A device behavior simulation method, apparatus, hardware chip and electronic device

By simulating the working behavior of target devices in the Industrial Internet using hardware chips, the problems of honeypots being easily detected and resources being wasted in existing technologies are solved, and low-cost, highly covert attack behavior capture is achieved.

CN114816891BActive Publication Date: 2025-12-19HARBIN ANTIY TECH
View PDF 1 Cites 0 Cited by

Patent Information

Application Number
CN202210167613.9
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2022-02-23
Publication Date
2025-12-19
Estimated Expiration
2042-02-23

AI Technical Summary

Technical Problem

Existing industrial internet honeypots mainly simulate device communication behavior through software, which is easily detected by attackers, making it impossible to effectively capture or analyze attack behavior. Furthermore, using real devices to build honeypot networks results in resource waste and maintenance inconvenience.

Method used

By simulating the working behavior of the target device through a hardware chip, an operating environment identical to that of the target device is established, and the target device's operating files are actually run in the hardware chip. Attacks are captured by exploiting physical interfaces and firewall vulnerabilities.

Benefits of technology

It improves the concealment and security of hardware chips, reduces costs, achieves highly interactive behavior simulation, is difficult for malicious users to detect, and can effectively capture attack behavior.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN114816891B_ABST
    Figure CN114816891B_ABST
Patent Text Reader

Abstract

The application provides a device behavior simulation method and device, a hardware chip and an electronic device. The method is applied to a hardware chip, and the hardware chip is used for simulating the working behavior of a target device. The method comprises the following steps: obtaining environment parameters and running files corresponding to the target device; establishing a running environment in the hardware chip according to the environment parameters; and executing the running files in the running environment, so that the hardware chip simulates the working behavior of the target device. The application can establish the same running environment as the target device in the hardware chip through the environment parameters and the running files of the target device, so as to simulate the working behavior of the target device. In the application, the working behavior of the target device is directly simulated by the hardware chip, so that the working behavior of the target device is actually run in the hardware chip instead of being virtually run by software. Therefore, the concealment of the hardware chip is improved, the malicious user is difficult to identify, and the security is improved.
Need to check novelty before this filing date? Find Prior Art

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a device behavior simulation method and device, a hardware chip and an electronic device. BACKGROUND

[0002] With the rapid development of industrial internet, industrial internet technology is gradually applied to chemical industry, automobile industry, intelligent manufacturing and other industrial industries. As an important part of industrial internet, the security problem of industrial control network is also gradually highlighted. In the field of industrial internet security, the understanding of personnel attack behavior and mode is still in a fuzzy state, and there is always a gap between attack and protection. This makes the security research of industrial internet in an unfavorable situation. The current industrial internet intelligent device honeypot mainly has two defects:

[0003] 1. The traditional industrial internet honeypot mainly simulates device communication behavior through software mode, which is easy to be recognized by attackers, so that the behavior of attack software cannot be effectively captured or analyzed, and the attack intention cannot be found.

[0004] 2. If a real device is used to build a honeypot network, it will cause resource waste and inconvenience in maintaining the honeypot network. SUMMARY

[0005] Therefore, the present application provides a device behavior simulation method, device, hardware chip and electronic device, which at least partially solves the problems in the prior art.

[0006] According to one aspect of the present application, a device behavior simulation method is provided, which is applied to a hardware chip for simulating the working behavior of a target device.

[0007] The method comprises:

[0008] Obtaining the environment parameters and running files corresponding to the target device;

[0009] Establishing a running environment in the hardware chip according to the environment parameters;

[0010] In the running environment, the running files are executed to make the hardware chip simulate the working behavior of the target device.

[0011] In an exemplary embodiment of the present application, the step of establishing a running environment in the hardware chip according to the environment parameters comprises:

[0012] Determining at least one original data exchange interface of the target device according to the environment parameters;

[0013] determining a target data exchange interface corresponding to each original data exchange interface, the target data exchange interface being a physical interface of the hardware chip;

[0014] configuring the target data exchange interface to enable the target data exchange interface to perform the same function as the corresponding original data exchange interface.

[0015] In an exemplary embodiment of the present application, the running environment comprises an operating system;

[0016] The method further comprises:

[0017] determining a set of memory addresses corresponding to the operating system;

[0018] directly accessing the physical memory corresponding to the operating system according to the set of memory addresses to obtain running information of the operating system.

[0019] In an exemplary embodiment of the present application, the method further comprises:

[0020] determining abnormal data in the running information;

[0021] continuously monitoring data sent by a data source corresponding to the abnormal data according to the data source.

[0022] In an exemplary embodiment of the present application, a firewall is arranged in the hardware chip, the firewall is provided with a target vulnerability, and the target vulnerability has a corresponding calling interface;

[0023] The method further comprises:

[0024] capturing a data packet received by the calling interface.

[0025] In an exemplary embodiment of the present application, the method further comprises:

[0026] receiving a reset instruction to reset the running environment.

[0027] In an exemplary embodiment of the present application, the target device has an upstream device and a downstream device in communication connection therewith;

[0028] The hardware chip is connected with the upstream device and the downstream device;

[0029] The hardware chip can receive input information sent by the upstream device and process the input information according to the running file to obtain output information;

[0030] The output information is configured not to be responded by the downstream device.

[0031] According to an aspect of the present application, there is provided a device behavior simulation apparatus applied to a hardware chip, the hardware chip being configured to simulate a working behavior of a target device.

[0032] The apparatus comprises:

[0033] an obtaining module configured to obtain an environment parameter and a running file corresponding to the target device;

[0034] a establishing module configured to establish a running environment in the hardware chip according to the environment parameter;

[0035] a running module configured to execute the running file in the running environment, so that the hardware chip simulates the working behavior of the target device.

[0036] According to an aspect of the present application, there is provided a hardware chip configured to execute the steps of any of the above-mentioned methods.

[0037] According to an aspect of the present application, there is provided an electronic device comprising a hardware chip configured to execute the steps of any of the above-mentioned methods.

[0038] The device behavior simulation method provided by the present application can establish the same running environment as the target device in a hardware chip through the environment parameter and the running file of the target device, and run the running file of the target device in the running environment, so as to simulate the working behavior of the target device. In the present application, the working behavior of the target device is directly simulated by the hardware chip, so that the working behavior of the target device is actually run in the hardware chip, rather than virtually run through software, thereby improving the concealment of the hardware chip and making it difficult for malicious users to recognize, and improving the security. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0040] Figure 1 A flowchart of a device behavior simulation method provided by the present embodiment;

[0041] Figure 2 A structural block diagram of a device behavior simulation apparatus provided by the present embodiment;

[0042] Figure 3A use state structure diagram of a hardware chip is provided for the embodiment. DETAILED DESCRIPTION

[0043] The embodiments of the present application will be described in detail below with reference to the drawings.

[0044] It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict; and all other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative labor are within the scope of protection of the present application.

[0045] It should be noted that various aspects of the embodiments described below are within the scope of the appended claims. It should be apparent that the aspects described herein can be embodied in a wide variety of forms and that any specific structure and / or function described herein is merely illustrative. Based on the teachings herein one skilled in the art should appreciate that an aspect described herein can be implemented independently of any other aspects and that an aspect can be implemented both as any number of software and / or hardware structures. For example, an aspect can be implemented as a single structure or any number of separate structures or instances, operating together or independently of one another.

[0046] Reference will now be made to Figure 1 As shown in the figure, according to an aspect of the present application, a device behavior simulation method is provided, which is applied to a hardware chip used for simulating the working behavior of a target device.

[0047] The method comprises the following steps:

[0048] In step S100, an environment parameter and a running file corresponding to the target device are acquired.

[0049] In step S200, a running environment is established in the hardware chip according to the environment parameter.

[0050] In step S300, the running file is executed in the running environment, so that the hardware chip simulates the working behavior of the target device.

[0051] In the hardware chip, a firewall is arranged, and the firewall is provided with a target vulnerability.

[0052] In the embodiment, the target device is an industrial internet device, such as a PLC, an embedded controller or a single-chip microcomputer, etc.

[0053] In the traditional behavior simulation mode, if the PLC behavior is simulated, since the PC is used to only perform the communication simulation at the software level, it belongs to the low-interactive behavior simulation, and the probability of being recognized by a malicious user is high. The high-interactive behavior simulation needs to use the same device as the simulated device to perform simulation running, but since the cost of a single device is often high, the cost of this behavior simulation mode is very high.

[0054] In the embodiment, the hardware chip itself is a programmable and logic processing hardware chip, and also has a plurality of data interaction interfaces, and can realize the interface simulation and actual running behavior simulation of the PLC and other industrial internet devices. Therefore, a running environment same as the target device can be actually established in the hardware chip, and the running is stable in the running environment, and the actual running is realized, so that the high-interactive behavior simulation is realized. That is, the running environment and running action (execution of running file) of the hardware chip and the target device are kept the same, and no behavior or data is generated by software simulation, so that the deception to malicious users is strong when implemented.

[0055] Meanwhile, the target vulnerability is set in the firewall in the hardware chip, and the target vulnerability is used to lure malicious users to attack, so that the hardware chip can capture and monitor the attack behavior of the malicious users through the target vulnerability under control.

[0056] The device behavior simulation method provided in the embodiment can establish the same running environment as the target device in the hardware chip through the environment parameters and the running file of the target device, and run the running file of the target device in the running environment, to realize the working behavior simulation of the target device. In the embodiment, the working behavior of the target device is directly simulated by the hardware chip, so that the working behavior of the target device is actually run in the hardware chip, instead of being virtually run by software, so that the concealment of the hardware chip is improved, and it is not easy to be recognized by malicious users, and the security is improved. And the cost of a single hardware chip is lower than that of the target device, so that the low-cost high-interactive behavior simulation is realized.

[0057] In an example embodiment of the present application, the running environment is established in the hardware chip according to the environment parameters, comprising:

[0058] determining at least one original data exchange interface of the target device according to the environment parameters;

[0059] determining the target data exchange interface corresponding to each original data exchange interface, the target data exchange interface being a physical interface of the hardware chip;

[0060] configuring the target data exchange interface, so that the target data exchange interface can perform the same function as the corresponding original data exchange interface.

[0061] Both the original data exchange interface and the target data exchange interface can be I / O interfaces. Specifically, configuring the target data exchange interface involves configuring it according to the interface name, corresponding functions, and connection relationships of the original data exchange interface, so that the target data exchange interface has the same configuration as the original data exchange interface and performs the same functions.

[0062] In this embodiment, when establishing the operating environment, unlike the software behavior simulation method which uses a simulated data interface (without an actual interface, only a virtual address), the physical interface of the hardware chip is used to perform the same work as the target device's response data exchange interface. This realizes the actual operation of the interface function, so it is difficult for malicious users to identify that the interface is not the actual data exchange interface in the industrial Internet device through the behavior and related data of the target data exchange interface, further improving the concealment of the device behavior simulation method.

[0063] In one exemplary embodiment of this application, the target device has an upstream device and a downstream device communicatively connected to it;

[0064] The hardware chip is connected to the upstream device and the downstream device;

[0065] The hardware chip can receive input information sent by the upstream device and process the input information according to the running file to obtain output information;

[0066] The output information is used to send to the downstream device, and the output information is configured not to be responded to by the downstream device.

[0067] In this embodiment, the hardware chip is actually connected to the upstream and downstream devices corresponding to the target device, and also receives input information from the upstream device and sends output information to the downstream device. Thus, from the perspective of a malicious user, the hardware chip appears to be actually connected to the industrial internet network and performing inter-device communication.

[0068] Meanwhile, the hardware chip uses the same runtime file as the target device to process the input information, and it also performs actual processing on the input information. Unlike software simulations that directly determine the output information through simple mapping tables, the hardware chip's simulation behavior appears identical to that of the target device from the perspective of a malicious user. This further enhances the hardware chip's stealth and makes it difficult for malicious users to detect.

[0069] Specifically, in the embodiment, the hardware chip can be seen as parallel to the target device to some extent, and the input information obtained and the output information generated by the two are the same in information path and information content. However, the output information of the hardware chip will not be responded by the downstream device connected thereto, so as to avoid the case that the output information is changed by a malicious user after the target vulnerability is intruded, thereby affecting the normal work of the downstream device.

[0070] The implementation method of configuring the output information not to be responded by the downstream device can be that a setting identifier or character is embedded at a setting byte of the output information of the hardware chip, so that the downstream device directly discards the information after receiving the information with the setting identifier or character. Or the I / O port connecting the downstream device and the target chip is directly set as a null port.

[0071] In an exemplary embodiment of the present application, the running environment includes an operating system.

[0072] The method further includes:

[0073] determining a memory address set corresponding to the operating system;

[0074] directly accessing the physical memory relied on by the operating system according to the memory address set, to obtain running information of the operating system.

[0075] In some high-end industrial internet devices, there is an operating system inside to run some software programs and the like. However, since the operating system of the industrial internet device is mostly a closed system, the internal behavior data cannot be obtained through a proxy mode when the actual industrial internet device is used to simulate high-interaction behaviors, so the collected data is limited.

[0076] The hardware information provided in the embodiment also establishes a corresponding operating system when establishing a running environment, directly accesses the physical memory (hardware memory) relied on by the operating system during the running of the operating system according to a memory address set corresponding to the operating system in the working environment (DMA, Direct Memory Access), to directly read the related data in the running process of the operating system, and to determine the attack behavior of a malicious user by analyzing the read system memory data (running information). For example, by reading the network card traffic data, all communication data in the network card are recorded. The collected data can include host keyboard input, network communication port, system log, host file change, network communication data packet, device running state and remote operation log, so as to covertly record the keyboard input, communication port, log, file change, network communication and the like of the attacker.

[0077] Compared with reading through a Hook system API, the embodiment realizes traceless behavior data collection, increases the concealment of device behavior simulation, and improves the comprehensiveness of collected data.

[0078] In an example embodiment of the present application, the method further comprises:

[0079] determining abnormal data in the running information;

[0080] According to the data source corresponding to the abnormal data, the data sent by the data source is continuously monitored.

[0081] Specifically, the receiving information and the output information of the intelligent device in the industrial internet are relatively single, and the information structure and content are relatively unified, so that the method for determining abnormal data in the running information can be that each input information and output information in the running information is compared with a normal information template, so that the information with greater difference is determined as abnormal data. The abnormal data can also be determined by comparing the function and security function corresponding to each running information.

[0082] After the abnormal data is determined, the corresponding data source (malicious user) can be determined according to the data source information corresponding to the abnormal data. Thus, the data source is directly monitored to realize targeted attack behavior data acquisition and monitoring.

[0083] In an example embodiment of the present application, a firewall is arranged in the hardware chip, the firewall is provided with a target vulnerability, and the target vulnerability has a corresponding calling interface;

[0084] The method further comprises:

[0085] The data packet received by the calling interface is captured.

[0086] Since the target vulnerability is set purposefully, the probability of attack by the malicious user through the calling interface corresponding to the target vulnerability is relatively large, so the calling interface can be directly monitored and the data packet can be captured purposefully. The capture method can be that the calling interface is set to send each data packet to an analysis module in the hardware chip in addition to normal processing such as sending and forwarding, so that the analysis module can analyze the content of the data packet and discover the attack of the malicious user in time.

[0087] In an example embodiment of the present application, the method further comprises:

[0088] A reset instruction is received to reset the running environment.

[0089] The resetting of the running environment refers to restoring the running environment to an initial establishment time of the running environment, that is, the running environment established according to the environment parameter just after the establishment.

[0090] In the conventional method, the target device is simulated by the same actual device, and after the actual device is attacked, if the actual device is reset, the resetting can only be performed by restoring the factory settings, but the resetting in this way also causes the running environment and the executable file set according to the target device in the device to be restored and deleted, and thus a large amount of operations are required to set the related parameters and the like after the resetting.

[0091] The device behavior simulation method provided in this embodiment can periodically acquire attack source identification data and attack process record data of a behavior simulation chip (hardware chip), and determine whether the cyberspace deception system is attacked. When it is found that the hardware chip is attacked, an alarm is given and a record is made. Moreover, the hardware chip that is attacked can be quickly reset to the state before the attack, and the hacker attack is induced again to capture the attack weapon and analyze the attack process, attack means, attack technology and the like. Compared with the behavior simulation using the actual device, the resetting speed is fast and no additional operation cost is required.

[0092] Please refer to Figure 2 According to an aspect of the present application, a device behavior simulation apparatus is provided, which is applied to a hardware chip and used for simulating working behavior of a target device.

[0093] The apparatus comprises:

[0094] An acquisition module is configured to acquire environment parameters and running files corresponding to the target device.

[0095] An establishment module is configured to establish a running environment in the hardware chip according to the environment parameters.

[0096] A running module is configured to execute the running files in the running environment, so that the hardware chip simulates the working behavior of the target device.

[0097] The hardware chip is provided with a firewall, and the firewall is provided with a target vulnerability.

[0098] In addition, although the steps of the method in the present application are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in this specific order or that all the steps shown must be performed to achieve the desired result. Additionally or alternatively, some steps can be omitted, a plurality of steps can be combined into one step, and / or one step can be divided into a plurality of steps, and the like.

[0099] Those skilled in the art can easily understand from the above description of the embodiments that the example embodiments described herein can be implemented by software or by software in combination with necessary hardware. Therefore, the technical solutions according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash disk, a mobile hard disk, etc.) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to perform the methods according to the embodiments of the present application.

[0100] Reference is made to Figure 3 According to an aspect of the present application, a hardware chip is provided for performing the steps of any of the above methods.

[0101] According to an aspect of the present application, an electronic device is provided, which includes a hardware chip for performing the steps of any of the above methods.

[0102] The electronic device according to this embodiment of the present application. The electronic device is merely an example and should not limit the function and use range of the embodiments of the present application.

[0103] The electronic device is in the form of a general computing device. The components of the electronic device can include, but are not limited to, the above-mentioned at least one processor, the above-mentioned at least one storage, and a bus connecting different system components, including the storage and the processor.

[0104] The storage stores program codes that can be executed by the processor, so that the processor performs the steps according to various example embodiments of the present application described in the above "example method" section of the present specification.

[0105] The storage can include a readable medium in the form of a volatile storage, such as a random access memory (RAM) and / or a cache memory, and can further include a read-only memory (ROM).

[0106] The storage can further include programs / utilities with a set of (at least one) program modules, such as an operating system, one or more application programs, other program modules, and program data, each of which or some combination of which can include the implementation of a network environment.

[0107] The bus can be one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of a variety of bus structures.

[0108] The electronic device can also communicate with one or more external devices such as a keyboard or a pointing device, through an I / O interface. The electronic device can communicate with one or more devices that enable a user to interact with it (e.g., a display device), and / or one or more devices (e.g., a router, a modem, a server, etc.) that enable the electronic device to communicate with one or more other computing devices. Such communication can occur via an I / O interface. Still yet, the electronic device can communicate with one or more networks (such as one or more LANs, WANs, and / or the Internet) through a network adapter. It should be appreciated that the network adapter can also be connected to one or more of the other buses of the electronic device, such as the bus of the electronic device. As will be appreciated, a wireless network adapter might also be used along with a modem to facilitate communication with one or more other computing devices or networks. The wireless network adapter might be integrated with the modem, or it might be a separate device.

[0109] Those skilled in the art will readily understand that the example embodiments described herein can be implemented by software and / or by software in combination with the requisite hardware. Thus, the technical solutions of the embodiments of the present application can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash disk, a mobile hard disk, or the like) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to perform the methods according to the embodiments of the present application.

[0110] In the example embodiments of the present application, a computer readable storage medium is also provided, which stores the program product capable of implementing the above-mentioned method of the present application. In some possible embodiments, various aspects of the present application can also be implemented in the form of a program product, which includes program codes for causing the terminal device to perform the steps according to various example embodiments of the present application described in the above-mentioned “example method” section of the present specification when the program product is run on the terminal device.

[0111] The program product can employ any combination of one or more computer-readable media. The computer-readable media can be a computer-readable storage medium or a computer-readable signal medium. The computer-readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium include the following: an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0112] The computer-readable signal medium can include a computer-readable storage medium that is propagated as a carrier wave. The computer-readable signal medium can further be any computer-readable medium that is not a storage medium. The computer-readable signal medium can be a computer-readable storage medium that is a propagated signal on a computer-readable storage medium.

[0113] The program code embodied on the computer-readable media can be transmitted using any appropriate medium, including but not limited to wireless, wired, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0114] The program code can be executed by one or more programmable processors, which can be implemented in one or more computer systems. In this context, a computer system generally includes a plurality of these programmable processors working in concert to perform a task. These computer systems can be specially constructed for the required purposes, or it can comprise one or more general-purpose computers. The program code can be stored on any suitable computer readable medium, including a floppy disk, a CD-ROM, a hard disk drive, a solid state drive, a DVD, a Blu-ray disk, a magnetic tape, a magnetic drum, a ROM, a PROM, an EPROM, an EEPROM, a solid state memory, a magnetic card, an optical card, an optical storage device, a memory chip, a cassette, or any other suitable device. The program code can also be downloaded from an Internet location. Furthermore, the program code can be implemented in a subset of the program code, or in a plurality of separate, but interoperable, program codes.

[0115] In addition, the above-described flowcharts are merely illustrative of the processes included in the method according to the exemplary embodiments of the present application, and are not intended to limit the purpose. It is easily understood that the processes shown in the above-described flowcharts do not indicate or limit the time sequence of the processes. In addition, it is easily understood that the processes can be executed synchronously or asynchronously, for example, in a plurality of modules.

[0116] It should be noted that, although several modules or units of the devices for action execution are mentioned in the above detailed description, such division into modules or units is not mandatory. Indeed, according to an embodiment of the application, the features and functionalities of two or more of the above-described modules or units can be embodied in a single module or unit. Conversely, the features and functionalities of one of the above-described modules or units can be further divided into several modules or units.

[0117] The above description is merely that of a specific implementation of the present application, but the protection scope of the present application is not limited thereto, and any changes or replacements that can be easily thought of by those skilled in the art within the technical scope disclosed by the present application shall be encompassed within the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A device behavior simulation method characterized by, The application is applied to a hardware chip used for simulating working behavior of a target device. The method comprises: acquiring environment parameters and running files corresponding to the target device; establishing a running environment in the hardware chip according to the environment parameters; in the running environment, executing the running files to make the hardware chip simulate the working behavior of the target device; the establishment of the running environment in the hardware chip according to the environment parameters comprises: determining at least one original data exchange interface of the target device according to the environment parameters; determining a target data exchange interface corresponding to each original data exchange interface, the target data exchange interface being a physical interface of the hardware chip; configuring the target data exchange interface to make the target data exchange interface be able to execute the same function of the corresponding original data exchange interface.

2. The device behavior simulation method according to claim 1, characterized by, The running environment comprises an operating system. The method further comprises: determining a memory address set corresponding to the operating system; directly accessing the physical memory corresponding to the operating system according to the memory address set to acquire running information of the operating system.

3. The device behavior simulation method according to claim 2, wherein The method further comprises: determining abnormal data in the running information; continuously monitoring data sent by a data source corresponding to the abnormal data.

4. The device behavior simulation method according to claim 1, characterized by, The hardware chip is provided with a firewall, the firewall is provided with a target vulnerability, and the target vulnerability has a corresponding calling interface. The method further comprises: capturing data packets received by the calling interface.

5. The device behavior simulation method according to claim 1, characterized by, The method further comprises: receiving a reset instruction to reset the running environment.

6. The device behavior simulation method according to claim 1, wherein The target device has an upstream device and a downstream device in communication connection therewith; The hardware chip is connected with the upstream device and the downstream device; The hardware chip can receive input information sent by the upstream device and process the input information according to the running files to obtain output information; The output information is used for sending to the downstream device, and the output information is configured not to be responded by the downstream device.

7. An apparatus behavior simulation device, characterized by, The application is applied to a hardware chip used for simulating working behavior of a target device. The device comprises: an acquisition module for acquiring environment parameters and running files corresponding to the target device; an establishment module for establishing a running environment in the hardware chip according to the environment parameters; a running module for executing the running files in the running environment to make the hardware chip simulate the working behavior of the target device; the establishment of the running environment in the hardware chip according to the environment parameters comprises: determining at least one original data exchange interface of the target device according to the environment parameters; determining a target data exchange interface corresponding to each original data exchange interface, the target data exchange interface being a physical interface of the hardware chip; configuring the target data exchange interface to make the target data exchange interface be able to execute the same function of the corresponding original data exchange interface.

8. A hardware chip, characterized by The hardware chip is used for executing steps of the method according to any one of claims 1 to 6.

9. An electronic device, comprising: The electronic device comprises a hardware chip for performing the steps of the method according to any one of claims 1 to 6.

Citation Information

Patent Citations

  • Dynamic behavioral analysis method, device, system, and apparatus

    WO2018019010A1