Malware detection apparatus, method and electronic apparatus using the same

Abstract

A malware detection device is disclosed, comprising a processor and an accelerator, wherein the accelerator is electrically connected to the processor. The processor can operate in a first mode or a second mode, wherein the first privilege in the first mode is higher than the second privilege in the second mode. The accelerator is triggered by the processor in the first mode to read code blocks from untrusted blocks, uses a judgment model to determine whether the program software corresponding to the code block is malware, and generates a judgment result for the processor.

Description

Technical Field

[0001] This invention relates to a malware detection technology, and more particularly to a malware detection apparatus, method, and electronic device using the same, which implements machine learning algorithms by setting up an additional accelerator processor and enables the code blocks of untrusted blocks to be read by the accelerator processor in a specific mode, so as to further determine whether the program software corresponding to the code blocks of untrusted blocks is malware. Prior Technology

[0002] In the field of information security, malicious software such as Trojans or worms can be identified through static analysis, which is a common method. There are also studies that suggest using deep learning techniques to train a neural network model to analyze programs. The neural network model mentioned above can include Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), and fully-connected layers.

[0003] In an Internet of Things (IoT) system, terminal devices connected to the network may download and execute untrusted applications to achieve specific goals. These untrusted programs may contain malicious software, which could damage the system if executed. Generally, the code of software to be executed by the processor is stored in Random Access Memory (RAM) or Read-Only Memory (ROM). This area storing the executable code is called the program region. This region can be defined; for example, the Memory Protection Unit (MPU) or Memory Management Unit (MMU) of an ARM architecture processor can define an "execute-never" region to separate the areas where the processor is allowed to execute programs from those where it is not. If a malicious program is found in the allowed program region, it may be launched and run at a specific time.

[0004] In short, while previous technologies could statically analyze whether software was malicious using deep learning, they relied on the processor to read the software's code blocks. Therefore, they couldn't effectively prevent malicious software from existing within these blocks and being executed. Furthermore, typical terminal devices operate at relatively low frequencies, and processors have limited processing power, making it difficult for them to perform neural network operations, or resulting in excessively long processing times for malware identification. Summary of the Invention

[0005] As can be understood from the above description, the purpose of this invention is to provide a malware detection apparatus, method, and electronic device that can prevent malware from being read by the processor during the identification process and can perform machine learning operations or reduce the processing time for malware identification.

[0006] Based on one objective of this invention, an embodiment of this invention provides a malware detection device, which includes a processor and an accelerator, wherein the accelerator is electrically connected to the processor. The processor can operate in a first mode or a second mode, wherein the first privilege in the first mode is higher than the second privilege in the second mode. The accelerator is triggered by the processor in the first mode to read code blocks from untrusted blocks, uses a judgment model to determine whether the program software corresponding to the code block is malware, and generates a judgment result for the processor.

[0007] Based on one objective of the present invention, an embodiment of the present invention provides an electronic device, which includes the above-mentioned malware detection device, storage device and memory device, wherein the storage device and memory device are electrically connected to the malware detection device.

[0008] Based on one objective of the present invention, embodiments of the present invention provide a malicious software detection method. The malicious software detection method is executed in a malicious software detection device including a processor and an accelerator, wherein the processor runs in a first mode or a second mode, the first privilege of the first mode is higher than the second privilege of the second mode, and the malicious software detection method includes the following steps: causing the processor to trigger the accelerator in the first mode; causing the triggered accelerator to read code blocks from untrusted blocks; and causing the triggered accelerator to use a judgment model to judge whether the program software corresponding to the code block is malicious software based on the code block, and generating a judgment result for the processor.

[0009] As described above, compared to prior art, the malware detection device and method provided by the present invention can be implemented using a processor with low computing power. This allows electronic devices with low computing performance (e.g., IoT terminal devices) to perform malware identification using machine learning algorithms. Furthermore, through the design of different permission modes, each hardware circuit can only be operated and accessed in the permitted mode, thus effectively preventing malware from being read by the processor and thus destroying the malware detection program. Simple Explanation of the Diagram

[0010] Figure 1 is a block diagram of a malicious software detection device for electronic devices according to an embodiment of the present invention. Figure 2 is a flowchart illustrating the malicious software detection method according to an embodiment of the present invention. Implementation

[0011] To enable low-performance electronic devices (e.g., IoT terminal devices) to perform malware identification using machine learning algorithms, and to effectively prevent malware from being read by the processor and thus compromising the malware detection program, this invention employs an additional accelerator processor to implement the machine learning algorithm. Furthermore, the hardware circuitry is designed so that the processor can only access the code blocks of untrusted areas in permitted modes. This allows the accelerator processor, triggered by the processor in a specific mode, to read the code blocks of untrusted areas and further determine whether the program software within these untrusted code blocks is malicious. This also prevents malicious software from being executed by the processor in specific modes and thus altering the malware detection program, the judgment results, and the model data. The following detailed description, in conjunction with the accompanying drawings, illustrates possible embodiments of this invention. However, it should be noted that these details are not intended to limit the scope of the claims made in this invention, but are merely for the convenience of those skilled in the art.

[0012] First, please refer to Figure 1, which is a block diagram of a malware detection device for an electronic device according to an embodiment of the present invention. The electronic device includes a malware detection device, a memory device, and a storage device. The malware detection device includes a processor 101 and an accelerator processor 102, and may further include at least one of memory units 103 and 104, storage units 105 and 106, and an interface controller 107.

[0013] Furthermore, memory units 103 and 104 can be part of a memory device, and storage units 105 and 106 can be part of a storage device. The memory device and storage device can be electrically connected to the malware detection device, but this invention is not limited thereto. For example, in some embodiments, memory units 103 and 104, and storage units 105 and 106 are independent hardware components of the malware detection device, and are not implemented as memory devices and storage devices.

[0014] Alternatively, the electronic device may include a computing processor, and the computing processor of the electronic device may serve as the processor 101 of the malicious software detection device; or, the electronic device may include multiple computing processors, and one of the computing processors of the electronic device may serve as the processor 101 of the malicious software detection device; or, the electronic device may include multiple computing processors, and the multiple computing processors of the electronic device may work together to serve as the processor 101 of the malicious software detection device.

[0015] Accelerator 102 is electrically connected to processor 101, memory unit 103 is electrically connected to processor 101 and accelerator 102, memory unit 104 is electrically connected to processor 101 and accelerator 102, storage unit 105 is electrically connected to accelerator 102, storage unit 106 is electrically connected to processor 101, and interface controller 107 is electrically connected to memory unit 104.

[0016] In this invention, the processor 101 can operate in either a first mode M1 or a second mode M2, wherein the first privilege of the first mode M1 is higher than the second privilege of the second mode M2. Simply put, the first mode M1 is a high-privilege mode, and the second mode M2 ​​is a low-privilege mode. If the processor 101 is implemented using an ARM architecture Cortex M series processor (e.g., Cortex M55), then the first mode M1 is a secure mode, and the second mode M2 ​​is a non-secure mode.

[0017] With different permission modes, the hardware configuration area can be physically or logically divided into a high-privilege area R1 and a low-privilege area R2. Hardware circuits configured in the high-privilege area R1 can be used or accessed by the processor in the first mode M1, but cannot be used or accessed by the processor in the second mode M2. Hardware circuits configured in the low-privilege area R2 can be used or accessed by the processor in both the first mode M1 and the second mode M2.

[0018] Furthermore, a portion of the processor 101 (the portion for operating in the first mode M1) is configured in the high-privilege region R1, another portion of the processor 101 (the portion for operating in the second mode M2) is configured in the low-privilege region R2, the memory unit 103, storage units 105, 106 and the accelerator processor 102 are configured in the high-privilege region R1, and the second memory unit 104 and the interface controller 107 are configured in the low-privilege region R2.

[0019] When processor 101 operates in the first mode M1, it can execute a malware detection program to set a read address and trigger accelerator 102 to send the read address to accelerator 102. Memory unit 104 is defined as an untrusted block and a program block, used to store one or more code blocks of the program software. The triggered accelerator 102 reads the code block from the untrusted block according to the read address, and uses a judgment model to determine whether the program software corresponding to the code block is malware, and generates a judgment result for processor 101.

[0020] When the processor 101 operates in the second mode M2, it can access the code block of the untrusted block to execute the program software corresponding to the code block. Further, in one implementation, in the first mode M1, the processor 101 is designed to allow the self-memory unit 104 (untrusted block) to access the code block; that is, in the first mode M1, the processor 101 can execute the program software corresponding to the code block. In another implementation, in the first mode M1, the processor 101 is designed to prohibit the self-memory unit 104 (untrusted block) from accessing the code block; that is, in the first mode M1, the processor 101 cannot execute the program software corresponding to the code block.

[0021] The accelerator processor 102 primarily serves as hardware circuitry for accelerating machine learning algorithms, thereby enabling even electronic devices with limited computing power (e.g., IoT terminal devices) to perform malware identification using machine learning algorithms. The accelerator processor 102 can be a neural network computing unit, and can be implemented using neural network computing units from ARM's Ethos U series (e.g., Ethos U55 or Ethos U85).

[0022] The interpretation model used above may include at least one of the following: convolutional neural networks, feedforward neural networks, support vector machines (SVM), long short-term memory networks (LSTM), recursive neural networks, gated recurrent units (GRU), and K-nearest neighbor (KNN) classification models. Furthermore, the convolutional neural network may have fully connected or partially connected layers following it. When the interpretation model has a convolutional neural network, the one-dimensional sequence data of the code block is converted into two-dimensional data (similar to image data), for example, but not limited to, Gramian Angular Field (GAF) transformation.

[0023] Without loss of generality, the accelerator processor 102 may include a plurality of multiply-accumulate (MAC) arithmetic units, a plurality of kernel function arithmetic units, a plurality of pooling arithmetic units, a plurality of rectified linear units (RLUs), and a plurality of sigmoid activation function arithmetic units.

[0024] The accelerator processor 102 further includes an active interface and a passive interface. The active interface is used to request model data from the storage unit 105 after the accelerator processor 102 is triggered, and to temporarily store the judgment result in the memory unit 103 after judgment. The passive interface is used to receive the read address and the trigger signal generated by the processor 101 to trigger the accelerator processor 102.

[0025] The memory unit 103 is used to temporarily store the judgment results generated by the acceleration processor 102 and allows the processor 101 to read the judgment results in the first mode M1. The memory unit 103 is configured in the high-limit region R1, so in the second mode M2, the processor 101 is prohibited from accessing the judgment results from the memory unit 103. In other words, the judgment results temporarily stored in the memory unit 103 are isolated and will not be tampered with by malicious software.

[0026] As described above, memory unit 104 serves as an untrusted block and temporarily stores code blocks of the program software. The code blocks temporarily stored in memory unit 104 in the high-privilege region R1 can be read by the accelerator processor 102 for malware identification. In the second mode M2, processor 101 is allowed to read code blocks from memory unit 104 to execute the corresponding program software. However, if the program software has already been identified as malware by processor 101 in the first mode M1, processor 101 will prohibit the program software from being executed in both the first mode M1 and the second mode M2. Alternatively, processor 101 will delete the program software's code blocks from memory unit 104 to prevent the program software from being executed.

[0027] Additionally, the interface controller 107 (e.g., implemented as an Ethernet interface controller) in the low-privilege region R2 can be used to update the code blocks of the program software stored in the memory unit 104. Typically, in IoT applications, the terminal device downloads the software program to the memory unit 104 via the interface controller 107. Therefore, the software program in the memory unit 104 can usually only be executed by the processor 101 in the second mode M2, and through this invention, the software program in the memory unit 104 can be identified by the accelerator processor 102 as malicious software.

[0028] Storage unit 105 is used to store model data of the interpretation model and allows accelerator processor 102 to read the model data. The model data is generated by training the interpretation model. Therefore, after accelerator processor 102 reads the model data, the interpretation model used by accelerator processor 102 is the trained interpretation model, which can determine whether the program software is malicious software with a certain accuracy. Since storage unit 105 is configured in the high-privilege area R1, processor 101 is prohibited from accessing model data from storage unit 105 in the second mode M2, thereby preventing the model data from being tampered with by malicious software.

[0029] Storage unit 106 is defined as a trusted block and a program block, storing a malware detection program. In the first mode M1, the processor reads the malware detection program from storage unit 106, executes the malware detection program, triggers the accelerator processor 102, sets the read address corresponding to the code block stored in memory unit 104, and passes the read address to the accelerator processor 102. Because storage unit 106 is configured in the high-privilege area R1, the processor 101 is prohibited from accessing the malware detection program from storage unit 106 in the second mode M2, thereby preventing the malware detection program from being modified by malware.

[0030] Please note that since software may have multiple code blocks, the aforementioned malware detection is performed sequentially on each code block in the first mode M1. In other words, the accelerator processor 102 reads one code block at a time, performs the judgment using the judgment model, and generates a judgment result, until every code block has been read and judged, at which point the malware detection ends.

[0031] For example, the program software includes a first code block and a second code block, which are stored in an untrusted block. The accelerator 102 is triggered by the processor 101 in the first mode M1 to read the first code block from the untrusted block, uses a judgment model to determine whether the program software corresponding to the first code block is malicious software, and generates a judgment result for the processor 101. Then, the accelerator 102 is triggered again by the processor 101 to sequentially read the second code block from the untrusted block, uses a judgment model to determine whether the program software corresponding to the second code block is malicious software, and generates a judgment result for the processor 101.

[0032] Please refer to Figures 1 and 2. Figure 2 is a flowchart illustrating the malware detection method according to an embodiment of the present invention. The malware detection device described above can be used to execute the malware detection method, and the malware detection method includes at least steps S201 to S205. Furthermore, in other embodiments, it may include the functional steps performed by the malware detection device described above.

[0033] In this embodiment, firstly, in step S201, the processor 101 sets the read address of the code block of the untrusted software in the first mode M1. Then, in step S202, the processor 101, in the first mode M1, passes the read address to the accelerator 102 and triggers the accelerator 102 to read the code block. Next, in step S203, the triggered accelerator 102 reads model data and uses the judgment model to determine whether the software in the code block is malicious software. Then, in step S204, the triggered accelerator 102 stores the judgment result in the memory unit 103. Then, in step S205, the processor 101 reads the judgment result from the memory unit 103 in the first mode M1.

[0034] In summary, the malware detection device, method, and electronic device using the present invention have at least the following characteristics: (1) The prior art can only identify malware using machine learning algorithms on computer devices with high computing power, but cannot be implemented on electronic devices with low computing power. The present invention provides an additional accelerator processor, enabling electronic devices with low computing power (e.g., IoT terminal devices) to identify malware using machine learning algorithms; (2) Through the design of different permission modes, the hardware circuit has access restrictions under different permission modes, achieving the purpose of storing data in hardware isolation. Through this isolation technology, the access of malware and malware detection software can be separated. (3) Define an untrusted block, which is a program block used to store one or more code blocks of the software program. This accelerates the processor to be triggered by the processor and receive the read address set by the processor to read the code block from the untrusted block for judgment. This avoids the accelerated processor from judging unrelated data blocks, reducing the amount of computation and overall power consumption. (4) Define a trusted block, which is a program block. Electronic devices can provide both secure and insecure execution environments with only one processor, thus further reducing system hardware costs.

[0035] This invention is disclosed herein only by preferred embodiments. However, it should be understood by anyone skilled in the art that the above embodiments are for illustrative purposes only and are not intended to limit the scope of the patent rights claimed by this invention. Any variations or substitutions that are equivalent to or equivalent to the above embodiments should be interpreted as being covered within the spirit or scope of this invention. Therefore, the scope of protection of this invention should be based on the claims defined below.

[0036] 101: Processor 102: Accelerated Processor 103, 104: Memory Units 105, 106: Storage Units 107: Interface Controller M1: First Mode M2: Second Mode R1: High-privilege area R2: Low-privilege region S201~S205: Steps

Claims

1. A malware detection device, comprising: A processor, running in a first mode or a second mode, wherein a first privilege in the first mode is higher than a second privilege in the second mode; And an accelerator, electrically connected to the processor; wherein the accelerator is triggered by the processor in the first mode to read a code block from an untrusted block, use a judgment model to judge whether the program software corresponding to the code block is malicious software, and generate a judgment result to the processor; wherein the malicious software detection device further includes: A second memory unit, electrically connected to the processor and the accelerator, is used as the untrusted block and temporarily stores the code block of the program software, wherein the processor is allowed to read the code block from the second memory unit in the second mode; and a second storage unit, electrically connected to the processor, is used as a trusted block and stores a malware detection program, wherein the processor reads the malware detection program from the second storage unit in the first mode, executes the malware detection program, triggers the accelerator, and passes a read address corresponding to the code block stored in the second memory unit to the accelerator, and the processor is prohibited from accessing the malware detection program from the second storage unit in the second mode.

2. The malware detection device as described in claim 1 further comprises: A first memory unit, electrically connected to the processor and the accelerator, is used to temporarily store the judgment result generated by the accelerator and allow the processor to read the judgment result in the first mode, wherein the processor is prohibited from accessing the judgment result from the first memory unit in the second mode.

3. The malware detection device as described in claim 2 further comprises: A first storage unit, electrically connected to the accelerator processor, is used to store model data of the judgment model and allows the accelerator processor triggered by the processor in the first mode to read the model data, wherein the processor is prohibited from accessing the model data from the first storage unit in the second mode.

4. The malware detection apparatus as claimed in claim 1, wherein the interpretation model includes at least one of a convolutional neural network, a feedforward neural network, a support vector machine, a long short-term memory network, a recursive neural network, a gated recurrent unit, and a K-nearest neighbor classification model.

5. The malware detection device as claimed in claim 3, wherein a portion of the processor is configured in a high-privilege region, another portion of the processor is configured in the low-privilege region, the first memory unit, the first storage unit, the second storage unit and the accelerator processor are configured in the high-privilege region, and the second memory unit is configured in the low-privilege region.

6. An electronic device comprising: The malicious software detection device as described in any one of claims 1 to 5; A storage device electrically connected to the malware detection device; And a memory device electrically connected to the malware detection device.

7. A malware detection method, executed in a malware detection apparatus including a processor and an accelerator, wherein the processor operates in a first mode or a second mode, wherein a first privilege in the first mode is higher than a second privilege in the second mode, and the malware detection method includes: This causes the processor to trigger the accelerator in the first mode; The triggered accelerator reads a code block from an untrusted block; The system also enables the triggered accelerator to use a judgment model to determine whether the program corresponding to the code block is malicious software based on the code block, and generates a judgment result for the processor; wherein a first memory unit of the malicious software detection device is used to temporarily store the judgment result generated by the accelerator, and allows the processor to read the judgment result in the first mode, and the processor is prohibited from accessing the judgment result from the first memory unit in the second mode; wherein a second memory unit of the malicious software detection device serves as the untrusted block, and temporarily stores the code block of the program software, and the processor is allowed to read the code block from the second memory unit in the second mode; wherein the processor is allowed to access the code block from the second memory unit in the first mode, or the processor is prohibited from accessing the code block from the second memory unit in the first mode; A second storage unit of the malware detection device is used as a trusted block and stores a malware detection program. In the first mode, the processor reads the malware detection program from the second storage unit, executes the malware detection program, triggers the acceleration processor, and passes a read address corresponding to the code block stored in the second storage unit to the acceleration processor. In the second mode, the processor is prohibited from accessing the malware detection program from the second storage unit.

Images