A quadruple multi-mode trusted dynamic measurement method for high-reliability fast-response devices

Abstract

A four-tuple multi-mode trusted dynamic measurement method for high-reliability fast-response devices, the method establishes a four-tuple measurement model for high-reliability fast-response devices, including subject-object-operation-execution environment, based on the four-tuple measurement model, a hierarchical dynamic measurement architecture is built, the bottom layer is a data support layer, the middle layer is a core measurement layer, and the top layer is a strategy scheduling layer, and the dynamic measurement is initialized after the initialization. The application constructs a classification measurement mechanism from three dimensions of running environment, system behavior and business behavior rules, designs a multi-mode strategy of "trigger event + periodic measurement" by combining business trajectory and system behavior, improves the accuracy and real-time performance of dynamic measurement under the premise of meeting the lightweight demand of embedded devices, ensures the reliable operation of high-reliability fast-response devices, and avoids the security risks of power grid caused by measurement technology defects.

Description

Technical Field

[0001] This invention belongs to the field of high reliability and fast response technology, and more specifically, relates to a quadruple multi-mode reliable dynamic measurement method for high reliability and fast response devices. Background Technology

[0002] Embedded high-reliability fast-response devices are core equipment for the safe and stable operation of power systems, undertaking critical tasks such as fault detection, fault isolation, and system recovery. The reliability of their operational status directly determines whether a large-scale power outage will occur due to equipment malfunction or failure to operate. Dynamic measurement technology in trusted computing is a core means to ensure the reliable operation of embedded high-reliability fast-response devices. By monitoring the code integrity and legality of behavior during device operation in real time, it identifies threats such as malicious tampering and abnormal intrusion, preventing device hijacking or malfunction. Existing dynamic measurement technologies include: 1. Fixed-period dynamic measurement technology An existing technology provides a dynamic measurement method for embedded devices. This method performs integrity measurements on the kernel program code and system configuration files of the embedded device at fixed time intervals (e.g., 1 second / time). The implementation process involves pre-storing a baseline hash value for the kernel code, extracting runtime code segments at fixed intervals and calculating their hash values, comparing them with the baseline value, and identifying any discrepancies to trigger an alarm. This technology is widely used in general-purpose embedded devices, but when applied to high-reliability, fast-response devices, it needs to be adapted to the high real-time requirements of power scenarios.

[0003] 2. Single-trigger dynamic measurement technology Existing technologies also include a trusted measurement method for embedded devices. This method designs trigger conditions based on a single characteristic of system behavior, initiating the measurement process only when preset events such as abnormal kernel / user mode switching or illegal system calls are detected. Its implementation involves building a system behavior trigger rule base, monitoring system call sequences in real time, and performing integrity checks on relevant code and data when a trigger rule is met. This technology aims to reduce resource consumption in non-critical scenarios but does not consider the business characteristics associated with high-reliability, fast-response devices.

[0004] When the two existing technologies are applied in embedded high-reliability fast-response devices, they both need to be adapted to the device's "embedded hardware constraints" and "the strong real-time requirements and special business rules of high-reliability fast-response services." However, the existing solutions are not specifically designed, resulting in obvious shortcomings in practical applications.

[0005] 1. Resource consumption Embedded high-reliability, fast-response devices have limited hardware resources. Fixed-period measurement technology does not differentiate between business scenarios (idle / critical business / fault handling). During critical business processes such as fault clearing and setting modification, it still measures according to a fixed period, consuming core computing resources and causing business response delays (e.g., fault clearing time is extended from 15ms to 30ms, exceeding the standard threshold of 20ms in the power industry). If the period is extended to ensure real-time performance, it will lead to a delay in anomaly detection and failure to detect code tampering in a timely manner.

[0006] 2. Lack of measurement dimensions and insufficient accuracy. Existing technologies only focus on system-level behavior (code integrity, system calls) and do not integrate the business behavior rules of high-reliability fast response devices (such as the legal range of protection settings, tripping logic timing requirements, data acquisition accuracy thresholds, etc.). When a malicious program only tampers with protection settings (such as changing the overcurrent setting from 5A to 10A) but does not trigger abnormal system behavior, existing technologies cannot detect it. At the same time, high-reliability fast response services have clear process correlations (such as "data acquisition → setting comparison → fault judgment → tripping execution"), and existing technologies do not establish a correlation verification between business trajectories and system behavior, resulting in a detection rate of less than 65% for business logic violation anomalies.

[0007] 3. Not adapted to the requirements of lightweight embedded systems. The trigger rule base design of the single trigger-based measurement technology is complex, requiring ≥128KB of storage resources, and the trigger judgment logic involves multiple layers of traversal, taking ≥500ms to execute on low-frequency embedded chips; some measurement algorithms do not use hardware acceleration optimization, and the full code hash verification takes ≥800ms, which conflicts with the "millisecond-level business response" requirement of high-reliability fast response devices and cannot be directly deployed.

[0008] 4. High misjudgment rate and poor adaptability Existing technologies employ fixed measurement strategies that are not dynamically adjusted based on business processes. For example, the normal range of system calls differs between steady-state operation and setting modification operations. However, existing technologies use a uniform threshold for judgment, resulting in a false positive rate as high as 10% during setting modification, which may trigger unnecessary alarms or business interruptions. Summary of the Invention

[0009] To address the shortcomings of existing technologies, particularly those in embedded high-reliability, fast-response devices, such as resource consumption conflicts with real-time performance, missing measurement dimensions, insufficient lightweight adaptation, and high false positive rates, this invention provides a multi-mode dynamic measurement method based on a four-tuple model. By constructing a classification measurement mechanism from three dimensions—operating environment, system behavior, and business behavior rules—and integrating business trajectories and system behavior to design a multi-mode strategy of "triggering events + periodic measurement," this method improves the accuracy and real-time performance of dynamic measurement while meeting the lightweight requirements of embedded devices. This ensures the reliable operation of high-reliability, fast-response devices and avoids power grid safety risks caused by measurement technology deficiencies.

[0010] The present invention adopts the following technical solution.

[0011] This invention provides a quadruple multi-mode reliability dynamic measurement method for high-reliability fast-response devices, comprising the following steps: For high-reliability, fast-response devices, a four-tuple measurement model is established, including: subject-object-operation-execution environment; wherein, the subject is the functional module of the high-reliability, fast-response device, the object is the object being measured, the operation is the behavior of the subject on the object, and the execution environment includes: embedded hardware state, operating system state, and business scenario; Based on the quadruple metric model, a hierarchical dynamic metric architecture is built, with the bottom layer being the data support layer, the middle layer being the core metric layer, and the top layer being the strategy scheduling layer. The core metric layer includes: a runtime environment metric mechanism, a system behavior metric mechanism, and a business behavior metric mechanism. The strategy scheduling layer integrates business trajectories and system behaviors to implement multi-mode metric strategy switching. Based on the layered architecture, dynamic metrics are executed after initialization, including: based on dynamic data from the data support layer, the strategy scheduling layer executes mode switching logic; the core metrics layer implements a classification and measurement process based on the dynamic switching results of the strategy scheduling layer, and performs anomaly classification response.

[0012] Preferably, the main body includes: a data acquisition module, a setting management module, a trip execution module, and a communication module; The objects include: kernel code, business programs, protection settings, sampling data, and system configuration parameters; The operations include: code execution, fixed value reading / modification, data acquisition / storage, and system calls; The execution environment includes: embedded hardware status, operating system status, and business scenario.

[0013] Preferably, the data support layer includes: a business behavior rule base, a system behavior benchmark base, a business trajectory base, a measurement control area, and a step loss detection area; The business behavior rule base is used to store legal rules for core businesses that require high reliability and rapid response; The system behavior benchmark library is used to pre-store the SHA-256 hash benchmark values ​​of kernel code and business programs, normal sequence templates for system calls, and hardware resource usage thresholds. The business trajectory database is used to record historical business execution data; The metric control area stores policy parameters and operating status; The out-of-step detection area is used to record measurement deviation information.

[0014] Preferably, the business trajectory database uses a hybrid storage of "array + linked list" to support fast indexing by timestamp.

[0015] Preferably, the metric control area stores policy parameters and operating status, and the fields include: current metric mode; The current measurement modes include: periodic mode, trigger mode, and hybrid mode; wherein, the periodic mode includes: sequentially executing runtime environment → system behavior → business behavior measurement, and comparing the results with the behavior rule base and the system behavior benchmark base; the trigger mode includes: after detecting a trigger event, prioritizing the execution of the deep measurement of the corresponding dimension of the four-tuple measurement model, and for business triggers, focusing on verifying the set value and timing; the hybrid mode includes: executing regular measurements in short cycles, while monitoring trigger events, and overlaying deep measurements after triggering.

[0016] Preferably, the measurement object of the runtime environment measurement mechanism is the execution environment of the quadruple measurement model; The system behavior measurement mechanism adopts a layered measurement strategy, including: the kernel layer only verifies the hash value, the business layer extracts the function call sequence features during program execution, and compares them with the templates in the system behavior benchmark library; The business behavior measurement mechanism includes: fixed value verification, time sequence verification, and data consistency verification.

[0017] Preferably, the strategy scheduling layer includes: idle mode, critical business mode and anomaly warning mode, and the three measurement modes are dynamically switched through the measurement control area; The idle mode is a switch to periodic measurement when the business trajectory library shows no critical business within a set time period. The key business mode is to switch to hybrid measurement when a key business is detected, perform regular measurement with a shorter cycle than the periodic measurement, and monitor the triggering event, and overlay deep measurement after the triggering. The anomaly warning mode expands the coverage of triggering events while maintaining periodic measurement when an anomaly is detected.

[0018] Preferably, the triggering events include: system behavior triggering conditions and business behavior triggering conditions; The system behavior triggering conditions include: code hash value is inconsistent with the baseline value, system call sequence deviates from the template, and hardware resource usage exceeds the threshold for multiple consecutive cycles. The triggering conditions for the business behavior include: protection setting exceeding the limit, business timing timeout, sampling data deviation exceeding the threshold, and operation permission verification failure.

[0019] Preferably, the step of performing dynamic metrics after initialization based on the layered architecture includes: System initialization, loading the data support layer, including: loading the business behavior rule library, system behavior benchmark library, initializing the measurement control area, business trajectory library, and step loss detection area; Real-time collection of current business type and execution environment status, updated to the measurement and control area of ​​the data support layer; The strategy scheduling layer dynamically adjusts the measurement mode and parameters of the measurement control area according to the current state. The core metric layer performs classification metrics according to the current mode; Result judgment: If normal, record to the business trajectory database; if abnormal, write to the out-of-step detection area and initiate a tiered response. Anomaly Handling: Minor anomalies increase measurement frequency; severe anomalies trigger hardware alarms and disable critical operations. Repeat the above steps repeatedly to continuously measure dynamically.

[0020] Compared with the prior art, the beneficial effects of the present invention include at least the following: 1. Resource consumption significantly reduced Idle state: Measurement cycle extended to 5 seconds, CPU utilization reduced from 15% to 3% of the current technology, and memory usage reduced by 30%; Critical business status: In hybrid mode, CPU utilization is ≤3%, which is far lower than the existing technology's 15%, and fault clearing response time is still ≤15ms, meeting the power industry's real-time standards.

[0021] 2. Measurement accuracy has been greatly improved. Anomaly detection accuracy: Improvements in existing technologies, particularly in the detection rate of business-layer anomalies (fixed value tampering, timing violations); False positive rate: The false positive rate is reduced and the scope affected by the false positive rate is reduced, avoiding equipment downtime due to false positives.

[0022] 3. Enhanced Embedded Adaptability The total storage usage of the measurement module is adapted to embedded devices. No additional hardware is required, and there is no need to upgrade the hardware of the high-reliability, fast-response device, thus reducing deployment costs.

[0023] 4. Guaranteed real-time response capability Triggered metric response time ≤100ms, deep metric time ≤300ms, both within the business tolerance threshold; The alarm delay for serious anomalies is ≤500ms, providing maintenance personnel with sufficient time to handle the situation and prevent the fault from escalating. Attached Figure Description

[0024] Figure 1 is a structural diagram of a multi-mode dynamic measurement framework provided according to an embodiment of the present invention; Figure 2 is a flowchart of the measurement execution process according to an embodiment of the present invention; Figure 3 is a schematic diagram of the measurement behavior structure provided according to an embodiment of the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this invention. The described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the spirit of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of this invention.

[0026] Embodiment 1 of the present invention provides a multi-modal dynamic measurement method based on a quadruplet measurement model. The core of this method is to construct a dynamic measurement framework consisting of a "quadruplet measurement model + classification measurement mechanism + multi-modal measurement strategy," adapting to the hardware constraints and business characteristics of embedded high-reliability, fast-response devices. Figure 1 As shown, the diagram illustrates the relationships between the quadruple metric model, classification metric mechanism, multi-modal strategy, and supporting data structures, as well as the interaction paths between the subject, object, operation, and execution environment. The detailed implementation process is as follows: Step 1: For high-reliability, fast-response devices, establish a four-tuple metric model, including: subject-object-operation-execution environment.

[0027] The subject refers to the functional modules of a high-reliability, fast-response device, preferably but not limited to, a data acquisition module, a setpoint management module, a trip execution module, and a communication module; the object refers to the measured object, preferably but not limited to, kernel code, business programs, protection setpoints, sampled data, and system configuration parameters; the operation refers to the subject's behavior on the object, preferably but not limited to, code execution, setpoint reading / modification, data acquisition / storage, and system calls; the execution environment includes: embedded hardware status, operating system status, and business scenarios; specifically, the embedded hardware status preferably but not limited to, CPU load, memory usage, and Flash usage; the operating system status preferably but not limited to, task scheduling and interrupt status; and the business scenarios preferably but not limited to, idle, steady-state operation, setpoint modification, and fault handling.

[0028] Step 2: Based on the quadruple metric model, build a hierarchical dynamic metric architecture, with the bottom layer being the data support layer, the middle layer being the core metric layer, and the top layer being the strategy scheduling layer.

[0029] Specifically, the data support layer includes: a business behavior rule base, a system behavior benchmark base, a business trajectory base, a measurement control area, and a step loss detection area.

[0030] The business behavior rule base is used to store legal rules for high-reliability, fast-response core businesses, including: legal range of protection settings, business process timing thresholds, and operation permission constraints; for example, but not limited to, the legal range of protection settings includes overcurrent settings of 2A-10A, etc.; business process timing thresholds include data acquisition to trip execution ≤20ms, etc.; operation permission constraints include setting modification requiring administrator key verification, etc.

[0031] The system behavior benchmark library is used to pre-store SHA-256 hash benchmark values ​​of kernel code and business programs, normal sequence templates of system calls, and hardware resource usage thresholds; for example, but not limitingly, the hardware resource usage thresholds are CPU load ≤80%, memory usage ≤60%, etc.

[0032] The business trajectory database uses a linked list structure to record historical business execution data. The fields include: business type, execution timestamp, associated system behavior, operation result, and measurement status. Preferably, but not limited to, it supports fast indexing by timestamp. It is worth noting that, as one of the outstanding substantive features of this invention, this invention achieves data structure optimization. The business trajectory database uses a hybrid storage of "array + linked list", which improves index query efficiency by 30% and reduces storage usage by 40%.

[0033] The measurement control area stores policy parameters and operating status, with fields including: current business type, execution environment status, periodic measurement adjustment coefficient, trigger event threshold, current measurement mode, anomaly count statistics, and baseline value version number. Preferably, but not limitingly, the current measurement mode includes: periodic mode, trigger mode, and hybrid mode. The periodic mode includes: sequentially executing operating environment → system behavior → business behavior measurements, and comparing the results with the behavior rule base and system behavior baseline base. The trigger mode includes: after detecting a trigger event, prioritizing the execution of deep measurements corresponding to the four-tuple measurement model dimension; for example, but not limitingly, business triggers focus on verifying setpoints and timing. The hybrid mode includes: executing regular measurements on short cycles while simultaneously monitoring trigger events, and overlaying deep measurements after triggering. For example, but not limitingly, such as... Figure 3 As shown, the names and data types of each field in the measurement control area are explained, along with the logical relationships between the fields.

[0034] The out-of-step detection area is used to record measurement deviation information, and the fields include: deviation type, deviation location, occurrence timestamp, and associated business trajectory ID; preferably, but not limitingly, the deviation type includes: code integrity exception, business parameter out of bounds and / or timing violation, and the deviation location includes: kernel address and / or business module ID.

[0035] Specifically, the core measurement layer is based on the core dimensions of the four-tuple measurement model and designs three types of lightweight measurement mechanisms to adapt to embedded resource constraints, including: runtime environment measurement mechanism, system behavior measurement mechanism, and business behavior measurement mechanism.

[0036] The measurement object of the runtime environment measurement mechanism is the execution environment of the quadruple measurement model, preferably but not limited to CPU load, memory usage, Flash storage utilization, and I / O interface communication status; the implementation method of the runtime environment measurement mechanism preferably but not limited to reading the embedded processor status register and the statistical data of the Memory Management Unit (MMU), calculating the resource utilization rate using the sliding window mean algorithm, and comparing it with the environment threshold of the measurement control area, preferably but not limited to a window size of 5; the I / O interface status is verified in real time through the communication frame check bit to avoid complex protocol parsing.

[0037] The system behavior measurement mechanism adopts a layered measurement strategy, including: the kernel layer only verifies the hash value of key code segments to avoid full code scanning, and the key code segments are preferably, but not limited to, interrupt handlers and permission management modules; the business layer extracts the function call sequence features during program execution and compares them with templates in the system behavior benchmark library; further preferably, but not limitingly, the system behavior measurement mechanism is optimized, including: using the hardware hash acceleration module of the embedded processor to reduce the SHA-256 calculation time from 200ms to 30ms to meet real-time requirements.

[0038] The business behavior measurement mechanism includes: setpoint verification, timing verification, and data consistency verification. The setpoint verification includes: real-time monitoring of read / write operations on protection setpoints, synchronously verifying "authorization validity + range validity" during modification, and verifying data consistency during reading, preferably, but not limited to, a deviation of ≤5% from the historical average. The timing verification includes: recording the time consumed by each step of the business process using a hardware timer, with the total time required to be ≤20ms. For example, but not limited to, data acquisition t1, setpoint comparison t2, fault judgment t3, and trip execution t4, the total time t1+t2+t3+t4 must be ≤20ms. The data consistency verification includes: using a difference algorithm to verify the deviation between sampled data and historical data from the same period; if the deviation exceeds a set percentage, it is marked as abnormal. For example, but not limited to, using a difference algorithm to verify the deviation between current and voltage sampled data and historical data from the same period; if the deviation exceeds 10%, it is marked as abnormal. It is worth noting that, as another prominent substantive feature of this invention, the invention achieves optimized measurement algorithms. All measurement algorithms are adapted to embedded hardware acceleration modules, avoiding complex calculations at the software level.

[0039] Specifically, the policy scheduling layer is used for the implementation of multi-mode measurement policies, integrating business trajectories and system behavior, including: idle mode, critical business mode, and anomaly warning mode. These three measurement modes are dynamically switched through the measurement control area. The switching logic for these three measurement modes specifically includes: The idle mode is based on the periodic mode stored in the measurement control area: when the business trajectory library shows no critical business within a set time period, it switches to the "periodic measurement mode", and the period length = base period × period measurement adjustment coefficient, wherein the period measurement adjustment coefficient is dynamically adjusted according to the historical business frequency and has an upper limit value; preferably, but not restrictively, when the business trajectory library shows no critical business such as setting modification and fault handling within 30 minutes, it switches to the "periodic measurement mode" and dynamically adjusts the period length according to the historical business frequency, wherein 1 second is the base period and 5 is the maximum period measurement adjustment coefficient, and the period length is calculated according to the period length = base period × period measurement adjustment coefficient.

[0040] The critical business mode is based on the hybrid mode stored in the measurement control area: when a critical business is detected, the system switches to the "hybrid measurement mode", shortens the cycle length to a set duration based on the basic cycle, and starts monitoring of critical trigger events; preferably, but not restrictively, when critical businesses such as setting modification or fault handling are detected, the system switches to the "hybrid measurement mode", shortens the cycle to 500ms, and starts monitoring of critical trigger events.

[0041] The anomaly warning mode is based on the trigger mode stored in the measurement control area: when the out-of-step detection area records a minor anomaly, it switches to the "trigger enhancement mode" to expand the coverage of trigger events while maintaining periodic measurement; for example, but not limited to, when the out-of-step detection area records a single instance of memory usage exceeding the threshold, it switches to the "trigger enhancement mode" to expand the coverage of trigger events while maintaining periodic measurement.

[0042] Further preferably, but not limitingly, the triggering events include: system behavior triggering conditions and business behavior triggering conditions; wherein, the system behavior triggering conditions include: code hash value inconsistent with the baseline value, system call sequence deviating from the template, and hardware resource usage exceeding the threshold for multiple consecutive cycles, preferably but not limited to 3 cycles; the business behavior triggering conditions include: protection setting exceeding the limit, business timing timeout, sampling data deviation exceeding the threshold, and operation permission verification failure.

[0043] Step 3: Based on the layered architecture, the system performs metrics after initialization, including: the strategy scheduling layer executes mode switching logic, the core metrics layer implements a classification metrics process based on the dynamic switching results of the strategy scheduling layer, and performs anomaly classification response.

[0044] Preferred, but not limiting, such as Figure 2 As shown, the steps for metric execution are presented in detail, including mode switching logic, categorized metric process, and anomaly hierarchical response branches; specifically, step 3 includes: Step 3.1: System initialization, loading the data support layer; specifically, loading the business behavior rule library, system behavior benchmark library, initializing the measurement control area, business trajectory library, and out-of-step detection area; more specifically, initializing the measurement control area includes: period adjustment coefficient = 1, default period mode.

[0045] Step 3.2: Collect the current business type and execution environment status in real time and update it to the measurement control area of ​​the data support layer; for example, but not limited to, collect the current business type in real time through the business module status identifier and update it to the measurement control area.

[0046] Step 3.3: The strategy scheduling layer dynamically adjusts the measurement mode and parameters of the measurement control area according to the current state. For example, but not limited to, the hybrid mode is switched during critical business operations, with a period of 500ms.

[0047] Step 3.4: The core metric layer performs classification metrics according to the current mode: as described above, Cyclic mode: Sequentially execute runtime environment → system behavior → business behavior measurement, and compare the results with the benchmark / rule base; Triggering mode: After a triggering event is detected, the depth measurement of the corresponding dimension is executed first; Hybrid mode: Perform regular metrics on short cycles while monitoring triggered events, and overlay depth metrics after triggering.

[0048] Step 3.5: Result judgment: If normal, record to the business trajectory database; if abnormal, write to the out-of-step detection area and start the hierarchical response.

[0049] Step 3.6: Exception Handling: Minor exceptions increase the measurement frequency; serious exceptions trigger hardware alarms and prohibit critical operations; Example but not limitation: If a minor exception such as a single resource exceeding the threshold is detected, the measurement frequency is increased; if a serious exception such as code tampering or illegal modification of setpoints is detected, a hardware alarm is triggered and critical operations such as tripping are prohibited.

[0050] Step 3.7: Repeat steps 2-6 for continuous dynamic measurement. It is worth noting that, as another prominent substantive feature of this invention, it achieves resource scheduling optimization: measurement tasks are set to low priority, and when high-reliability, rapid-response core business (such as fault handling) is triggered, non-critical measurement operations are paused to ensure real-time business response.

[0051] It is also worth noting that, in summary, the data structure optimization of the data support layer, the measurement algorithm optimization of the core measurement layer, and the resource scheduling optimization of the strategy scheduling layer together constitute one of the important core concepts of this invention, namely, lightweight optimization design. Under the premise of meeting the lightweight requirements of embedded devices, it improves the accuracy and real-time performance of dynamic measurement, ensures the reliable operation of highly reliable and fast-response devices, and avoids power grid safety risks caused by defects in measurement technology.

[0052] In summary, the key features of this invention and the significant advancements it brings to the prior art include at least the following: 1. Quadruple-driven classification and measurement mechanism: For embedded high-reliability and fast-response devices, three measurement dimensions are split: operating environment, system behavior, and business behavior. Each dimension adopts a lightweight design to solve the problem of excessive resource consumption in existing technologies. 2. Multi-mode strategy for business trajectory fusion: Dynamically adjust the measurement period and mode based on the business trajectory library, distinguish between idle and critical business scenarios, and balance resource consumption and real-time performance; 3. System-Business Two-Layer Correlation Verification: Establish a correlation mechanism between system behaviors (such as permission verification) and business behaviors (such as value modification), fill the gap in existing technologies that only focus on the system layer, and improve the accuracy of anomaly detection; 4. Embedded-specific lightweight optimization: Through hardware acceleration, data structure simplification, and priority scheduling, it adapts to the low computing power and small memory constraints of high-reliability, fast-response devices, ensuring that metrics do not affect core business.

[0053] It is worth noting that in the embodiments of the present invention, "steps + numbers" is only an expression for clearly describing the specific implementation of the quadruple multimode trust dynamic measurement method for high reliability fast response devices, and is not an absolute restriction on the order of the steps. Under the guidance of the core concept of the present invention, changing the order of these steps to obtain the same or similar technical effects all fall within the scope of the present invention.

[0054] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A quadruple multi-mode reliability dynamic measurement method for high-reliability fast response devices, characterized in that, Includes the following steps: For high-reliability, fast-response devices, a four-tuple measurement model is established, including: subject-object-operation-execution environment; wherein, the subject is the functional module of the high-reliability, fast-response device, the object is the object being measured, the operation is the behavior of the subject on the object, and the execution environment includes: embedded hardware state, operating system state, and business scenario; Based on the quadruple metric model, a hierarchical dynamic metric architecture is built, with the bottom layer being the data support layer, the middle layer being the core metric layer, and the top layer being the strategy scheduling layer. The core metric layer includes: a runtime environment metric mechanism, a system behavior metric mechanism, and a business behavior metric mechanism. The strategy scheduling layer integrates business trajectories and system behaviors to implement multi-mode metric strategy switching. Based on the layered architecture, dynamic metrics are executed after initialization, including: based on dynamic data from the data support layer, the strategy scheduling layer executes mode switching logic; the core metrics layer implements a classification and measurement process based on the dynamic switching results of the strategy scheduling layer, and performs anomaly classification response.

2. The quadruple multi-mode reliability dynamic measurement method for high-reliability fast response devices according to claim 1, characterized in that: The main body includes: a data acquisition module, a setting management module, a trip execution module, and a communication module; The objects include: kernel code, business programs, protection settings, sampling data, and system configuration parameters; The operations include: code execution, fixed value reading / modification, data acquisition / storage, and system calls; The execution environment includes: embedded hardware status, operating system status, and business scenario.

3. A quadruple multi-mode reliability dynamic measurement method for high-reliability fast response devices according to claim 1 or 2, characterized in that: The data support layer includes: a business behavior rule base, a system behavior benchmark base, a business trajectory base, a measurement control area, and a step loss detection area; The business behavior rule base is used to store legal rules for core businesses that require high reliability and rapid response; The system behavior benchmark library is used to pre-store the SHA-256 hash benchmark values ​​of kernel code and business programs, normal sequence templates for system calls, and hardware resource usage thresholds. The business trajectory database is used to record historical business execution data; The metric control area stores policy parameters and operating status; The out-of-step detection area is used to record measurement deviation information.

4. The quadruple multi-mode reliability dynamic measurement method for high-reliability fast response devices according to claim 3, characterized in that: The business trajectory database uses a hybrid storage of "array + linked list" and supports fast indexing by timestamp.

5. The quadruple multi-mode reliability dynamic measurement method for high-reliability fast response devices according to claim 3, characterized in that: The measurement control area stores policy parameters and operating status, including fields such as: current measurement mode; The current measurement modes include: periodic mode, trigger mode, and hybrid mode; wherein, the periodic mode includes: sequentially executing runtime environment → system behavior → business behavior measurement, and comparing the results with the behavior rule base and the system behavior benchmark base; the trigger mode includes: after detecting a trigger event, prioritizing the execution of the depth measurement of the corresponding dimension of the four-tuple measurement model; the hybrid mode includes: executing regular measurement in short cycles, while monitoring trigger events, and overlaying depth measurement after triggering.

6. A quadruple multi-mode reliability dynamic measurement method for high-reliability fast response devices according to claim 1 or 2, characterized in that: The runtime environment measurement mechanism measures the execution environment of the quadruple measurement model. The system behavior measurement mechanism adopts a layered measurement strategy, including: the kernel layer only verifies the hash value, the business layer extracts the function call sequence features during program execution, and compares them with the templates in the system behavior benchmark library; The business behavior measurement mechanism includes: fixed value verification, time sequence verification, and data consistency verification.

7. The quadruple multi-mode reliability dynamic measurement method for high-reliability fast response devices according to claim 6, characterized in that: The policy scheduling layer includes: idle mode, critical business mode and anomaly warning mode, and the three measurement modes are dynamically switched through the measurement control area; The idle mode is a switch to periodic measurement when the business trajectory library shows no critical business within a set time period. The key business mode is to switch to hybrid measurement when a key business is detected, perform regular measurement with a shorter cycle than the periodic measurement, and monitor the triggering event, and overlay deep measurement after the triggering. The anomaly warning mode expands the coverage of triggering events while maintaining periodic measurement when an anomaly is detected.

8. The quadruple multi-mode reliability dynamic measurement method for high-reliability fast response devices according to claim 7, characterized in that: The triggering events include: system behavior triggering conditions and business behavior triggering conditions; The system behavior triggering conditions include: code hash value is inconsistent with the baseline value, system call sequence deviates from the template, and hardware resource usage exceeds the threshold for multiple consecutive cycles. The triggering conditions for the business behavior include: protection setting exceeding the limit, business timing timeout, sampling data deviation exceeding the threshold, and operation permission verification failure.

9. The quadruple multi-mode reliability dynamic measurement method for high-reliability fast response devices according to claim 3, characterized in that: The process of performing dynamic metrics after initialization, based on a layered architecture, includes: System initialization, loading the data support layer, including: loading the business behavior rule library, system behavior benchmark library, initializing the measurement control area, business trajectory library, and step loss detection area; Real-time collection of current business type and execution environment status, updated to the measurement and control area of ​​the data support layer; The strategy scheduling layer dynamically adjusts the measurement mode and parameters of the measurement control area according to the current state. The core metric layer performs classification metrics according to the current mode; Result judgment: If normal, record to the business trajectory database; if abnormal, write to the out-of-step detection area and initiate a tiered response. Anomaly Handling: Minor anomalies increase measurement frequency; severe anomalies trigger hardware alarms and disable critical operations. Repeat the above steps repeatedly to continuously measure dynamically.

Images