A power software virus detection method embedded with a hardware fusing mechanism

Abstract

The application relates to the technical field of software virus detection, and discloses a power software virus detection method embedded with a hardware fuse mechanism, which is used for solving the problem of false judgment of virus existence caused by software updating during software virus detection, and comprises the following steps: collecting running state data to obtain a software system behavior characteristic set when a software system is updated; calculating virus characteristic matching degrees of each behavior characteristic vector in the characteristic set; determining whether virus exists; if it is determined that virus exists, obtaining updating related parameters of the software system, evaluating an updating influence index, determining whether false judgment occurs at present, constructing a safety baseline behavior model, calculating a dynamic deviation index if it is determined that false judgment does not occur at present, and triggering the hardware fuse mechanism if it is determined that there is serious deviation from the safety baseline behavior according to the dynamic deviation index, so that the accuracy of virus detection is effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software virus detection, and more particularly to a power software virus detection method embedded with a hardware fuse mechanism. BACKGROUND

[0002] With the continuous improvement of the digitalization and intelligentization level of the power system, the embedded software in the power terminal device undertakes more and more key control tasks, such as relay protection logic, state monitoring and analysis, device cooperative scheduling, communication management and remote upgrading, etc. Such power software usually runs on an embedded platform, has characteristics such as high real-time performance, high dependency and strong coupling business logic, and stable operation is of great significance to guarantee the safety and stability of the power grid.

[0003] In order to improve the protection ability of the power terminal against malicious code, a software virus detection mechanism is gradually introduced in the prior art, which combines static instruction signature matching, behavior rule comparison, whitelist verification and other methods to identify suspicious behaviors during software operation. For key scenarios, a hardware fuse mechanism is further embedded, which can quickly interrupt the transmission of related instructions or the calling path of permissions when high-risk virus behaviors are detected, realize physical level isolation, block virus spread and protect the safety of system core modules.

[0004] However, the above-mentioned technology at least has the following technical problems:

[0005] When the software system is online upgraded, version iterated or patched, new module instruction streams, calling structures or permission control methods are often introduced, and these update behaviors have high similarity in behavior characteristics with malicious behaviors. The existing detection mechanism usually lacks the identification and perception ability of system update behaviors, and does not set a false positive suppression strategy for the update state, which leads to the fact that in the system software upgrading process, the legal update behavior is easily misjudged as a virus behavior, the hardware fuse response is triggered by mistake, and then the terminal is not available, the control link is interrupted and other serious consequences are caused. SUMMARY

[0006] In order to overcome the above-mentioned defects of the prior art, the present application provides a power software virus detection method embedded with a hardware fuse mechanism to solve the problems existing in the background art.

[0007] In order to achieve the above-mentioned purpose, the present application provides the following technical scheme:

[0008] The application discloses a power software virus detection method embedded with a hardware fuse mechanism, and the system comprises the following steps: 1, collecting running state data from power terminal software in real time when a software system is updated, and pre-processing the collected running state data to obtain pre-processed running state data; 2, extracting multi-dimensional feature indexes reflecting system behaviors from the pre-processed running state data, mapping the multi-dimensional feature indexes into behavior feature vectors respectively, forming a software system behavior feature set at a current moment, recording access paths, calling targets and operation objects in the generation process of each behavior feature vector, and constructing corresponding access track information; 3, obtaining a virus feature library deployed locally or remotely, calculating virus feature matching degrees between each behavior feature vector in the software system behavior feature set and a virus feature library vector through a similarity method, and determining whether a virus exists according to the virus feature matching degrees; 4, if it is determined that a virus exists, obtaining update related parameters of the software system, the update related parameters comprising system structure data, interface calling data and process behavior data, obtaining an update influence index according to the update related parameters, and determining whether misjudgment occurs at present according to the update influence index; 5, constructing a security baseline behavior model, if it is determined that misjudgment occurs at present, continuing to monitor behaviors of the software system, if it is determined that misjudgment does not occur at present, calculating a dynamic deviation index according to the security baseline behavior model for a suspected virus behavior vector, and determining whether a serious deviation from the security baseline behavior exists according to the dynamic deviation index; and 6, if it is determined that a serious deviation from the security baseline behavior exists, triggering the hardware fuse mechanism, and performing physical level protection measures on the software system.

[0009] Preferably, the step of determining whether a virus exists according to the virus feature matching degrees comprises the following steps: comparing the virus feature matching degrees with a feature matching threshold, if the virus feature matching degree of any behavior feature vector is greater than or equal to the feature matching threshold, it is determined that a virus exists, and the behavior feature vector with the virus feature matching degree greater than or equal to the feature matching threshold is marked as a suspected virus behavior vector; and if the virus feature matching degree of no behavior feature vector is greater than or equal to the feature matching threshold, it is determined that no virus exists.

[0010] Preferably, the obtaining step of the update influence index is: obtaining the original and updated system structure data of the software system, and evaluating the system structure disturbance influence coefficient according to the original and updated system structure data of the software system; obtaining the original and updated interface calling data of the software system, and evaluating the permission calling reconstruction influence coefficient according to the original and updated interface calling data of the software system; obtaining the original and updated process behavior data of the software system, and evaluating the process behavior deviation influence coefficient according to the original and updated process behavior data of the software system; performing normalization processing on the system structure disturbance influence coefficient, the permission calling reconstruction influence coefficient and the process behavior deviation influence coefficient, and evaluating the update influence index according to the normalized system structure disturbance influence coefficient, the normalized permission calling reconstruction influence coefficient and the normalized process behavior deviation influence coefficient, and the specific obtaining steps are: ; wherein, is the update influence index, is the normalized system structure disturbance influence coefficient, is the normalized permission calling reconstruction influence coefficient, is the normalized process behavior deviation influence coefficient, , , is the weight coefficient of the normalized system structure disturbance influence coefficient, the weight coefficient of the normalized permission calling reconstruction influence coefficient and the weight coefficient of the normalized process behavior deviation influence coefficient.

[0011] Preferably, the system structure disturbance influence coefficient obtaining step is: obtaining module structure data before software system update, and constructing an original module structure graph according to the module structure data, the original module structure graph including an original function module node set and an original inter-module call edge set; parsing a structure configuration file and a module dependency list in the update patch, extracting module structure change data after update, predicting new module structure data formed after update according to the module structure change data through static analysis means, and constructing an update module structure graph, the update module structure graph including an update function module node set and an update inter-module call edge set; according to the original function module node set and the update function module node set, counting the number of newly added and removed modules, denoted as the number of changed modules, obtaining the total number of original function modules in the original function module node set, and performing ratio calculation on the number of changed modules and the total number of original function modules to obtain a module set change rate; according to the original inter-module call edge set and the update inter-module call edge set, counting the number of newly added and deleted call paths, denoted as the number of changed paths, obtaining the total number of original call paths in the original inter-module call edge set, and performing ratio calculation on the number of changed paths and the total number of original call paths to obtain a call path change rate; from the original module structure graph and the update module structure graph, filtering the modules with a call frequency in the top 20%, as a core module set; for the core module set, filtering the number of modules with call path adjustment, denoted as the number of core adjustment modules, obtaining the total number of core modules in the core module set, and performing ratio calculation on the number of core adjustment modules and the total number of core modules to obtain a core module migration rate; concatenating the module set change rate, the call path change rate and the core module migration rate to form a disturbance feature vector, and obtaining the system structure disturbance influence coefficient by calculating the Euclidean norm of the disturbance feature vector.

[0012] Preferably, the permission call reconstruction influence coefficient obtaining step is: obtaining the interface call data before the power software system is updated as the original interface identifier set, constructing an original permission call table based on the original interface identifier set, each table entry of the permission call table including interface identifier, call module, permission level, call condition and actual call frequency; parsing the call list, permission declaration and sandbox test log contained in the update patch to extract interface call change data, obtaining an updated interface identifier set, and constructing an updated permission call table according to the updated interface identifier set; according to the original interface identifier set and the updated interface identifier set, counting the number of newly added and deleted interfaces, denoted as the number of changed interfaces, obtaining the total number of original interfaces in the original interface identifier set, and performing ratio calculation on the number of changed interfaces and the total number of original interfaces to obtain the permission interface change rate; comparing the permission level information of the same interface entries in the original permission call table and the updated permission call table, filtering out the interface entries whose access permission level has changed, denoted as the number of permission change interfaces, obtaining the total number of interface entries in the original permission call table, and performing ratio calculation on the number of permission change interfaces and the total number of interface entries to obtain the permission level drift rate; the permission interface change rate and the permission level drift rate are spliced to form a permission call reconstruction vector, and the Euclidean norm of the permission call reconstruction vector is calculated to obtain the permission call reconstruction influence coefficient.

[0013] Preferably, the process behavior offset influence coefficient obtaining step is: obtaining process behavior data before the power software system is updated, the process behavior data including a core process startup time sequence, parent-child process call relationship, a CPU utilization sequence, a memory occupation sequence, an I / O call number sequence, and thread switching frequency information, and constructing an original process behavior model according to the process behavior data; parsing process initialization configuration and simulation running logs contained in the update patch to obtain process expected behavior data after the power software system is updated, and constructing an updated process behavior model; extracting the startup time sequence of the same core process in the original process behavior model and the updated process behavior model, calculating the absolute startup time difference at each time point according to the time sequence, and performing mean value calculation on all the absolute startup time differences to obtain a process startup offset degree; obtaining the average CPU utilization, memory occupation rate, and I / O call number of the original process behavior model and the updated process behavior model according to the CPU utilization sequence, the memory occupation sequence, and the I / O call number sequence in the original process behavior model and the updated process behavior model; performing absolute deviation value calculation on the average CPU utilization, memory occupation rate, and I / O call number of the original process behavior model and the updated process behavior model to obtain a CPU offset degree, a memory offset degree, and an I / O offset degree; performing maximum value normalization processing on the CPU offset degree, the memory offset degree, and the I / O offset degree to obtain a normalized CPU offset degree, a normalized memory offset degree, and a normalized I / O offset degree, and performing mean value calculation on the normalized CPU offset degree, the normalized memory offset degree, and the normalized I / O offset degree to obtain a resource fluctuation offset degree; constructing a process communication topology graph for the original process behavior model and the updated process behavior model respectively, taking the core process as a node and an IPC communication path between processes as an edge to obtain an original process communication topology graph and an updated process communication topology graph, and according to the original process communication topology graph and the updated process communication topology graph, counting the number of communication structure changes, denoted as a change edge number; obtaining a total edge number in the original process communication topology graph, performing ratio calculation on the change edge number and the total edge number in the original process communication topology graph to obtain a communication topology offset rate; splicing the process startup offset degree, the resource fluctuation offset degree, and the communication topology offset rate to form a process behavior offset vector, calculating the Euclidean norm of the process behavior offset vector, and obtaining the process behavior offset influence coefficient.

[0014] Preferably, the step of determining whether a misjudgment occurs currently according to the update influence index is: comparing the update influence index with an influence threshold value, if the update influence index is greater than or equal to the influence threshold value, it is determined that a misjudgment occurs currently; and if the update influence index is less than the influence threshold value, it is determined that a misjudgment does not occur currently.

[0015] Preferably, the step of obtaining the dynamic deviation degree index comprises: obtaining a continuous behavior feature sequence in the log generated during the detection period for the suspected virus behavior vector, the behavior feature sequence comprising a system call sequence, a memory write rate sequence, and a CPU usage proportion sequence; extracting a standard reference feature sequence consistent with the suspected virus behavior feature sequence in dimension from the security baseline behavior model, the standard reference feature sequence comprising a system call reference sequence, a memory write rate reference sequence, and a CPU usage proportion reference sequence; calculating an absolute deviation value of each dimension feature in a time point pair form, and taking an average value to obtain a system call deviation index, a write rate deviation index, and a CPU usage deviation index; obtaining a historical fluctuation interval of the feature of the software system in a normal state, the fluctuation interval comprising an interval maximum value and an interval minimum value, and performing maximum and minimum value normalization processing on the system call deviation index, the write rate deviation index, and the CPU usage deviation index according to the historical fluctuation interval to obtain a standardized system call deviation coefficient, a standardized write rate deviation coefficient, and a standardized CPU usage deviation coefficient; splicing the standardized system call deviation coefficient, the standardized write rate deviation coefficient, and the standardized CPU usage deviation coefficient to form a dynamic deviation vector, calculating a Euclidean norm of the dynamic deviation vector, and obtaining the dynamic deviation degree index.

[0016] Preferably, the step of determining whether there is a serious deviation from the security baseline behavior according to the dynamic deviation degree index comprises: comparing the dynamic deviation degree index with a deviation threshold value, and if the dynamic deviation degree index is greater than or equal to the deviation threshold value, determining that there is a serious deviation from the security baseline behavior; and if the dynamic deviation degree index is less than the deviation threshold value, determining that there is no serious deviation from the security baseline behavior.

[0017] Preferably, the step of triggering the hardware fuse mechanism to perform a physical level protection measure on the software system comprises: delivering a fuse trigger instruction to a trusted root firmware of the power terminal for verification; after passing the verification of the trusted firmware, suspending a current instruction bus transmission related to the suspected virus behavior vector according to an execution level of the fuse trigger instruction; performing a locking operation on a high authority resource unit occupied by a process or thread currently executing the suspected virus behavior vector; identifying a file path or a device path interacting with the suspected virus behavior vector according to access track information corresponding to the suspected virus behavior feature vector, marking the path as a suspicious path, and performing a physical disconnection operation.

[0018] Technical effects and advantages of the present application:

[0019] When the software system is updated, running state data is collected, a software system behavior feature set is obtained, a virus feature matching degree of each behavior feature vector in the feature set is calculated, it is determined whether a virus exists, if it is determined that a virus exists, update related parameters of the software system are obtained, an update influence index is evaluated, it is determined whether a false positive occurs at present, a safety baseline behavior model is constructed, if it is determined that a false positive does not occur at present, a dynamic deviation degree index is calculated, if it is determined that there is a serious deviation from the safety baseline behavior according to the dynamic deviation degree index, a hardware fuse mechanism is triggered, and the accuracy of virus detection is effectively improved. BRIEF DESCRIPTION OF DRAWINGS

[0020] Figure 1 A power software virus detection method embedding a hardware fuse mechanism is provided. DETAILED DESCRIPTION

[0021] The technical solutions in the present application will be described clearly and completely in the present application with reference to the drawings, and additionally, the forms of each structure described in the following embodiments are only examples, and the power software virus detection method embedding a hardware fuse mechanism is not limited to each structure described in the following embodiments, and all other embodiments obtained by those skilled in the art without making creative efforts belong to the scope of protection of the present application.

[0022] The present application provides a power software virus detection method embedding a hardware fuse mechanism, as shown in the figure, comprising the following steps: Figure 1 The steps are as follows:

[0023] Step 1: When the software system is updated, running state data is collected from the power terminal software in real time, the running state data includes operating system logs, key business instruction flow, storage access behavior and process scheduling information, and provides basic data support for subsequent detection, and the collected running state data is preprocessed to obtain preprocessed running state data, the preprocessing includes field screening, format unification and time sequence alignment;

[0024] Step 2: Multi-dimensional feature indexes reflecting system behavior are extracted from the preprocessed running state data, the multi-dimensional feature indexes include process creation frequency, system call distribution and memory access mode, and the multi-dimensional feature indexes are respectively mapped into behavior feature vectors to form a software system behavior feature set at the present time, and the access path, call target and operation object in the generation process of each behavior feature vector are recorded to form corresponding access track information;

[0025] Step 3: Obtain the virus feature library deployed locally or remotely, calculate the virus feature matching degree between each behavior feature vector in the software system behavior feature set and the virus feature library vector by the similarity method, and determine whether a virus exists according to the virus feature matching degree;

[0026] In this embodiment, it needs to be specifically pointed out that the step of determining whether a virus exists according to the virus feature matching degree is:

[0027] The virus feature matching degree is compared with the feature matching threshold value. If the virus feature matching degree of any behavior feature vector is greater than or equal to the feature matching threshold value, it is determined that a virus exists, and the behavior feature vector with the virus feature matching degree greater than or equal to the feature matching threshold value is marked as a suspected virus behavior vector. If there is no behavior feature vector with a virus feature matching degree greater than or equal to the feature matching threshold value, it is determined that no virus exists.

[0028] The feature matching threshold value can be obtained by historical sample statistics, experience setting, model training or adaptive adjustment, and the specific method can be selected according to system requirements, or a combination of multiple methods can be used to determine the threshold value together to improve the adaptability and determination accuracy of the threshold value.

[0029] The similarity method refers to evaluating the similarity of two vectors in the feature space by mathematical calculation, which is a comparison method for judging whether the current behavior is similar to the known virus behavior feature. In this embodiment, the similarity method can use a non-weighted vector comparison method such as cosine similarity to compare the current software system behavior feature vector with the virus feature vector in the virus feature library, calculate the similarity value between them, and the higher the matching degree, the closer the behavior to the virus feature, which is used for subsequent judgment of whether to trigger a virus detection response.

[0030] It needs to be specifically pointed out that the virus feature matching degree calculated by the similarity method is a prior art, and this embodiment will not make a detailed description of the specific steps.

[0031] Step 4: If it is determined that a virus exists, obtain the update related parameters of the software system, the update related parameters including system structure data, interface call data and process behavior data, obtain an update influence index according to the update related parameters, and determine whether a false positive occurs according to the update influence index;

[0032] In this embodiment, it needs to be specifically pointed out that the step of obtaining the update influence index is:

[0033] Obtain the original and updated system structure data of the software system, and obtain a system structure disturbance influence coefficient according to the original and updated system structure data of the software system;

[0034] obtain the original and updated interface calling data of the software system, and evaluate the permission calling reconstruction influence coefficient according to the original and updated interface calling data of the software system;

[0035] obtain the original and updated process behavior data of the software system, and evaluate the process behavior deviation influence coefficient according to the original and updated process behavior data of the software system;

[0036] normalize the system structure disturbance influence coefficient, the permission calling reconstruction influence coefficient and the process behavior deviation influence coefficient, and evaluate the update influence index according to the normalized system structure disturbance influence coefficient, the normalized permission calling reconstruction influence coefficient and the normalized process behavior deviation influence coefficient, and the specific obtaining steps are as follows:

[0037]

[0038] In the formula, is the update influence index, is the normalized system structure disturbance influence coefficient. When the number of modules involved in the software system of the power terminal in the updating process is more, the functional structure adjustment is more complex, and the system dependency path change is more significant, the influence degree on the original virus detection model is also increased, thereby significantly increasing the risk of misjudgment. This coefficient is used to reflect the behavior characteristic deviation amplitude caused by the update at the system structure level. The larger the coefficient value is, the more the behavior change caused by the update exceeds the fault tolerance range of the virus detection model, and the higher the probability of misidentifying the legal update behavior as abnormal or malicious behavior is, is the normalized permission calling reconstruction influence coefficient. When a large number of high permission calling behaviors (such as kernel writing, system configuration modification, device control instruction, etc.) are added or changed in the software system in the updating process, these behaviors will cause stronger interference to the original virus detection model, so that the system is more likely to misjudge the normal permission application process as malicious overreach operation, thereby increasing the risk of misjudgment, is the normalized process behavior deviation influence coefficient. When the key process in the software system after the update has obvious deviation in running logic, resource calling mode or time sequence behavior compared with the normal state, the deviation will significantly increase the misjudgment risk of the virus detection system to the behavior. Since many virus detection methods depend on the modeling and comparison of the stable behavior characteristics of the core process, once the process behavior changes after the update exceed the baseline model, such as calling path reconstruction, execution frequency change or resource access mode anomaly, it may be misidentified as malicious process replacement or injection behavior, , , ​The weight coefficient is a normalized system structure disturbance influence coefficient, a normalized permission call reconstruction influence coefficient, and a normalized process behavior deviation influence coefficient. , 、 、 The weight coefficient is obtained by an analytic hierarchy process, 、 、 The weight coefficient can be 0.4, 0.3, and 0.3. The analytic hierarchy process is a weight determination method used in multi-factor decision-making. By constructing a pairwise comparison judgment matrix between factors, the relative importance of each factor in the overall goal is reflected, and the weight value of each factor is calculated through consistency check. In this embodiment, the system structure disturbance influence coefficient, the permission call reconstruction influence coefficient, and the process behavior deviation influence coefficient are compared with each other by using the analytic hierarchy process, a judgment matrix is constructed by combining the experience of field experts or historical sample data, and the weight proportion of the three types of influence factors in the evaluation of the influence degree of the detection result is calculated, so as to realize reasonable weighted calculation of the update influence index.

[0039] In this embodiment, it needs to be specifically explained that the system structure disturbance influence coefficient is obtained by:

[0040] The module structure data before the software system is updated is obtained, the module structure data includes module call relationship, library dependency relationship, and process startup path information, and an original module structure graph is constructed according to the module structure data , wherein, represents an original function module node set, represents an original module call edge set;

[0041] The structure configuration file and the module dependency list in the update patch are parsed, the module structure change data is extracted, the module structure change data includes new modules, modified modules, and dependency information, the new module call relationship, the library dependency path, and the process startup logic after the update are predicted according to the module structure change data by using a static analysis method, and an updated module structure graph is constructed , wherein represents an updated function module node set, represents an updated module call edge set;

[0042] According to the original module structure diagram and the updated module structure diagram, an original function module node set and an updated function module node set are obtained, the number of added and removed modules is counted according to the original function module node set and the updated function module node set, denoted as a changed module number, the total number of original modules in the original function module node set is obtained, and ratio calculation is performed on the changed module number and the total number of original modules to obtain a module set change rate, so as to reflect the disturbance degree introduced by the current update at the module structure level. If the module change rate is high, it usually means that the structure reconstruction range is large, and the probability of potentially interfering with the system behavior mode is also relatively high.

[0043] An original inter-module call edge set and an updated inter-module call edge set are obtained, the number of added and deleted call paths is counted according to the original inter-module call edge set and the updated inter-module call edge set, denoted as a changed path number, the total number of original call paths in the original inter-module call edge set is obtained, and ratio calculation is performed on the changed path number and the total number of original call paths to obtain a call path change rate, which is used to measure the change amplitude of the inter-module call relationship, that is, whether the internal dependency structure of the system has been substantially reorganized.

[0044] From the original module structure diagram and the updated module structure diagram, the top 20% of modules in terms of call frequency are selected as a core module set; for the core module set, the number of modules with call path adjustment is selected, denoted as a core adjustment module number, the total number of core modules in the core module set is obtained, and ratio calculation is performed on the core adjustment module number and the total number of core modules to obtain a core module migration rate, which is used to reflect whether the structural role of the key module is changed in the update process. The higher the value, the more concentrated the structural disturbance is in the core area of the system, and the more significant the potential behavior impact is.

[0045] The module set change rate, the call path change rate, and the core module migration rate are concatenated to form a disturbance feature vector, and a system structure disturbance influence coefficient is obtained by calculating the Euclidean norm of the disturbance feature vector. The norm form measures the comprehensive deviation degree of the three structural disturbance factors, which not only maintains the same degree of measurement scale for each index, but also highlights the strength of the overall structural disturbance, and is suitable for subsequent proportional relationship evaluation of the update influence index.

[0046] In this embodiment, it needs to be specifically explained that the steps for obtaining the permission call reconstruction influence coefficient are:

[0047] The interface call data before the update of the power software system is obtained as an original interface identifier set. The interface identifier refers to the function, instruction or service name that can be called by the system or module, and has a unique identification function. Based on the original interface identifier set, an original permission call table is constructed. Each table entry of the permission call table includes an interface identifier, a calling module, a permission level (such as user, system, administrator), a calling condition and an actual calling frequency, which is used for subsequent difference analysis.

[0048] Parse the call list, permission declaration and sandbox test log contained in the update patch, extract the interface call change data including modification, addition or removal, obtain the updated interface identifier set, and construct the updated permission call table according to the updated interface identifier set, the fields are consistent with the original permission call to ensure structural comparability;

[0049] According to the original interface identifier set and the updated interface identifier set, the number of added and deleted interfaces is counted, which is recorded as the number of changed interfaces, the total number of original interfaces in the original interface identifier set is obtained, and the ratio calculation is performed between the number of changed interfaces and the total number of original interfaces, so as to obtain the permission interface change rate, which reflects the overall change amplitude of the system call interface, and is the most basic permission structure disturbance index. If the change rate is too high, it may cause virus feature mismatch;

[0050] By comparing the permission level information of the same interface item in the original permission call table and the updated permission call table, the interface item whose access permission level has changed is filtered out, which is recorded as the number of permission change interfaces, the total number of interface items in the original permission call is obtained, and the ratio calculation is performed between the number of permission change interfaces and the total number of interface items, so as to obtain the permission level drift rate, which is used to measure whether the permission control boundary has been expanded or tightened, especially the case that the ordinary interface permission is promoted to the system or administrator level, which will significantly change the judgment basis of the behavior feature matching process and increase the false positive probability of virus detection;

[0051] The permission interface change rate and the permission level drift rate are spliced to form a permission call reconstruction vector, the Euclidean norm of the permission call reconstruction vector is calculated to obtain the permission call reconstruction influence coefficient, the reconstruction strength of the updated permission system is comprehensively measured by the norm of the two-dimensional disturbance index, avoiding subjective weighting allocation, and having objectivity and universality, which is suitable for being used as a key component factor of the update influence index.

[0052] In this embodiment, it needs to be specifically pointed out that the step of obtaining the process behavior deviation influence coefficient is:

[0053] Obtain the process behavior data before the update of the power software system, the process behavior data includes the startup time sequence of the core process, the parent-child process call relationship, the CPU utilization sequence, the memory occupation sequence, the I / O call number sequence and the thread switching frequency information, and an original process behavior model is constructed according to the process behavior data, the core process refers to a process set that undertakes key business tasks in the running of the power software;

[0054] Parse the process initialization configuration and simulation running log contained in the update patch, obtain the expected process behavior data after the update of the power software system, and construct an updated process behavior model;

[0055] Extract the start time sequence of the same core process in the original process behavior model and the updated process behavior model, calculate the absolute start time difference at each time point according to the time sequence, and perform mean calculation on all absolute start time differences to obtain the process start offset degree, which is used to evaluate whether the update disrupts the start timing of the key process. If the start offset increases significantly, it may be misrecognized by the behavior detection system as an abnormal start caused by virus implantation;

[0056] According to the CPU utilization sequence, the memory occupation sequence and the I / O call times sequence in the original process behavior model and the updated process behavior model, the average CPU utilization, the memory occupation rate and the I / O call times of the original process behavior model and the updated process behavior model are obtained.

[0057] The absolute deviation values of the average CPU utilization, the memory occupation rate and the I / O call times of the original process behavior model and the updated process behavior model are calculated to obtain the CPU offset degree, the memory offset degree and the I / O offset degree.

[0058] The maximum value normalization processing is performed on the CPU offset degree, the memory offset degree and the I / O offset degree to obtain the normalized CPU offset degree, the normalized memory offset degree and the normalized I / O offset degree. The normalized CPU offset degree, the normalized memory offset degree and the normalized I / O offset degree are subjected to mean calculation to obtain the resource fluctuation offset degree, which is used to measure whether the system update causes significant changes in the process resource usage behavior model. If the resource occupation difference is too large, it is often recognized as abnormal behavior.

[0059] The process communication topology graphs of the original process behavior model and the updated process behavior model are constructed respectively, taking the core process as the node and the IPC communication path between processes as the edge, to obtain the original process communication topology graph and the updated process communication topology graph. The number of edges of the communication structure change is calculated according to the original process communication topology graph and the updated process communication topology graph, which is denoted as the number of changed edges.

[0060] The total number of edges in the original process communication topology graph is obtained, and the ratio calculation is performed on the number of changed edges and the total number of edges in the original process communication topology graph to obtain the communication topology offset rate. Significant changes in the communication structure may cause the virus detection module to misinterpret the system behavior as "lateral penetration" or "instruction redirection";

[0061] The process start offset degree, the resource fluctuation offset degree and the communication topology offset rate are spliced to form the process behavior offset vector. The Euclidean norm of the process behavior offset vector is calculated to obtain the process behavior offset influence coefficient. This influence coefficient can comprehensively reflect the multi-dimensional behavior offset changes caused by the system update at the process level. The index calculation does not depend on the subjective weight setting, has high objectivity and engineering applicability, and can be used as a key basis for judging whether the virus misjudgment is caused by the update in the update influence index.

[0062] In this embodiment, it needs to be specifically pointed out that the step of determining whether the current misjudgment occurs according to the update influence index is:

[0063] The update influence index is compared with the influence threshold value. If the update influence index is greater than or equal to the influence threshold value, it is determined that the current misjudgment occurs. If the update influence index is less than the influence threshold value, it is determined that the current misjudgment does not occur. The influence threshold value is obtained by the adaptive threshold method, which is a method of dynamically adjusting the threshold value according to the historical data characteristics and the current detection environment, so as to improve the accuracy and stability of the judgment result. In this embodiment, the adaptive threshold method is used to determine the judgment threshold value of the update influence index. By analyzing the historical update influence index distribution of the system in the normal update process, the average value and fluctuation range are extracted, and the influence threshold value adaptive to the current running environment is automatically calculated combined with the abnormal tolerance of the current system state. This method can automatically adjust the threshold value according to the change trend of the actual update behavior of the software, avoid misjudgment or omission caused by improper fixed threshold setting, and improve the accuracy and robustness of the update false alarm identification.

[0064] Step 5: Constructing a safe baseline behavior model, if it is determined that the current misjudgment occurs, continue to monitor the behavior of the software system, if it is determined that the current misjudgment does not occur, calculate the dynamic deviation degree index according to the safe baseline behavior model for the suspected virus behavior vector, and determine whether there is a serious deviation from the safe baseline behavior according to the dynamic deviation degree index;

[0065] In this embodiment, it needs to be specifically pointed out that the construction steps of the safe baseline behavior model are:

[0066] In the normal running state of the software system, the system running log data generated in the running process is collected, including but not limited to system call sequence, memory write rate, CPU usage ratio and file operation behavior, etc., to ensure that the log data covers all key activities in the typical business period;

[0067] The system running log data is preprocessed, and multi-dimensional feature indexes representing the software running state are extracted, including system call sequence, memory write rate and CPU usage ratio, to ensure that the key dimensions such as instruction behavior, resource occupation and processing load are covered;

[0068] Each type of feature index is arranged in time sequence to form a continuous reference behavior sequence, and its change trend and distribution characteristics are recorded as a basic template for subsequent comparison. The reference sequence should be extracted in multiple normal running periods to ensure that the stable behavior mode is reflected rather than accidental fluctuation;

[0069] For each feature reference sequence, the maximum and minimum values in the normal state are counted to obtain the historical fluctuation interval of each feature dimension. The fluctuation interval is used for subsequent normalization processing of the dynamic deviation index to ensure that the deviation values in each dimension are comparable on a unified scale;

[0070] The extracted reference sequence and the fluctuation interval are organized into a structured model file, and the software module, running stage and feature category to which it belongs are labeled to form a security baseline behavior model.

[0071] In this embodiment, it needs to be specifically pointed out that the acquisition step of the dynamic deviation degree index is:

[0072] For the suspected virus behavior vector, the continuous behavior feature sequence in the log during the generation in the detection period is obtained, including the system call sequence, the memory write rate sequence and the CPU usage ratio sequence. It needs to be specifically pointed out that the detection period can be adjusted according to the actual situation, for example, the detection period can be 1 hour or half an hour;

[0073] From the security baseline behavior model, select the reference template matching the business type, system module or running stage to which the suspected virus behavior vector belongs, and extract the standard reference feature sequence consistent with the dimension of the suspected virus behavior feature sequence, including the system call reference sequence, the memory write rate reference sequence and the CPU usage ratio reference sequence;

[0074] The absolute deviation value of each dimension feature is calculated in the form of time point pair, and the average value is taken to obtain the system call deviation index, the write rate deviation index and the CPU usage deviation index;

[0075] The historical fluctuation interval of the feature in the normal state of the software system is obtained, and the fluctuation interval includes the interval maximum and the interval minimum. The system call deviation index, the write rate deviation index and the CPU usage deviation index are subjected to maximum and minimum value normalization processing according to the historical fluctuation interval to obtain the standardized system call deviation coefficient, the standardized write rate deviation coefficient and the standardized CPU usage deviation coefficient, so as to ensure that the deviation values in each dimension have a unified dimensional scale and avoid the incomparability caused by different units.

[0076] The maximum and minimum value normalization processing refers to linearly transforming a certain feature index value according to the historical maximum and minimum values of the feature in the normal state, so as to map it to the standardized interval between 0 and 1, thereby eliminating the differences in dimension and numerical range of different features and improving the comparability between indexes.

[0077] The standardization system call deviation coefficient, the standardization write rate deviation coefficient and the standardization CPU usage deviation coefficient are spliced to form a dynamic deviation vector, the Euclidean norm of the dynamic deviation vector is calculated, and a dynamic deviation degree index is obtained.

[0078] The Euclidean norm refers to regarding multiple standardized values as different components of a space vector, measuring the overall deviation degree by calculating the geometric distance between the vector and the origin. In the embodiment, the system call deviation coefficient, the memory write rate deviation coefficient and the CPU usage deviation coefficient are spliced into a three-dimensional vector, and the Euclidean norm is used to measure the vector as a whole, so that a single value is obtained to represent the comprehensive difference between the current behavior and the normal behavior. The larger the value is, the more the current behavior deviates from the normal state in multiple dimensions, and the higher the abnormality degree is, which is convenient for comprehensive judgment of whether there is a potential virus risk.

[0079] In the embodiment, it needs to be specifically explained that the step of determining whether there is a serious deviation from the security baseline behavior according to the dynamic deviation degree index is:

[0080] The dynamic deviation degree index is compared with the deviation threshold value. If the dynamic deviation degree index is greater than or equal to the deviation threshold value, it is determined that there is a serious deviation from the security baseline behavior. If the dynamic deviation degree index is less than the deviation threshold value, it is determined that there is no serious deviation from the security baseline behavior, the hardware fuse mechanism is not triggered, the risk warning is performed, the relevant personnel is reminded to pay more attention, and the deviation threshold value is obtained by the adaptive threshold method.

[0081] Step 6: If it is determined that there is a serious deviation from the security baseline behavior, the hardware fuse mechanism is triggered, and physical level protection measures are performed on the software system. The fuse mechanism includes suspending the instruction bus, locking the high-privilege execution unit and disconnecting the suspicious storage path, so as to ensure that the virus propagation is immediately blocked at the hardware level.

[0082] When it is detected that the software system has a serious abnormality or a suspected virus behavior, the hardware fuse mechanism is added to the power system, which can bypass the traditional software response process, directly interrupt the key instruction path from the physical layer, block the high-privilege operation or isolate the suspicious module, so as to realize the immediate blocking and tamper-proof forced protection of malicious behavior. Compared with the detection and response mechanism of the pure software layer, the hardware fuse has the advantages of fast response speed, strong anti-tampering ability and being unable to be evaded or closed by viruses, and is especially suitable for power terminal devices with extremely high security requirements, effectively preventing viruses from further spreading or damaging critical control logic, and improving the overall security protection level and operation stability of the system.

[0083] In the embodiment, it needs to be specifically explained that the step of triggering the hardware fuse mechanism and performing physical level protection measures on the software system is:

[0084] The fuse triggering instruction is transmitted to the trusted root firmware of the power terminal for verification, and the trusted root firmware is used to verify whether the instruction source is legal, whether the integrity is damaged, whether the signature is authenticated, and ensure that the instruction is not tampered or forged by malicious code;

[0085] After authentication by the trusted firmware, according to the execution level of the fuse triggering instruction, the current instruction bus transmission related to the suspected virus behavior vector is suspended, the instruction bus includes an access system call path, a dynamic loading module path and a cache refresh channel;

[0086] Locking operation is performed on the high-privilege resource unit occupied by the process or thread currently executing the suspected virus behavior vector, the high-privilege execution unit includes a kernel-level write permission controller, a scheduling priority register and a dynamic loading entry area, to ensure that it no longer accepts new instruction input;

[0087] According to the access track information corresponding to the behavior feature vector, the file path or device path frequently interacted with the behavior feature vector is identified, the path is marked as a suspicious path, and a physical disconnection operation is performed, the path includes an external storage port (such as a USB, serial device), a local cache file area and a configuration writing area;

[0088] After the above fuse action is completed, a fuse response log is generated, recording the triggering time, the execution action, the associated behavior vector, the verification signature and the operation result state, etc., as subsequent system audit and security model iterative training data, and uploaded to the power information security management platform.

[0089] Finally: the above only describes the preferred embodiments of the present application and is not used to limit the present application, any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

[0090] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, any skilled person in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for detecting a power software virus embedded with a hardware fusing mechanism, characterized in that, Comprising the following steps: Step 1: Collecting running state data in real time from the power terminal software when the software system is updated, preprocessing the collected running state data to obtain preprocessed running state data; Step 2: Extracting multi-dimensional feature indicators reflecting system behavior from the preprocessed running state data, and mapping the multi-dimensional feature indicators into behavior feature vectors respectively to form a software system behavior feature set at the current time, recording the access path, calling target and operation object in the generation process of each behavior feature vector, and forming corresponding access track information; Step 3: Obtaining a virus feature library, calculating the virus feature matching degree between each behavior feature vector in the software system behavior feature set and the virus feature library vector by similarity method, and determining whether a virus exists according to the virus feature matching degree; Step 4: If it is determined that a virus exists, obtaining the update related parameters of the software system, the update related parameters including system structure data, interface calling data and process behavior data, obtaining an update influence index according to the update related parameters, and determining whether a false positive occurs at present according to the update influence index; Step 5: Building a security baseline behavior model, if it is determined that a false positive occurs at present, continuing to monitor the behavior of the software system, if it is determined that a false positive does not occur at present, calculating a dynamic deviation degree index according to the security baseline behavior model for the suspected virus behavior vector, and determining whether there is a serious deviation from the security baseline behavior according to the dynamic deviation degree index; Step 6: If it is determined that there is a serious deviation from the security baseline behavior, triggering a hardware fuse mechanism to take physical level protection measures for the software system; The step of determining whether a false positive occurs at present according to the update influence index is: Comparing the update influence index with an influence threshold, if the update influence index is greater than or equal to the influence threshold, it is determined that a false positive occurs at present; if the update influence index is less than the influence threshold, it is determined that a false positive does not occur at present.

2. The method of claim 1, wherein the method comprises: The step of determining whether a virus exists according to the virus feature matching degree is: Comparing the virus feature matching degree with a feature matching threshold, if the virus feature matching degree of any behavior feature vector is greater than or equal to the feature matching threshold, it is determined that a virus exists, and the behavior feature vector whose virus feature matching degree is greater than or equal to the feature matching threshold is marked as a suspected virus behavior vector; if there is no behavior feature vector whose virus feature matching degree is greater than or equal to the feature matching threshold, it is determined that no virus exists.

3. The method of claim 1, wherein the hardware-embedded fuse mechanism is a fuse circuit. The step of obtaining the update influence index is: Obtaining the original and updated system structure data of the software system, and obtaining a system structure disturbance influence coefficient according to the original and updated system structure data of the software system; Obtaining the original and updated interface calling data of the software system, and obtaining a permission calling reconstruction influence coefficient according to the original and updated interface calling data of the software system; Obtaining the original and updated process behavior data of the software system, and obtaining a process behavior deviation influence coefficient according to the original and updated process behavior data of the software system; The system structure disturbance influence coefficient, the permission call reconstruction influence coefficient and the process behavior deviation influence coefficient are normalized, and an update influence index is evaluated according to the normalized system structure disturbance influence coefficient, the permission call reconstruction influence coefficient and the process behavior deviation influence coefficient, and the specific acquisition steps are as follows: ； In the formula, is expressed as an update influence index, is expressed as a normalized system structure disturbance influence coefficient, is expressed as a normalized permission call reconstruction influence coefficient, is expressed as a normalized process behavior deviation influence coefficient, , , is expressed as a weight coefficient of the normalized system structure disturbance influence coefficient, a weight coefficient of the normalized permission call reconstruction influence coefficient, and a weight coefficient of the normalized process behavior deviation influence coefficient.

4. The method of claim 3, wherein the hardware-embedded fuse mechanism is a fuse circuit. The system structure disturbance influence coefficient is obtained by the following steps: Obtain the module structure data before the software system is updated, and construct an original module structure graph according to the module structure data, wherein the original module structure graph includes an original function module node set and an original inter-module call edge set; Parse the structure configuration file and the module dependency list in the update patch, extract the module structure change data after the update, predict the new module structure data formed after the update according to the module structure change data by static analysis, and construct an update module structure graph, wherein the update module structure graph includes an update function module node set and an update inter-module call edge set; According to the original function module node set and the update function module node set, the number of added and removed modules is counted, denoted as the changed module number, the total number of original modules in the original function module node set is obtained, and the changed module number and the total number of original modules are calculated by ratio, to obtain the module set change rate; According to the original inter-module call edge set and the update inter-module call edge set, the number of added and deleted call paths is counted, denoted as the changed path number, the total number of original call paths in the original inter-module call edge set is obtained, and the changed path number and the total number of original call paths are calculated by ratio, to obtain the call path change rate; From the original module structure graph and the update module structure graph, the modules with the top 20% call frequency are selected as the core module set; for the core module set, the number of modules with call path adjustment is selected, denoted as the core adjustment module number, the total number of core modules in the core module set is obtained, and the core adjustment module number and the total number of core modules are calculated by ratio, to obtain the core module migration rate; The module set change rate, the call path change rate and the core module migration rate are concatenated to form a disturbance feature vector, and the system structure disturbance influence coefficient is obtained by calculating the Euclidean norm of the disturbance feature vector.

5. The method of claim 3, wherein the method further comprises: if the power software virus is detected, transmitting a signal to the hardware fuse to be inserted into the power supply circuit of the electronic device. The permission call reconstruction influence coefficient is obtained by the following steps: Obtain the interface call data before the power software system is updated as an original interface identifier set, and construct an original permission call table based on the original interface identifier set, wherein each table entry of the permission call table includes an interface identifier, a calling module, a permission level, a calling condition and an actual calling frequency; Parse the call list, permission declaration and sandbox test log contained in the update patch, extract the interface call change data, and obtain an update interface identifier set, and construct an update permission call table according to the update interface identifier set; According to the original interface identifier set and the update interface identifier set, the number of added and deleted interfaces is counted, denoted as the changed interface number, the total number of original interfaces in the original interface identifier set is obtained, and the changed interface number and the total number of original interfaces are calculated by ratio, to obtain the permission interface change rate; The permission level information of the same interface item in the original permission call table and the updated permission call table is compared, the interface items whose access permission levels change are screened out, recorded as the number of permission change interfaces, the total number of interface items in the original permission call table is obtained, the number of permission change interfaces and the total number of interface items are ratio calculated, and the permission level drift rate is obtained; The permission interface change rate and the permission level drift rate are spliced to form a permission call reconstruction vector, and a permission call reconstruction influence coefficient is obtained by calculating the Euclidean norm of the permission call reconstruction vector.

6. The method of claim 3, wherein the method further comprises: if the power software virus is detected, transmitting a signal to the hardware fuse to be inserted into the power supply circuit of the electronic device. The process behavior offset influence coefficient obtaining step is: Process behavior data before the power software system is updated is obtained, the process behavior data including a core process startup time sequence, a parent-child process call relationship, a CPU utilization sequence, a memory occupation sequence, an I / O call number sequence and thread switching frequency information, and an original process behavior model is constructed according to the process behavior data; Process initialization configuration and simulation running logs contained in the update patch are parsed, process expected behavior data after the power software system is updated is obtained, and an updated process behavior model is constructed; The startup time sequence of the same core process in the original process behavior model and the updated process behavior model is extracted, the absolute startup time difference at each time point is calculated according to the time sequence, and the absolute startup time difference is mean calculated to obtain a process startup offset degree; The average CPU utilization, memory occupation rate and I / O call number of the original process behavior model and the updated process behavior model are obtained according to the CPU utilization sequence, the memory occupation sequence and the I / O call number sequence in the original process behavior model and the updated process behavior model; The absolute deviation value of the average CPU utilization, memory occupation rate and I / O call number of the original process behavior model and the updated process behavior model is calculated to obtain a CPU offset degree, a memory offset degree and an I / O offset degree; The CPU offset degree, the memory offset degree and the I / O offset degree are normalized by the maximum value to obtain a normalized CPU offset degree, a normalized memory offset degree and a normalized I / O offset degree, and the normalized CPU offset degree, the normalized memory offset degree and the normalized I / O offset degree are mean calculated to obtain a resource fluctuation offset degree; The process communication topology graphs of the original process behavior model and the updated process behavior model are constructed respectively, the core process is taken as a node, and the IPC communication path between processes is taken as an edge, the original process communication topology graph and the updated process communication topology graph are obtained, and the number of edges of the communication structure change is counted according to the original process communication topology graph and the updated process communication topology graph, recorded as the number of changed edges; The total number of edges in the original process communication topology graph is obtained, the number of changed edges and the total number of edges in the original process communication topology graph are ratio calculated, and a communication topology offset rate is obtained; The process startup offset degree, the resource fluctuation offset degree and the communication topology offset rate are spliced to form a process behavior offset vector, the Euclidean norm of the process behavior offset vector is calculated, and a process behavior offset influence coefficient is obtained.

7. The method of claim 1, wherein the method further comprises: determining whether the power software virus is a virus that is capable of damaging the hardware; and if the power software virus is a virus that is capable of damaging the hardware, then activating the hardware fusing mechanism. The dynamic deviation index obtaining step is: For the suspected virus behavior vector, a continuous behavior feature sequence in the log generated during the detection period is obtained, and the behavior feature sequence includes a system call sequence, a memory write rate sequence, and a CPU usage ratio sequence; From the security baseline behavior model, a standard reference feature sequence consistent with the dimensions of the suspected virus behavior feature sequence is extracted, and the standard reference feature sequence includes a system call reference sequence, a memory write rate reference sequence, and a CPU usage ratio reference sequence; The absolute deviation value of each dimension feature is calculated in the form of a time point pair, and the average value is taken to obtain a system call deviation index, a write rate deviation index, and a CPU usage deviation index; The historical fluctuation interval of the feature of the software system in the normal state is obtained, and the fluctuation interval includes an interval maximum value and an interval minimum value. The system call deviation index, the write rate deviation index, and the CPU usage deviation index are subjected to maximum and minimum value normalization processing according to the historical fluctuation interval to obtain a standardized system call deviation coefficient, a standardized write rate deviation coefficient, and a standardized CPU usage deviation coefficient; The standardized system call deviation coefficient, the standardized write rate deviation coefficient, and the standardized CPU usage deviation coefficient are spliced to form a dynamic deviation vector, and the Euclidean norm of the dynamic deviation vector is calculated to obtain a dynamic deviation degree index.

8. The method of claim 1, wherein the method further comprises: determining whether the power software virus is a virus that is capable of damaging the hardware; and if the power software virus is a virus that is capable of damaging the hardware, then activating the hardware fusing mechanism. The step of determining whether there is a serious deviation from the security baseline behavior according to the dynamic deviation degree index is: The dynamic deviation degree index is compared with a deviation threshold value. If the dynamic deviation degree index is greater than or equal to the deviation threshold value, it is determined that there is a serious deviation from the security baseline behavior; If the dynamic deviation degree index is less than the deviation threshold value, it is determined that there is no serious deviation from the security baseline behavior.

9. The method of claim 1, wherein the method further comprises: The step of triggering a hardware fuse mechanism to perform a physical-level protection measure on the software system is: ​ The fuse trigger instruction is delivered to the trusted root firmware of the power terminal for verification; After verification by the trusted firmware, the instruction bus transmission related to the suspected virus behavior vector is suspended according to the execution level of the fuse trigger instruction; The high-privilege resource unit occupied by the process or thread currently executing the suspected virus behavior vector is locked; According to the access track information corresponding to the suspected virus behavior feature vector, the file path or device path interacting with it is identified, the path is marked as a suspicious path, and a physical disconnection operation is performed.

Images