least one of the following conditions is met, the determination result is abnormal: The anomaly score is greater than the preset risk threshold; The operation logic continuity result does not meet the preset logic rules; The sensitive operation density is greater than or equal to the dynamic density threshold.

[0007] According to the technical solution provided by the present application, the anomaly score is obtained through calculation by a dynamic deviation model, and the dynamic deviation model is an autoencoder, and its construction and training include the following steps: Extracting context-level features from historical normal RDP sessions to generate a training dataset, and the training dataset only includes the instruction stream features without attack behavior; Construct an autoencoder, which includes an encoder and a decoder. The encoder compresses the context-level features into a low-dimensional vector, and the decoder reconstructs the original features from the low-dimensional vector; Train the autoencoder with the goal of minimizing the reconstruction error, so that the context-level features of the normal instruction stream can be reconstructed with high precision; Obtain an anomaly score based on the temporal correlation index, the result of operation logic continuity, and the sensitive operation density, including the following steps: Input the context-level features of the real-time intercepted graphics rendering instruction stream into the trained autoencoder, and calculate the reconstruction error; Take the reconstruction error as the deviation index, and set a deviation threshold; Take the ratio of the deviation index to the deviation threshold as the anomaly score.

[0008] According to the technical solution provided by the present application, the window size of the preset time window is 5-20 consecutive graphics rendering instructions, the sliding step is 1-5 instructions, and the window size and the sliding step are dynamically adjusted according to the real-time load of the Loongson processor.

[0009] According to the technical solution provided by the present application, the structures of the encoder and decoder of the autoencoder are that the number of neurons in the input layer is equal to the dimension of the context-level features, the number of neurons in the encoding layer is 20%-30% of the input layer, the number of neurons in the decoding layer is equal to the input layer, and the activation function adopts a combination of ReLU and Sigmoid.

[0010] According to the technical solution provided by the present application, if the determination result of the dynamic behavior analysis is abnormal, triggering blocking includes the following steps: If the anomaly score is in the first interval, discard the high-risk instructions and record the log; if the anomaly score is in the second interval, additionally isolate the current RDP session; if the anomaly score is greater than the upper limit of the second interval, permanently freeze the access permission of the attack source IP; where the upper limit of the first interval is the lower limit of the second interval.

[0011] According to the technical solution provided by the present application, after extracting the context-level features from the historical normal RDP sessions and before generating the training dataset, the following steps are further included: Perform standardization processing on the context-level features of the historical normal RDP sessions to make each dimension of the features conform to the normal distribution; Perform a moving average filtering process on the temporal correlation index, and the window size of the filtering window has a 1:1 mapping relationship with the window size of the preset time window.

[0012] According to the technical solution provided by this application, to determine whether the operations within the verification instruction window meet the preset logical rules to obtain the operation logic continuity result, the following steps are included: If at least one of the following conditions is met, the operation logic continuity result does not meet the preset logical rules: Perform address range validity verification on the video memory allocation instruction, and the allocated base address exceeds the range of the virtual address mapping table of the current process; Perform a permission check mark scan on multiple instructions after the system call instruction, and no permission check instruction is found.

[0013] According to the technical solution provided by this application, the method is deployed in the GPU driver layer of LoongArch 3A5000 and above processors.

[0014] Compared with the prior art, the beneficial effects of this application are as follows: By intercepting the RDP graphics rendering instruction stream in real time and parsing it one by one, this application directly obtains the operation type, target address, and permission range (single-instruction features) of the underlying instructions, breaking through the limitations of traditional image content protection, covering non-image attacks (such as malicious memory writes, unauthorized instruction injection, etc.) at the instruction level, and achieving precise identification and interception of system-level high-risk operations. By extracting context-level features and combining dynamic behavior analysis technology, it captures the attack logic hidden in the instruction stream, effectively identifies the camouflage behavior or unknown variant attacks of the attack chain, and significantly improves the detection ability for complex attack paths. Therefore, this solution adopts a dual determination mechanism of static rule library matching and dynamic behavior analysis. The static rule library quickly intercepts known attack patterns, and the dynamic analysis module identifies abnormal behaviors through context feature modeling. The two work together to reduce the risk of missed judgments and avoid over-reliance on static rules, enhancing the adaptability to new attacks, thereby improving the protection ability for system-level high-risk operations. Description of the Drawings

[0015] Figure 1 It is a flowchart of the steps of the method for real-time blocking of high-risk operations in the RDP graphics rendering instruction stream under the LoongArch architecture provided by this application. Detailed Embodiments

[0016] The following further elaborates on this application with reference to the drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related invention and are not intended to limit the invention. Additionally, it should be noted that for the sake of description, only the parts related to the invention are shown in the drawings.

[0017] It should be noted that, without conflict, the embodiments in this application and the features in the embodiments can be combined with each other. The following will detail this application with reference to the drawings and embodiments.

[0018] Embodiment 1 As mentioned in the background technology, in response to the problems in the prior art, this application proposes a real-time blocking method for high-risk operations of RDP graphics rendering instruction streams under the Loongson architecture. The professional vocabulary mentioned in this application is now explained: the Loongson architecture is an instruction system architecture independently developed and designed by Loongson Zhongke. From the top-level planning of the architecture to the details of the instructions, it is independently designed, with autonomy, advancement and compatibility. It integrates the main functional characteristics of the international mainstream instruction system, is easy to design high-performance and low-power hardware, and software compilation optimization and development, and can also achieve efficient binary translation of multiple mainstream instruction systems. All newly developed CPUs from 2020 support this architecture. The RDP protocol, namely the Remote Desktop Protocol, is a multi-channel protocol designed and implemented by Microsoft for remote connection to the Windows system desktop environment, allowing the client to perform graphical interaction, audio playback, file operations, etc. as if it were local. The protocol is located above the application layer, uses port 3389 for network transmission, and adopts a multi-channel design to allocate different types of data to their respective logical channels.

[0019] like Figure 1 As shown, the method comprises the following steps: S1. intercepting a graphics rendering instruction stream transmitted by an RDP protocol in real time, wherein the graphics rendering instruction stream includes a plurality of graphics rendering instructions; Specifically, the graphics rendering instruction stream is a set of instructions used to describe how to present the changes in the desktop graphics of the server on the client during the RDP protocol transmission process, including multiple graphics rendering instructions, which control operations such as graphics drawing and image display. The method of intercepting the graphics rendering instruction stream in real time: in the system under the Loongson architecture, a data capture point is set on the RDP protocol data transmission path, and by writing a corresponding data capture program, the network interface or underlying driver interface provided by the operating system is used to obtain the RDP protocol data flowing through the point in real time, and extract the graphics rendering instruction stream from it.

[0020] S2, parsing each of the graphics rendering instructions in the graphics rendering instruction stream one by one to generate structured features of the graphics rendering instruction stream; the structured features include single instruction features and context-level features, the single instruction features include the operation type, target address and permission range of each of the graphics rendering instructions, and the context-level features include the timing correlation indicators between multiple graphics rendering instructions, the operation logic continuity results and the sensitive operation density within a preset time window; Specifically, the structured features are the feature representations obtained after parsing the graphics rendering instruction stream. The single-instruction features describe the attributes of a single graphics rendering instruction, referring to the operation type (such as operation categories like drawing graphics, setting colors, etc.), target address (the target location such as the memory address targeted by the instruction operation), and permission range (the size of the permissions and the restricted range possessed by the instruction operation) and other characteristics of each graphics rendering instruction; the context-level features reflect the correlation characteristics between multiple graphics rendering instructions, covering the timing correlation indicators between multiple graphics rendering instructions (time-related characteristics such as instruction execution order and time interval), the result of the continuity of the operation logic (the judgment result of whether the instruction execution conforms to the preset logic rules), and the density of sensitive operations within a preset time window (the frequency of occurrence of sensitive operations within a specific time window).

[0021] S3. Retrieve and traverse the static rule library, and match the single-instruction features of each of the graphics rendering instructions with the static rule library. The static rule library includes multiple known attack patterns and the pattern features corresponding to each of the known attack patterns; Specifically, the pre-established static rule library stores multiple known attack patterns and the pattern features corresponding to each known attack pattern. These pattern features are obtained based on the analysis and summary of past attack behaviors and are used to match with single-instruction features to determine whether there is a high-risk operation risk for the current instruction. The static rule library can be pre-stored in a specific file system on the local disk or stored in a database management system. When matching is required, the static rule library is loaded into memory through a file reading function or a database query interface for subsequent matching operations with single-instruction features.

[0022] S4. If at least one of the single-instruction features matches successfully, it is determined as a high-risk operation and blocking is triggered; if all the single-instruction features do not match successfully, dynamic behavior analysis is performed on the graphics rendering instruction stream based on the context-level features, and if the determination result of the dynamic behavior analysis is abnormal, blocking is triggered.

[0023] Describe the usage process and technical principle of this embodiment: First, capture the graphical rendering instruction stream transmitted by the RDP protocol in real time. Since the RDP protocol transmits desktop graphical change information, the graphical rendering instruction stream carries key drawing instructions and other instructions. Only by capturing it can subsequent instructions be analyzed. Then, parse each instruction in the instruction stream one by one to generate structured features, which can transform the original instruction stream into a form with clear feature representations, facilitating subsequent analysis and judgment. The single-instruction feature describes its attributes from the dimension of a single instruction, and the context-level feature is characterized from the dimensions of the relationship between instructions and the overall behavior. Next, retrieve and traverse the static rule library, and match the single-instruction features with it. This is a feature matching based on known attack patterns. If the match is successful, it indicates that there may be a high-risk operation in this instruction. If none of the single-instruction features match successfully, then perform dynamic behavior analysis based on the context-level features. Because some attack behaviors may not be judged by a single instruction and need to identify anomalies from the relationship between instructions and the overall behavior pattern. If the analysis and judgment result is abnormal, trigger blocking, thereby realizing real-time blocking of high-risk operations.

[0024] This embodiment can monitor high-risk operations in the graphical rendering instruction stream transmitted by the RDP protocol in real time. Through the parsing and feature extraction of the instruction stream, combined with static rule library matching and dynamic behavior analysis, it effectively identifies known attack patterns and some abnormal attack behaviors manifested through the instruction context relationship and overall behavior, and performs blocking in a timely manner. This improves the security of the system under the LoongArch architecture in the remote desktop application scenario, prevents security problems such as system attacks, data leakage, or system crashes caused by malicious graphical rendering instructions, and ensures the safe and reliable operation of remote desktop operations.

[0025] In a preferred embodiment, the step of parsing each graphical rendering instruction in the graphical rendering instruction stream one by one to generate the structured features of the graphical rendering instruction stream includes the following steps: Divide the graphical rendering instruction stream into multiple consecutive instruction windows based on the window size and sliding step of a preset time window; Specifically, starting from the starting position of the instruction stream, select instructions according to the window size to form the first instruction window, and then move backward at intervals of the sliding step to sequentially select new instruction windows until the entire instruction stream is traversed.

[0026] For multiple graphical rendering instructions in each instruction window, analyze the execution order and time interval between instructions to generate a timing correlation index; Verify whether the operations in the instruction window meet the preset logical rules to obtain the result of operation logic continuity; the preset logical rules include that the video memory allocation instruction is executed before the drawing instruction, and the system call instruction requires permission verification afterwards; Further, verify whether the operations within the verification instruction window meet the preset logical rules to obtain the operation logic continuity result, including the following steps: If at least one of the following conditions is met, the operation logic continuity result does not meet the preset logical rules: Verify the validity of the address range of the video memory allocation instruction, and the allocated base address exceeds the range of the virtual address mapping table of the current process; Perform a permission check mark scan on multiple instructions after the system call instruction, and no permission check instruction is found.

[0027] Specifically, verify the validity of the address range of the video memory allocation instruction, and the allocated base address exceeds the range of the virtual address mapping table of the current process. This is because normal video memory allocation operations should be carried out within the legal address range of the current process. If the allocated base address exceeds this range, it is very likely to be a malicious attack or a program error, which will pose a threat to the stability and security of the system. Perform a permission check mark scan on multiple instructions after the system call instruction, and no permission check instruction is found. This is to ensure the legality of the system call operation. System calls usually have higher privileges. If no permission check is performed after the call, it may be exploited by attackers to perform illegal operations, thus compromising the security of the system.

[0028] Count the number of sensitive operations in each instruction window to obtain the sensitive operation density within the preset time window; the sensitive operations include out-of-bounds access to video memory, system memory writing, and modification of non-standard protocol fields; The timing correlation index, the operation logic continuity result, and the sensitive operation density constitute the context-level features.

[0029] Specifically, dividing the graphics rendering instruction stream into instruction windows based on a preset time window is to process the continuous instruction stream in segments, facilitating the analysis of the relationships and behaviors between instructions within a local range. Generating the timing correlation index by analyzing the execution order and time interval of instructions within the instruction window can reflect the rules and correlations of instruction execution from the time dimension. Verifying the operation logic continuity result and judging whether the instruction execution logic is correct according to the preset logical rules, because reasonable instruction execution logic is the basis for the normal operation of the system, and violating the logical rules may mean abnormal or attack behaviors. Counting the sensitive operation density and measuring the security risk degree of the instruction stream by paying attention to the occurrence frequency of sensitive operations within the instruction window. These context-level features combined can more comprehensively describe the behavior pattern of the graphics rendering instruction stream over a period of time, providing data support for subsequent dynamic behavior analysis.

[0030] Further, the window size of the preset time window is 5-20 consecutive graphics rendering instructions, the sliding step is 1-5 instructions, and the window size and the sliding step are dynamically adjusted according to the real-time load of the Loongson processor.

[0031] Exemplarily, the complete instruction stream is as follows: The 1st instruction: video memory allocation, the 2nd instruction: color setting, the 3rd instruction: rectangle drawing, the 4th instruction: font loading, the 5th instruction: text rendering, the 6th instruction: video memory locking, the 7th instruction: image decoding, the 8th instruction: video memory writing, the 9th instruction: video memory release, the 10th instruction: palette modification, the 11th instruction: protocol tampering, the 12th instruction: drawing instruction; the 13th instruction: video memory allocation; the 14th instruction: system call, the 15th instruction: kernel writing. Among them, the 8th, 9th, 11th, 14th, and 15th instructions are sensitive marked. The system preset time window size is 10 consecutive instructions, and the sliding step is 5 instructions. When an attacker launches an attack, the instruction stream is divided into multiple windows (for example: the 1st-10th instructions are window 1, the 6th-15th instructions are window 2, and so on). The system detects the following anomalies for window 1: Number of sensitive operations: 2 times (instructions 8, 9), Sensitive operation density: 2 / 10 = 0.2 (equal to the threshold, not greater than), Timing feature: Instruction 8-9 interval: normal value 15ms (meeting the requirement of >10ms), Instruction order: Video memory allocation (1) → operation (8) → release (9) conforms to logic, Logic continuity: The video memory operation chain is complete: allocation → use → release. Finally, the context-level features of window 1 include: Timing correlation index: normal; Operation logic continuity result: normal; Sensitive operation density: 0.2 (not exceeding the threshold); Window 1 is normal. The system detects the following anomalies for window 2: Anomaly features of window 2 (instructions 6-15): Number of sensitive operations: 5 (instructions 8, 9, 11, 14, 15), Sensitive operation 5 times → 5 / 10 = 0.5 (exceeding the threshold 0.2), Timing anomaly: Instruction 8 → 9 interval compressed to 2ms (recalculated due to window overlap), Instruction 12 (drawing) precedes 13 (video memory allocation), violating the rule that "video memory allocation must precede drawing", Logic break: Violation of rule 1: Drawing instruction 12 lacks a pre-video memory allocation (13th comes later), Violation of rule 2: There is no permission check instruction after system call 14; Finally, the context-level features of window 2 include: Timing correlation index: high-frequency operation, order anomaly; Operation logic continuity result: incorrect video memory allocation order, permission check missing; Sensitive operation density: 0.5 (exceeding the threshold), Window 2 is abnormal. Based on these features, combined with subsequent steps, it is determined whether to trigger a blocking operation.

[0032] In a preferred embodiment, the dynamic behavior analysis of the graphics rendering instruction stream based on the context-level features includes the following steps: An anomaly score is obtained based on the temporal correlation index, the operational logic continuity result, and the sensitive operation density. Further, the anomaly score is calculated through a dynamic deviation model, and the dynamic deviation model is an autoencoder. Its construction and training include the following steps: Extract context-level features from historical normal RDP sessions to generate a training dataset, and the training dataset only includes instruction flow features without attack behaviors. Construct an autoencoder, which includes an encoder and a decoder. The encoder compresses the context-level features into a low-dimensional vector, and the decoder reconstructs the original features from the low-dimensional vector. Train the autoencoder with the goal of minimizing the reconstruction error so that the context-level features of the normal instruction flow can be reconstructed with high precision. The step of obtaining the anomaly score based on the temporal correlation index, the operational logic continuity result, and the sensitive operation density includes the following steps: Input the context-level features of the real-time intercepted graphic rendering instruction flow into the trained autoencoder to calculate the reconstruction error. Specifically, the reconstruction error is the degree of difference between the reconstructed features and the original input features after the autoencoder reconstructs the input context-level features, and is calculated through a certain distance metric (such as mean square error, etc.). The larger the reconstruction error, the greater the difference between the input instruction flow features and the normal mode learned by the autoencoder, that is, the more abnormal the instruction flow behavior.

[0033] Exemplarily, context-level features (including temporal correlation index, logical continuity result, sensitive operation density) of all instruction windows are extracted from 100,000 historical normal RDP sessions to form a training dataset. For example, the typical features of a normal instruction flow are: uniform temporal interval (10 - 20ms), complete satisfaction of logical rules, and sensitive operation density ≤ 0.1. Model construction: The autoencoder is designed with an input layer (3 nodes corresponding to 3 types of features), an encoder (compressed into a 1-dimensional low-dimensional vector), and a decoder (reconstructing 3-dimensional features); Model training: Using the mean square error (MSE) as the loss function, the reconstruction error of the trained autoencoder for normal features is stabilized below 0.05 (the threshold is set to 0.1).

[0034] Take the reconstruction error as the deviation index and set a deviation threshold. Take the ratio of the deviation index to the deviation threshold as the anomaly score.

[0035] Exemplarily, numericalize the context-level features of window 2: Temporal correlation index: [High-frequency marker = 1, Sequential anomaly marker = 1] → Encoded as 2 (1 + 1, anomaly count). Logical continuity result: [Video memory allocation error = 1, Permission verification missing = 1] → Encoded as 2. Sensitive operation density: 0.3. It should be noted that the actual features need to be normalized, and here it is simplified as an example. The input vector is x = [2, 2, 0.3], the encoder weights = [0.3, 0.3, 0.1], the encoder bias = [0.3, 0.3, 0.1], then the encoder output is: = (0.3 × 2) + (0.3 × 2) + (0.1 × 0.3) + 0.2 = 1.43; z activation = σ(1.43) = ≈ 0.81, so the encoder output is [0.8], the decoder weights are = [0.5, 0.4, 0.1], = [0.1, 0.2, 0.05], the decoder decodes to = [0.5 × 0.8 + 0.1, 0.4 × 0.8 + 0.2, 0.1 × 0.8 + 0.05] = [0.5, 0.52, 0.13]. The difference between the original input and the reconstructed output is calculated using the mean squared error (MSE) as 1.4834. Based on historical normal data, the threshold is set to 0.1 (average MSE of normal instruction stream ≤ 0.1), and the anomaly score = reconstruction error / deviation threshold = 14.834.

[0036] If at least one of the following conditions is met, the determination result is abnormal: The anomaly score is greater than the preset risk threshold; The operation logical continuity result does not meet the preset logical rules; The sensitive operation density is greater than or equal to the dynamic density threshold.

[0037] Specifically, by analyzing and statistically calculating the context-level features of a large number of historical normal RDP sessions, the distribution range of the anomaly score under normal conditions can be calculated. Based on this distribution, considering factors such as system security requirements and acceptable false alarm rates, a suitable value is determined as the preset risk threshold. For example, the 95th percentile of the anomaly score in historical normal data is selected as the preset risk threshold. The dynamic density threshold is dynamically calculated according to factors such as the current real-time load of the system, historical sensitive operation density data, and adjustment of security policies. For example, when the system load is low, the dynamic density threshold can be appropriately reduced to improve detection sensitivity; according to historical data statistics, the average sensitive operation density is 5% within a certain period of time, then it can be adjusted up and down by a certain proportion (such as ±2%) based on the strictness of the security policy to determine the dynamic density threshold.

[0038] Exemplarily, the anomaly score (14.834) > the preset risk threshold (e.g., threshold = 2.0). The sensitive operation density (0.3) > the dynamic density threshold (e.g., threshold = 0.2). The logical continuity result is not satisfied (video memory allocation error + permission verification missing). Therefore, all three conditions are satisfied, and the determination result is abnormal.

[0039] This embodiment can accurately determine whether there is abnormal behavior in the graphics rendering instruction stream, and then trigger the blocking operation in a timely manner. By comparing the anomaly score with the preset risk threshold, the deviation of the overall behavior of the instruction stream from the normal mode is considered; the logical continuity result of the operation directly reflects the correctness of the instruction execution logic; the sensitive operation density judges anomalies from the perspective of the occurrence frequency of sensitive operations. The combination of multiple determination conditions avoids the limitations of single-condition judgment, improves the accuracy and reliability of abnormal behavior detection, effectively prevents high-risk operations from harming the system, and ensures the safe operation of the system under the LoongArch architecture. Through the compression-reconstruction mechanism, the normal mode is encoded into a low-dimensional distribution, and abnormal behavior generates a high reconstruction error because it cannot be restored. Combining multi-dimensional determination conditions, precise real-time blocking of the RDP graphics rendering instruction stream under the LoongArch architecture is achieved.

[0040] In a preferred embodiment, the encoder and decoder structures of the autoencoder are such that the number of neurons in the input layer is equal to the dimension of the context-level features, the number of neurons in the encoding layer is 20%-30% of the input layer, the number of neurons in the decoding layer is equal to the input layer, and the activation function adopts a combination of ReLU and Sigmoid.

[0041] Specifically, the number of neurons in the input layer is equal to the dimension of the context-level features to ensure that the autoencoder can directly process the original context-level feature data, enabling all information of the input data to be utilized and avoiding information loss. The number of neurons in the encoding layer is set to 20% - 30% of the input layer. This is a dimensionality reduction operation. By compressing the high-dimensional context-level features into a low-dimensional space, the autoencoder can learn the essential features and potential structure of the data, removing noise and redundant information. In this way, during the subsequent reconstruction process, it is possible to better distinguish normal patterns from abnormal patterns. The number of neurons in the decoding layer is equal to that of the input layer to be able to reconstruct the encoded low-dimensional vector into features of the same dimension as the original input for calculating the reconstruction error. The activation function uses a combination of ReLU and Sigmoid. The ReLU function has good performance in dealing with non-linear problems, can effectively solve the vanishing gradient problem, and accelerate the training speed of the model. The Sigmoid function can map the output to the interval [0, 1], which is suitable for dealing with probability-related problems and can help the model in the autoencoder better learn the distribution of the data. Exemplarily, ReLU is used in the encoding layer to solve the vanishing gradient problem and enhance the non-linear expression ability. Sigmoid is used in the decoding layer to limit the output to the range [0, 1] to adapt to the numerical distribution after feature normalization.

[0042] In a preferred embodiment, the triggering of blocking when the determination result of the dynamic behavior analysis is abnormal includes the following steps: If the abnormal score is within the first interval, discard the high-risk instruction and record a log; if the abnormal score is within the second interval, additionally isolate the current RDP session; if the abnormal score is greater than the upper limit of the second interval, permanently freeze the access permission of the attack source IP; where the upper limit of the first interval is the lower limit of the second interval.

[0043] Specifically, based on historical data statistics, for example, the 95th percentile of the normal score is 1.5, then the upper limit of the first interval = 1.5 × 1.3 ≈ 2.0 (leaving 30% buffer); First interval (1.0 ≤ score < 2.0): low risk, only record the log to avoid interfering with normal operations. Second interval (2.0 ≤ score < 5.0): medium risk, isolate the session to prevent lateral penetration. Third interval (score ≥ 5.0): high risk, permanently freeze the IP to prevent continuous attacks.

[0044] In a preferred embodiment, after extracting the context-level features from the historical normal RDP sessions and before generating the training dataset, the following steps are further included: Perform normalization processing on the context-level features of the historical normal RDP sessions to make each dimension of the features conform to the normal distribution; Perform a moving average filtering process on the timing correlation index, and the window size of the filtering window maintains a 1:1 mapping relationship with the window size of the preset time window.

[0045] Specifically, the standardization process can adopt Z-score normalization to eliminate the differences in feature dimensions. For example, the numerical scales of the timing correlation (0 - 100 ms) and the sensitive operation density (0 - 1) are different. The moving average filtering is to smooth the instantaneous fluctuations of the timing index (such as abnormal instruction intervals caused by network jitter) and reduce misjudgments.

[0046] In a preferred embodiment, the method is deployed in the GPU driver layer of LoongArch 3A5000 and above processors.

[0047] Specifically, deploying the method in the GPU driver layer of LoongArch 3A5000 and above processors is because the GPU driver layer can directly access and process the graphics rendering instruction stream, with high real-time performance and efficiency. LoongArch 3A5000 and above processors have strong computing capabilities and performance, which can meet the requirements of real-time monitoring and analysis of the graphics rendering instruction stream. Deploying this method in the GPU driver layer can intercept and analyze at the source of the graphics rendering instruction stream, timely discover and block high-risk operations, and effectively protect the security of the system.

[0048] The specific implementation is to build a program module for the GPU driver layer of LoongArch 3A5000 and above processors (the strategy is consistent with the process of this method). This module realizes functions such as real-time intercepting the graphics rendering instruction stream transmitted by the RDP protocol, parsing the instruction stream, generating structured features, matching the static rule library, performing dynamic behavior analysis, and triggering blocking operations. In the initialization stage of the GPU driver layer, load this program module and register it into the corresponding event handling mechanism to ensure that this module can be called in a timely manner for processing when the graphics rendering instruction stream is transmitted. Conduct strict testing and optimization on this program module to ensure that it can run stably in the GPU driver layer of LoongArch 3A5000 and above processors and will not have an obvious impact on the normal performance of the system.

[0049] In this article, specific examples are used to elaborate on the principles and implementation methods of this application. The descriptions of the above embodiments are only used to help understand the method of this application and its core idea. The above are only the preferred implementation methods of this application. It should be noted that due to the limitations of literal expression and objectively existing infinite specific structures, for those of ordinary skill in the art in this technical field, without departing from the principle of this invention, several improvements, retouches or changes can be made, or the above technical features can be combined in an appropriate manner; these improvements, retouches, changes or combinations, or directly applying the concept and technical solution of the invention to other occasions without improvement, should all be regarded as the protection scope of this application.

Claims

1. A real-time blocking method for high-risk operations of RDP graphics rendering instruction stream under Loongson architecture, characterized in that: The following steps are involved: intercepting a graphics rendering instruction stream transmitted by an RDP protocol in real time, wherein the graphics rendering instruction stream includes a plurality of graphics rendering instructions; Parsing each of the graphics rendering instructions in the graphics rendering instruction stream one by one to generate structural features of the graphics rendering instruction stream; The structural features include single instruction features and context-level features. The single instruction features include the operation type, target address and permission range of each graphics rendering instruction. The context-level features include the timing correlation index between multiple graphics rendering instructions, the operation logic continuity result and the sensitive operation density within a preset time window. Retrieving and traversing a static rule base, matching the single instruction feature of each of the graphics rendering instructions with the static rule base, wherein the static rule base includes a plurality of known attack patterns and pattern features corresponding to each of the known attack patterns; If at least one of the single instruction features matches successfully, it is determined to be a high-risk operation and blocking is triggered; if all of the single instruction features fail to match successfully, a dynamic behavior analysis of the graphics rendering instruction stream is performed based on the context-level features, and if the determination result of the dynamic behavior analysis is abnormal, blocking is triggered.

2. The method for real-time blocking of high-risk operations of RDP graphics rendering instruction stream under the Loongson architecture according to claim 1 is characterized in that: The step of parsing each of the graphics rendering instructions in the graphics rendering instruction stream one by one to generate structural features of the graphics rendering instruction stream comprises the following steps: Based on a window size and a sliding step size of a preset time window, dividing the graphics rendering instruction stream into a plurality of continuous instruction windows; For each of the plurality of graphics rendering instructions in the instruction window, analyzing the execution order and time interval between the instructions, and generating a timing correlation index; Verify whether the operation in the command window meets the preset logic rules to obtain the result of the operation logic continuity; the preset logic rules include that the video memory allocation instruction is executed before the drawing instruction, and the permission check is required after the system call instruction; Counting the number of sensitive operations in each instruction window to obtain the density of sensitive operations in a preset time window; the sensitive operations include out-of-bounds access to video memory, writing to system memory, and modification of non-standard protocol fields; The timing correlation index, the operation logic continuity result and the sensitive operation density constitute the context-level feature.

3. The method for real-time blocking of high-risk operations of RDP graphics rendering instruction stream under the Loongson architecture according to claim 1 is characterized in that: The step of performing dynamic behavior analysis on the graphics rendering instruction stream based on the context-level features comprises the following steps: Obtaining an anomaly score based on the timing correlation index, the operation logic continuity result, and the sensitive operation density; If at least one of the following conditions is met, the result is considered abnormal: The abnormality score is greater than a preset risk threshold; The operation logic continuity result is that the preset logic rule is not satisfied; The sensitive operation density is greater than or equal to a dynamic density threshold.

4. The method for real-time blocking of high-risk operations of RDP graphics rendering instruction stream under the Loongson architecture according to claim 3 is characterized in that: The anomaly score is calculated by a dynamic deviation model, and the dynamic deviation model is an autoencoder, and its construction and training include the following steps: Extracting context-level features from historical normal RDP sessions to generate a training data set, wherein the training data set only includes instruction flow features without attack behaviors; Constructing an autoencoder, the autoencoder comprising an encoder and a decoder, the encoder compressing the context-level features into a low-dimensional vector, and the decoder reconstructing the original features from the low-dimensional vector; The autoencoder is trained with the goal of minimizing the reconstruction error so that the context-level features of the normal instruction stream can be reconstructed with high accuracy; The obtaining of anomaly scores based on the timing correlation index, the operation logic continuity result and the sensitive operation density comprises the following steps: Inputting the context-level features of the graphics rendering instruction stream intercepted in real time into the trained autoencoder to calculate the reconstruction error; Using the reconstruction error as a deviation index and setting a deviation threshold; The ratio of the deviation index to the deviation threshold is used as the abnormality score.

5. The method for real-time blocking of high-risk operations of RDP graphics rendering instruction stream under the Loongson architecture according to claim 2 is characterized in that: The window size of the preset time window is 5-20 consecutive graphics rendering instructions, the sliding step is 1-5 instructions, and the window size and the sliding step are dynamically adjusted according to the real-time load of the Loongson processor.

6. The method for real-time blocking of high-risk operations of RDP graphics rendering instruction stream under the Loongson architecture according to claim 4 is characterized in that: The encoder and decoder structures of the autoencoder are as follows: the number of neurons in the input layer is equal to the dimension of the context-level features, the number of neurons in the encoding layer is 20%-30% of the input layer, the number of neurons in the decoding layer is equal to that in the input layer, and the activation function adopts a combination of ReLU and Sigmoid.

7. The method for real-time blocking of high-risk operations of RDP graphics rendering instruction stream under the Loongson architecture according to claim 3 is characterized in that: If the determination result of the dynamic behavior analysis is abnormal, blocking is triggered, comprising the following steps: If the anomaly score is in the first interval, high-risk instructions are discarded and logs are recorded; if the anomaly score is in the second interval, the current RDP session is additionally isolated; if the anomaly score is greater than the upper limit of the second interval, the access rights of the attack source IP are permanently frozen; wherein the upper limit of the first interval is the lower limit of the second interval.

8. The method for real-time blocking of high-risk operations of RDP graphics rendering instruction stream under the Loongson architecture according to claim 4 is characterized in that: After extracting context-level features from historical normal RDP sessions and before generating a training data set, the following steps are also included: The context-level features of historical normal RDP sessions are standardized to make the features of each dimension conform to the normal distribution; The timing correlation index is subjected to sliding average filtering, and the window size of the filtering window maintains a 1:1 mapping relationship with the window size of the preset time window.

9. The method for real-time blocking of high-risk operations of RDP graphics rendering instruction stream under the Loongson architecture according to claim 2 is characterized in that: The verification of whether the operation in the instruction window satisfies the preset logic rules to obtain the operation logic continuity result includes the following steps: If at least one of the following conditions is met, the operation logic continuity result does not meet the preset logic rule: Performing address range validity verification on the video memory allocation instruction, and the allocation base address exceeds the range of the virtual address mapping table of the current process; A permission check mark scan was performed on multiple instructions after the system call instruction, and no permission check instruction was found.

10. The method for real-time blocking of high-risk operations of RDP graphics rendering instruction stream under the Loongson architecture according to claim 1, characterized in that: The method is deployed in the GPU driver layer of Loongson 3A5000 and above processors.

Images