Instruction monitoring device, instruction monitoring method, chip, apparatus, and medium

Abstract

The present disclosure provides an instruction monitoring device, an instruction monitoring method, a chip, an equipment and a medium, wherein the method comprises: obtaining a target task executed by an operation unit at a current time; wherein the target task comprises at least one target instruction; determining task execution information of the target task; wherein the task execution information is used to indicate an instruction operation characteristic of the target instruction comprised in the target task; in a case where it is determined based on the task execution information that an operation performed by the target instruction in the target task is a preset hash operation, it is determined that an illegal intrusion hash operation instruction is detected.

Description

Technical Field

[0001] This disclosure relates to the field of chip technology, and more specifically, to an instruction monitoring device, instruction monitoring method, chip, equipment, and medium. Background Technology

[0002] In the field of integrated circuit (IC) technology, ICs are widely used due to their powerful parallel computing capabilities. For example, their powerful parallel computing capabilities can be used for hash calculations. However, in order to save on hardware procurement and electricity costs, some users illegally intrude into other people's hosts and use the computing resources of these unauthorized hosts to perform their own hash calculations. This phenomenon consumes the computing resources of the compromised host, thereby harming the legitimate rights and interests of the compromised party, and also easily leads to the leakage of relevant resources on the compromised host. Therefore, how to effectively and quickly detect hash calculation intrusions has become an urgent problem to be solved. Summary of the Invention

[0003] This disclosure provides at least one instruction monitoring device, instruction monitoring method, chip, equipment, and medium.

[0004] In a first aspect, embodiments of this disclosure provide an instruction monitoring device, comprising: a control unit, configured to acquire a target task executed by a computing unit at a current time; wherein the target task includes at least one target instruction; and to determine task execution information of the target task; wherein the task execution information is used to indicate the instruction operation characteristics of the target instruction included in the target task; and, if it is determined based on the task execution information that the operation performed by the target instruction in the target task is a preset hash operation, to determine that an illegal intrusion hash operation instruction has been detected.

[0005] In the above embodiments, the operations performed by the chip can be detected in real time based on task execution information. If the operation performed by the chip is a preset hash operation, it can be determined that the chip has been illegally invaded, thereby improving the effectiveness and efficiency of chip intrusion detection and further enhancing chip security.

[0006] In an optional implementation, the control unit is further configured to: acquire sub-operation features of the target instruction under each preset operation feature dimension, and obtain at least one sub-operation feature; wherein the at least one sub-operation feature is used to indicate at least one of the following: instruction execution duration, the number of threads executing the target instruction in the operation unit, and the instruction content of the target instruction; and determine the instruction operation features of the target instruction based on the at least one sub-operation feature to obtain the task execution information.

[0007] In the above embodiments, the control unit can obtain more accurate and comprehensive task execution information by acquiring at least one sub-operation feature of the target instruction under a preset operation feature dimension, and determining the instruction operation feature of the target task based on the at least one sub-operation feature. This can improve the accuracy of determining the operation type of the target instruction based on the task execution information, and thus improve the monitoring accuracy of the instruction monitoring device.

[0008] In an optional implementation, the control unit is further configured to: determine feature quantization sub-information for each of the sub-operation features to obtain at least one feature quantization sub-information, wherein each feature quantization sub-information is used to indicate the degree of sub-matching between the operation performed by the target instruction in the target task and the preset hash operation under the preset operation feature dimension corresponding to the sub-operation feature; and, if it is determined that the at least one feature quantization sub-information satisfies the preset quantization requirement, determine that the operation performed by the target instruction in the target task is the preset hash operation.

[0009] In the above embodiments, the control unit can determine the degree of sub-matching between the operation performed by the target instruction and the preset hash operation from each preset operation feature dimension. Then, the control unit can further determine that the operation performed by the target instruction is the preset hash operation based on each sub-matching degree. This processing method allows for a more comprehensive verification of the operation performed by the target instruction, thereby improving the accuracy of the verification.

[0010] In an optional implementation, the control unit is further configured to: determine the quantization weight corresponding to each of the feature quantization sub-informations; and perform a weighted summation on the at least one feature quantization sub-information based on the quantization weight to obtain a weighted summation result; and if the weighted summation result is greater than or equal to a first threshold, determine that the at least one feature quantization sub-information satisfies the preset quantization requirement.

[0011] In the above embodiments, the control unit can set a corresponding quantization weight for each feature quantization sub-information, so that during the process of checking the operation executed by the target instruction, more attention is paid to the feature quantization sub-information with higher feature priority, thereby improving the inspection accuracy of the operation executed by the target instruction and obtaining more accurate intrusion detection results.

[0012] In an optional implementation, the control unit is further configured to: sum the at least one feature quantization sub-information to obtain a summation result; and determine that the at least one feature quantization sub-information satisfies the preset quantization requirement if the summation result is greater than or equal to a second threshold.

[0013] In the above embodiments, the control unit can more comprehensively integrate each feature quantization sub-information by summing up each feature quantization sub-information, thereby more accurately determining the relationship between at least one feature quantization sub-information and the preset quantization requirements.

[0014] In an optional implementation, the control unit is further configured to: determine feature quantization information of the target task based on the task execution information; the feature quantization information is used to indicate the degree of matching between the operation performed by the target instruction in the target task and the preset hash operation; and, if the feature quantization information satisfies the preset quantization requirements, determine that the operation corresponding to the target task is the preset hash operation.

[0015] In the above embodiments, the control unit can determine the feature quantization information of the target task through task execution information. Then, if the feature quantization information meets the preset quantization requirements, the control unit can determine that the operation corresponding to the target task is a preset hash operation. By quantifying the task execution information to obtain feature quantization information, and by detecting the preset hash operation based on the feature quantization information, the control unit can more accurately detect whether the operation performed by the chip's computing unit is a preset hash operation, thereby improving the detection accuracy of the preset hash operation and reducing the false positive rate.

[0016] In an optional implementation, the control unit is further configured to: acquire a sample instruction database; the sample instruction database contains preset instruction operation features of hash operation instructions that perform the preset hash operation; and determine the degree of matching between the instruction operation features indicated by the task execution information and the preset instruction operation features in the sample instruction database, and determine the feature quantification information of the target task based on the degree of matching.

[0017] In the above embodiments, the control unit can determine the degree of matching between the instruction operation features indicated by the task execution information and the preset instruction operation features in the sample instruction database through the sample instruction database, thereby accurately and efficiently determining the feature quantification information of the target task and improving the efficiency of intrusion detection.

[0018] In an optional implementation, the control unit is further configured to: record the instruction operation characteristics of the hash operation instruction executed by the computing unit within a preset recording time period when a target triggering event is detected; and save the instruction operation characteristics of the hash operation instruction as preset instruction operation characteristics of the hash operation instruction to the sample instruction database.

[0019] In the above embodiments, after detecting a target triggering event, the control unit can record the instruction operation characteristics of the hash operation performed by the computing unit and save the instruction operation characteristics to the sample instruction database, thereby continuously enriching the sample instruction database, improving the scope of intrusion detection, and thus improving the effectiveness of intrusion detection.

[0020] In an optional implementation, the control unit is further configured to: after determining that an illegal intrusion hash operation instruction has been detected, generate intrusion warning information and / or task end signal, wherein the intrusion warning information is used to indicate that an intrusion operation has been detected, and the task end signal is used to control the operation unit to end the execution of the target task.

[0021] In the above embodiments, the control unit can generate intrusion warning information after detecting a hash operation command for unauthorized intrusion, thereby promptly reminding staff to investigate. Simultaneously, it can also generate a task completion signal to terminate the target task in a timely manner, thus saving equipment and power resources.

[0022] Secondly, embodiments of this disclosure provide an instruction monitoring method, comprising: acquiring a target task executed by a computing unit at a current time; wherein the target task includes at least one target instruction; determining task execution information of the target task; wherein the task execution information is used to indicate the instruction operation characteristics of the target instruction included in the target task; and determining that an illegal intrusion hash operation instruction has been detected when the operation performed by the target instruction in the target task is a preset hash operation based on the task execution information.

[0023] Thirdly, embodiments of this disclosure also provide a chip, characterized in that it includes an instruction monitoring unit as described in any of the preceding claims.

[0024] Fourthly, embodiments of this disclosure also provide an electronic device, including: a processing unit, a storage unit, and a bus. The storage unit stores machine-readable instructions executable by the processing unit. When the electronic device is running, the processing unit communicates with the storage unit via the bus. When the machine-readable instructions are executed by the processing unit, the steps of the first aspect described above, or any possible implementation of the first aspect, are executed, or the steps of the second aspect described above are executed, or the chip described in the third aspect described above is executed.

[0025] Fifthly, embodiments of this disclosure also provide a computer-readable storage medium storing a computer program, which, when run by a processing unit, performs the steps of the first aspect described above, or any possible implementation of the first aspect, or performs the steps of the second aspect described above.

[0026] To make the above-mentioned objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0027] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings used in the embodiments will be briefly described below. These drawings are incorporated in and constitute a part of this specification. They illustrate embodiments conforming to this disclosure and, together with the specification, serve to explain the technical solutions of this disclosure. It should be understood that the following drawings only show some embodiments of this disclosure and should not be considered as limiting the scope. Those skilled in the art can obtain other related drawings based on these drawings without creative effort.

[0028] Figure 1 A flowchart of an instruction monitoring method provided by an embodiment of this disclosure is shown;

[0029] Figure 2 The flowchart illustrates a method for determining, based on task execution information, that the operation performed by the target instruction in a target task is a preset hash operation, according to an embodiment of this disclosure.

[0030] Figure 3 A flowchart is shown below illustrating a method for determining feature quantification information of a target task based on task execution information, as provided in an embodiment of this disclosure.

[0031] Figure 4 A flowchart is shown, illustrating another method for determining feature quantification information of a target task based on task execution information provided in an embodiment of this disclosure;

[0032] Figure 5 A flowchart of a method for determining task execution information of a target task provided in an embodiment of this disclosure is shown;

[0033] Figure 6 A schematic diagram of an instruction monitoring device provided in an embodiment of this disclosure is shown;

[0034] Figure 7 A schematic diagram of an electronic device provided in an embodiment of this disclosure is shown. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. The components of the embodiments of this disclosure described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this disclosure provided in the accompanying drawings is not intended to limit the scope of the claimed disclosure, but merely represents selected embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0036] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0037] In this document, the term "and / or" merely describes a relationship, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0038] Research has revealed a phenomenon where, in order to save on hardware and electricity costs, attackers illegally intrude into other users' hosts and exploit the host's computing resources to perform hash calculations. This consumes the host's computing resources, thereby harming the legitimate rights and interests of the compromised party, and also easily leads to the leakage of relevant resources on the compromised host. Therefore, how to effectively and quickly detect hash calculation intrusions has become an urgent problem to be solved.

[0039] Based on the above research, this disclosure provides an instruction monitoring device, instruction monitoring method, chip, device, and medium. In the embodiments of this disclosure, firstly, the target task executed by the chip's arithmetic unit at the current moment can be obtained, and the task execution information of the target task can be determined. Here, the task execution information is used to indicate the instruction operation characteristics of the target instructions contained in the target task. Then, based on the task execution information, it can be determined whether the operation performed by the target instruction in the target task is a preset hash operation. If it is determined to be a preset hash operation, an illegally intruded hash operation instruction is detected. Through the above processing method, the hash operation executed by the chip can be detected in real time based on the task execution information, and then the chip can be determined to have been illegally intruded based on the detected hash operation. This improves the effectiveness and efficiency of chip intrusion detection and further enhances chip security.

[0040] To facilitate understanding of this embodiment, a detailed description of the instruction monitoring method disclosed in this disclosure embodiment will be provided first. The execution subject of the instruction monitoring method provided in this disclosure embodiment is generally an electronic device with a certain computing capability.

[0041] It should be noted that the instruction monitoring method disclosed in this embodiment can be implemented in the SoC (System on Chip) of the chip as program code, or it can be implemented in the hardware intellectual property core (IPcore) of the chip as hardware.

[0042] See Figure 1 The diagram shows a flowchart of an instruction monitoring method provided in an embodiment of this disclosure. The method includes steps S101 to S105, wherein:

[0043] S101: Obtain the target task being executed by the arithmetic unit at the current moment; wherein the target task includes at least one target instruction.

[0044] Here, the aforementioned computing unit can be understood as a unit set in a chip for performing computing tasks. The chip can be a GPU (Graphics Processing Unit) or an ASIC (Application Specific Integrated Circuit). This disclosure does not specifically limit the type of chip, but rather follows the actual needs.

[0045] In this embodiment, a monitoring module can be pre-configured in the chip. This monitoring module can be program code written into the SoC (System-on-a-Chip) or a hardware IP core of the chip. Here, the monitoring module in the chip can achieve linkage with the task distribution module in the chip. The specific linkage process can be described as follows:

[0046] After the chip's computing unit obtains the target task distributed by the task distribution module, the chip's monitoring module can obtain the target task and execute steps S103 to S105.

[0047] Here, the target task includes at least one target instruction. At this point, the task distribution module in the chip can distribute at least one instruction of the target task to the processing unit. Then, after detecting the task distribution operation of the task distribution module, the chip's monitoring unit can obtain the instruction of the task corresponding to that task distribution operation, i.e., at least one target instruction of the target task.

[0048] S103: Determine the task execution information of the target task; wherein, the task execution information is used to indicate the instruction operation characteristics of the target instructions contained in the target task.

[0049] In this embodiment of the disclosure, after obtaining the target task being executed by the chip's arithmetic unit at the current moment, the task execution information of the target task can be determined, so as to determine the instruction operation characteristics of the target instructions contained in the target task through the task execution information.

[0050] Here, the instruction operation characteristics of the target instruction can correspond to multiple sub-operation characteristics of preset operation characteristic dimensions. For each preset operation characteristic dimension, there can be at least one sub-operation characteristic. For example, these multiple preset operation characteristic dimensions can be the following dimensions: operation time dimension, operation space dimension, and operation content dimension.

[0051] In the computation time dimension, the instruction operation characteristics of the aforementioned target instruction (i.e., sub-operation characteristics in the computation time dimension) can be used to indicate the instruction execution duration of the aforementioned target instruction. In the computation space dimension, the instruction operation characteristics of the aforementioned target instruction (i.e., sub-operation characteristics in the computation space dimension) can be used to indicate the number of threads in the chip executing the aforementioned target instruction. In the computation content dimension, the instruction operation characteristics of the aforementioned target instruction (i.e., sub-operation characteristics in the computation content dimension) can be used to indicate the instruction content characteristics of executing the aforementioned target instruction.

[0052] At this point, the task execution information of the target task can be determined based on the sub-operation features under the aforementioned multiple preset operation feature dimensions. For example, the sub-operation features under the aforementioned multiple preset operation feature dimensions can be summarized, and the task execution information of the target task can be determined based on the summarized results.

[0053] S105: If, based on the task execution information, it is determined that the operation performed by the target instruction in the target task is a preset hash operation, an illegal intrusion hash operation instruction is detected.

[0054] Here, the preset hash operation can be a known illegal intrusion hash operation, and / or other operations with a similar calculation method to the known illegal intrusion hash operation. The other operations with a similar calculation method to the known illegal intrusion hash operation can also be understood as operations that repeatedly perform a specific calculation.

[0055] For example, a preset hash operation can be performed as follows: Assuming there is data to be processed, such as a 32-bit number, perform a 6-bit, 11-bit, and 25-bit circular right shift on the 32-bit number, resulting in three circular right shift results. Then, perform an XOR operation on each of these three circular right shift results to obtain the final calculation result. For example, if the circular right shift result after performing a 6-bit circular right shift is result 1, the result after performing an 11-bit circular right shift is result 2, and the result after performing a 25-bit circular right shift is result 3, then first perform an XOR operation on result 1 and result 2 to obtain result 4. Then, perform an XOR operation on result 3 and result 4 to obtain result 5, and this result 5 is determined as the final calculation result of the preset hash operation.

[0056] In this embodiment of the disclosure, after determining the task execution information of the target task, the operation type of at least one target instruction in the target task can be determined based on the task execution information. If the operation type is determined to be a preset hash operation, an illegal intrusion hash operation instruction is detected, that is, an intrusion operation targeting the chip is detected.

[0057] In this embodiment of the disclosure, the above processing method can realize the real-time detection of hash operations performed by the chip based on task execution information, and then determine whether the chip has been illegally invaded based on the detected hash operations, thereby improving the effectiveness and efficiency of chip intrusion detection and further improving chip security.

[0058] In one alternative implementation, such as Figure 2As shown, for S105: determining that the operation performed by the target instruction in the target task is a preset hash operation based on the task execution information specifically includes the following steps:

[0059] Step S21: Determine the feature quantization information of the target task based on the task execution information; the feature quantization information is used to indicate the degree of matching between the operation performed by the target instruction in the target task and the preset hash operation;

[0060] Step S22: If the feature quantization information meets the preset quantization requirements, determine that the operation corresponding to the target task is the preset hash operation.

[0061] In this embodiment of the disclosure, when it is determined from the task execution information that the operation performed by the target instruction in the target task is a preset hash operation, the feature quantization information of the target task can be determined first based on the task execution information. If the feature quantization information meets the preset quantization requirements, then the operation corresponding to the target task is determined to be a preset hash operation.

[0062] Here, the feature quantification information can be a quantified numerical value, which indicates the degree of matching between the operation performed by the target instruction in the target task and the preset hash operation. This degree of matching can be represented by a matching degree value. For example, the matching degree value corresponding to the above matching degree can be 0, 0.4, or 0.9. This disclosure does not limit the above matching degree value; the matching degree value corresponding to the degree of matching between the operation performed by the target instruction in the actual target task and the preset hash operation is the standard. Furthermore, this matching degree can also be understood as the similarity between the operation performed by the target instruction and the preset hash operation.

[0063] As described above, task execution information can be used to indicate the instruction operation characteristics of the target instruction, and the feature quantification information determined based on this task execution information can be used to indicate the degree of matching between the operation performed by the target instruction and the preset hash operation. Therefore, the above can also be understood as: the degree of matching (i.e., feature quantification information) between the operation performed by the target instruction and the preset hash operation in the target task can be determined by the instruction operation characteristics of the target instruction.

[0064] In practice, the instruction operation characteristics of the hash operation instruction that performs the preset hash operation can be obtained, denoted as instruction operation characteristic 1. Then, the instruction operation characteristics of the target instruction can be obtained, denoted as instruction operation characteristic 2. Next, the degree of matching between instruction operation characteristic 1 and instruction operation characteristic 2 can be determined, and then this degree of matching can be determined as the aforementioned feature quantification information.

[0065] As described above, the instruction operation features of the target instruction can correspond to multiple sub-operation features of preset operation feature dimensions. In this case, the degree of matching between the operation performed by the target instruction in the target task and the preset hash operation can be determined based on each sub-operation feature. For example, each sub-operation feature can be compared with the matching sub-operation features in instruction operation feature 1 to obtain the corresponding feature quantization sub-information. For each sub-operation feature, a corresponding feature quantization sub-information can be obtained. Next, the feature quantization information can be determined based on each feature quantization sub-information.

[0066] For example, assuming there are multiple preset operation feature dimensions, including operation time dimension, operation space dimension, and operation content dimension, the sub-operation features under each preset operation feature dimension can be matched with the sub-operation features that match the dimensions in instruction operation feature 1 to obtain the degree of matching between the sub-operation features under that dimension and the preset hash operation (this degree of matching corresponds to the feature quantization sub-information mentioned above), thereby obtaining multiple degree of matching; then, the feature quantization information of the target task can be determined based on the multiple degree of matching.

[0067] In this embodiment of the disclosure, the matching order of the above-mentioned multiple preset operational feature dimensions can be determined. For example, the matching order can be determined according to the priority of each preset operational feature dimension. For example, the matching order can be: first, match the operational content dimension, and if it is determined that the sub-operational features under the operational content dimension match the preset hash operation, then match the operational space dimension, and if it is determined that the sub-operational features under the operational space match the preset hash operation, finally match the operational time dimension. For each of the above matching processes, a corresponding matching result can be obtained, namely the matching degree (or, feature quantization sub-information).

[0068] Continuing the previous example, regarding the dimension of computational content, when the sub-computation features under this dimension match the preset hash operation, a numerical value representing the degree of matching (i.e., the matching degree value) can be obtained. Matching the sub-computation features under the computational content dimension with the preset hash operation can be understood as the instruction content of the target instruction being the same as or corresponding to the instruction content of the hash operation instruction executing the preset hash operation. In this case, the matching degree value between the sub-computation features under the computational content dimension and the preset hash operation (i.e., the aforementioned feature quantification sub-information) can be set to 0.4. Besides this, the matching degree value can also be other values, such as 0.5. This disclosure does not limit this matching degree value; it is based on actual needs. When the instruction content of the target instruction is different from or does not correspond to the instruction content of the instruction corresponding to the preset hash operation, it can be determined that the sub-computation features under the computational content dimension do not match the preset hash operation. In this case, the matching degree value between the sub-computation features under the computational content dimension and the preset hash operation can be set to 0.

[0069] It should be noted that when a sub-operation feature matches a preset hash operation, the matching degree value between the sub-operation feature and the preset hash operation can be a value preset by the operator, or it can be a value adjusted by the operator after detecting an unauthorized hash operation instruction on the chip in response to the unauthorized intrusion. This disclosure does not specifically limit the matching degree value between the sub-operation feature and the preset hash operation; the achievable value shall prevail.

[0070] If a sub-operation feature in the computation content dimension matches a preset hash operation, then the sub-operation feature in the computation space dimension can be matched with the preset hash operation. Assume the total number of threads in the chip is N (where N is a natural number greater than 1). If the number of threads executing the target instruction is M, then the matching degree between the sub-operation feature in the computation space dimension and the preset hash operation can be determined to be M / N. Furthermore, if M / N is greater than a preset thread threshold (e.g., 0.5), the matching degree corresponding to the degree of matching between the sub-operation feature in the computation space dimension and the preset hash operation can be determined to be a fixed value, such as 0.7. If M / N is less than or equal to the preset thread threshold (e.g., 0.5), the matching degree between the sub-operation feature in the computation space dimension and the preset hash operation can be determined to be the matching degree value determined above based on the computation content dimension, for example, 0.4.

[0071] After matching instruction operation features with preset hash operations based on the computation space and computation content dimensions, the sub-operation features under the computation time dimension can also be matched with preset hash operations. For example, after determining that the corresponding sub-operation features match the preset hash operations under the computation space and computation content dimensions, the execution duration of the target instruction can be obtained, and the degree of matching between the sub-operation features under the computation time dimension and the preset hash operations can be determined based on this execution duration. For example, if the instruction execution duration is greater than or equal to a preset duration threshold, the matching degree between the sub-operation features under the computation time dimension and the preset hash operations can be set to 0.9; if the instruction execution duration is less than the preset duration threshold, the matching degree between the sub-operation features under the computation time dimension and the preset hash operations can be set to the matching degree value determined above based on the computation space dimension, such as M / N, 0.7, or 0.4.

[0072] In this embodiment of the disclosure, if the feature quantization information (or the aforementioned matching degree value) is greater than or equal to a preset quantization threshold, it can be determined that the feature quantization information meets the preset quantization requirements. For example, if the preset quantization threshold is 0.8, and the feature quantization information is 0.9, it is determined that the feature quantization information meets the preset quantization requirements, and the operation corresponding to the target task is determined to be a preset hash operation; if the feature quantization information is 0.4, it is determined that the feature quantization information does not meet the preset quantization requirements, and the operation corresponding to the target task is determined to be not a preset hash operation.

[0073] In the above embodiments, the feature quantization information of the target task can be determined through task execution information, and if the feature quantization information meets the preset quantization requirements, the operation corresponding to the target task is determined to be a preset hash operation. By quantifying the task execution information to obtain feature quantization information, and then detecting the preset hash operation based on the feature quantization information, it is possible to more accurately detect whether the operation performed by the chip's computing unit is a preset hash operation, thereby improving the detection accuracy of the preset hash operation and reducing the false positive rate.

[0074] In one alternative implementation, such as Figure 3 As shown, regarding step S21 above: determining the feature quantification information of the target task based on the task execution information, the following steps are also included:

[0075] Step S31: Obtain the sample instruction database; the sample instruction database contains preset instruction operation features of hash operation instructions that perform the preset hash operation;

[0076] Step S32: Determine the degree of matching between the instruction operation features indicated by the task execution information and the preset instruction operation features in the sample instruction database, and determine the feature quantification information of the target task based on the degree of matching.

[0077] In this embodiment of the disclosure, as described above, since task execution information is used to indicate the instruction operation characteristics of the target instruction contained in the target task, the instruction operation characteristics of the target instruction can be determined based on the task execution information, and then the feature quantification information of the target task can be determined based on the degree of matching between the instruction operation characteristics of the target instruction and the preset hash operation characteristics.

[0078] In practice, a sample instruction database can be obtained first, and the preset instruction operation characteristics of hash operation instructions that perform preset hash operations can be determined from the sample instruction database. Then, the instruction operation characteristics of the target instruction are matched with the preset instruction operation characteristics to obtain the degree of matching between the instruction operation characteristics of the target instruction and the preset instruction operation characteristics, and the feature quantification information of the target task is determined based on the degree of matching.

[0079] The sample instruction database can contain multiple preset instruction operation features. In this case, the instruction operation features of the target instruction can be matched with each preset instruction operation feature to obtain the degree of matching between the target instruction's instruction operation features and each preset instruction operation feature. For each degree of matching, feature quantification information of the target task can be determined. This feature quantification information indicates the degree of matching between the target instruction and the hash operation instruction that performs the corresponding preset hash operation.

[0080] As described above, the instruction operation features of a target instruction can correspond to multiple sub-operation features of preset operation feature dimensions, and the preset instruction operation features in the sample instruction database can also correspond to multiple preset operation feature dimensions. Based on this, the sub-operation features corresponding to each preset operation dimension in the instruction operation features of the target instruction can be matched with the preset instruction operation features of the same dimension in the preset instruction operation features to obtain the corresponding feature quantization sub-information. Then, the degree of matching between the instruction operation features of the target instruction and each preset instruction operation feature can be determined by combining the feature quantization sub-information corresponding to each preset operation dimension, thereby obtaining the corresponding feature quantization information.

[0081] In the above embodiments, by determining the degree of matching between the instruction operation features indicated by the task execution information and the preset instruction operation features in the sample instruction database, the feature quantification information of the target task can be accurately and efficiently determined, thereby improving the efficiency of intrusion detection.

[0082] In one alternative implementation, such as Figure 4 As shown, in Figure 3 Based on the corresponding embodiments, the method disclosed herein further includes the following steps:

[0083] Step S41: When a target triggering event is detected, record the instruction operation characteristics of the hash operation instruction executed by the computing unit within a preset recording time period;

[0084] Step S42: Save the instruction operation characteristics of the hash operation instruction as the preset instruction operation characteristics of the hash operation instruction to the sample instruction database.

[0085] In this embodiment, the target triggering event can be understood as an event triggered when the chip's computing unit is in an abnormal operating state. Specifically, a detection program can be built into the chip to detect abnormal operating states of the chip's computing unit, and generate a target triggering event upon detection of an abnormal operating state. Afterwards, the chip's monitoring module, upon receiving the target triggering event, can execute the steps described in S101 to S105 above.

[0086] For example, if it is detected that no corresponding task has been assigned to the chip's computing unit at the current moment, but the chip's computing unit is in a task execution state, it can be determined that the chip's computing unit is in an abnormal operating state, and in this case, it can be determined that a target trigger event has been detected. As another example, if it is detected that the task being executed by the chip's computing unit is different from the task assigned to the chip's computing unit, it can also be determined that the chip's computing unit is in an abnormal operating state, and in this case, it can be determined that a target trigger event has been detected.

[0087] In this embodiment of the disclosure, the preset recording time period can be used to indicate the preset recording start and end times, wherein the preset recording time period includes the preset recording start time and recording duration, or includes the preset recording start time and recording end time.

[0088] For example, the recording start time in the preset recording time period can be the moment when the target trigger event is detected, or it can be a moment after the moment when the target trigger event is detected.

[0089] In this embodiment of the disclosure, after detecting a target triggering event, it can be determined that the task being executed by the chip's arithmetic unit at the current moment is not the expected task (e.g., a task assigned by staff), and it can be determined that an intrusion operation targeting the chip has been detected. At this time, a recording function can be activated to start recording the instruction operation characteristics of the instructions executed by the arithmetic unit. Subsequently, the recorded instruction operation characteristics can be saved as preset instruction operation characteristics of hash operation instructions to the sample instruction database. When a hash operation instruction with the same instruction operation characteristics is detected again, it can be automatically determined that an intrusion operation targeting the chip has been detected.

[0090] In the above embodiments, after a target triggering event is detected, the instruction operation characteristics of the hash operation performed by the computing unit can be recorded and saved to the sample instruction database. This can continuously enrich the sample instruction database, thereby increasing the scope of intrusion detection and thus improving the effectiveness of intrusion detection.

[0091] In one alternative implementation, such as Figure 5 As shown, for S103: determining the task execution information of the target task specifically includes the following steps:

[0092] Step S51: Obtain the sub-operation features of the target instruction under each preset operation feature dimension to obtain at least one sub-operation feature; wherein, the at least one sub-operation feature is used to indicate at least one of the following: instruction execution time, the number of threads executing the target instruction in the operation unit, and the instruction content of the target instruction;

[0093] Step S52: Determine the instruction operation characteristics of the target instruction based on the at least one sub-operation characteristic to obtain the task execution information.

[0094] In this embodiment, the preset computational feature dimensions may include at least the following dimensions: computation time dimension, computation space dimension, and computation content dimension. Detailed descriptions of the computation time dimension, computation space dimension, and computation content dimension are provided in the above embodiments; therefore, a detailed description of each of the preset computational feature dimensions will not be repeated here.

[0095] In this embodiment of the disclosure, each preset operation feature dimension can include corresponding sub-operation features in the instruction operation features of the target instruction. For example, when the preset operation feature dimension is the operation time dimension, the sub-operation feature of the target instruction under the preset operation feature dimension can be obtained as the instruction execution duration; when the preset operation feature dimension is the operation space dimension, the sub-operation feature of the target instruction under the preset operation feature dimension can be obtained as the number of threads executing the target instruction in the chip's operation unit; when the preset operation feature dimension is the operation content dimension, the sub-operation feature of the target instruction under the preset operation feature dimension can be obtained as the instruction content of the target instruction.

[0096] In this embodiment of the disclosure, the instruction operation characteristics of the target instruction can be determined based on at least one acquired sub-operation characteristics. For example, at least one sub-operation characteristic can be summarized, and the summarized result can be determined as the instruction operation characteristics of the target instruction, thereby obtaining the task execution information of the target task based on the instruction operation characteristics.

[0097] In the above embodiments, by obtaining at least one sub-operation feature of the target instruction under a preset operation feature dimension, and determining the task execution information based on the instruction operation feature of the target task, more accurate and comprehensive task execution information can be obtained. This can improve the accuracy of determining the operation type of the target instruction based on the task execution information, and thus improve the monitoring accuracy of the instruction monitoring method.

[0098] In an optional implementation, based on steps S51 to S52, regarding S105: determining that the operation performed by the target instruction in the target task is a preset hash operation based on the task execution information specifically includes the following steps:

[0099] Step S61: Determine the feature quantization sub-information of each of the sub-operation features to obtain at least one feature quantization sub-information, wherein each feature quantization sub-information is used to indicate the degree of sub-matching between the operation performed by the target instruction in the target task and the preset hash operation under the preset operation feature dimension corresponding to the sub-operation feature;

[0100] Step S62: If it is determined that the at least one feature quantization sub-information meets the preset quantization requirements, the operation performed by the target instruction in the target task is determined to be the preset hash operation.

[0101] As described above, the hash operation instruction that performs the preset hash operation contains corresponding instruction operation features, namely the preset instruction operation features described above. For each preset instruction operation feature dimension, there can be corresponding preset instruction sub-operation features. Based on this, the sub-operation features corresponding to the same preset operation feature dimension can be matched between the instruction operation features of the target instruction and the preset instruction operation features.

[0102] For example, the sub-operation features corresponding to the operation time dimension in the instruction operation features of the target instruction can be matched with the preset instruction sub-operation features corresponding to the operation time dimension in the preset instruction operation features to obtain the corresponding sub-matching degree; then, the corresponding feature quantization sub-information can be determined based on the sub-matching degree.

[0103] In practice, the degree of sub-matching can be determined as the corresponding feature quantization sub-information. Alternatively, a conversion relationship between the degree of sub-matching and the feature quantization sub-information can be determined, and then the corresponding feature quantization sub-information can be determined based on this conversion relationship.

[0104] In this embodiment of the disclosure, after obtaining at least one feature quantization sub-information, it can be determined whether the at least one feature quantization sub-information meets a preset quantization requirement. If it is determined that the at least one feature quantization sub-information meets the preset quantization requirement, it can be determined that the operation performed by the target instruction is a preset hash operation.

[0105] For example, if the preset operation feature dimension is the operation time dimension, then the sub-operation feature of the target instruction under this operation time dimension can be the instruction execution duration. If the instruction execution duration meets the duration requirement (e.g., continuous execution duration of 4 hours), then the feature quantization sub-information of the instruction execution duration can be 0.3 (or any other value from 0 to 1). The duration requirement can be a duration requirement determined based on the preset instruction operation features.

[0106] For example, if the preset operation feature dimension is the operation space dimension, then the sub-operation feature of the target instruction under this operation space dimension is the number of threads. Assuming the total number of threads in the chip is N (where N is a natural number greater than 1), if the number M of threads executing the target instruction in the operation unit meets the thread count requirement—for example, if M / N is greater than 0.5—the thread count requirement can be determined to be met. In this case, the feature quantization sub-information corresponding to the thread count can be determined to be 0.2 (or any other value from 0 to 1). The thread count requirement can be a quantity requirement determined based on the preset instruction operation features.

[0107] For example, if the preset operation feature dimension is the operation content dimension, then the sub-operation feature of the target instruction under this operation content dimension is the instruction content. If the instruction content of the target instruction is the same as or corresponds to the preset instruction operation sub-feature under the operation content dimension of the preset instruction operation features, then the feature quantization sub-information corresponding to the instruction content can be determined to be 0.4 (or any other value from 0 to 1).

[0108] In the above embodiments, the degree of sub-matching between the operation performed by the target instruction and the preset hash operation can be determined from each preset operation feature dimension, and the operation performed by the target instruction can be determined to be the preset hash operation based on each sub-matching degree. This processing method allows for a more comprehensive verification of the operation performed by the target instruction, thereby improving the verification accuracy of the operation performed by the target instruction.

[0109] In an optional implementation, step S62, determining that the at least one feature quantization sub-information satisfies a preset quantization requirement, specifically includes the following steps:

[0110] Step S71: Determine the quantization weight corresponding to each of the aforementioned feature quantization sub-informations;

[0111] Step S72: Perform a weighted summation on the at least one feature quantization sub-information based on the quantization weight to obtain a weighted summation result;

[0112] Step S73: If the weighted summation result is greater than or equal to the first threshold, determine that the at least one feature quantization sub-information satisfies the preset quantization requirement.

[0113] In this embodiment of the disclosure, after determining the feature quantization sub-information of each sub-operation feature, the quantization weight corresponding to each feature quantization sub-information can be determined. The quantization weight is related to the dimensional priority of the preset operation feature dimension corresponding to each sub-operation feature; for example, the higher the dimensional priority, the larger the quantization weight; conversely, the lower the dimensional priority, the smaller the quantization weight.

[0114] Subsequently, at least one feature quantization sub-information can be weighted and summed based on the aforementioned quantization weights to obtain a weighted summation result. If the weighted summation result meets the preset quantization requirements, then it is determined that the at least one feature quantization sub-information meets the preset quantization requirements.

[0115] For example, the feature quantization sub-information corresponding to the sub-operation features under each preset operation feature dimension, as mentioned above, is as follows: feature quantization sub-information for instruction execution duration is 0.3, feature quantization sub-information for thread count is 0.2, and feature quantization sub-information for instruction content is 0.4. If the quantization weight of the feature quantization sub-information for instruction execution duration is set to 0.5, the quantization weight of the feature quantization sub-information for thread count is set to 0.5, and the quantization weight of the feature quantization sub-information for instruction content is set to 0.9, then each feature quantization sub-information can be weighted and summed based on its corresponding quantization weight to obtain a weighted summation result. That is, the obtained weighted summation result is: 0.3*0.5 + 0.2*0.5 + 0.4*0.9 = 0.7.

[0116] Then, the weighted summation result can be compared with the first threshold. If the weighted summation result is greater than or equal to the first threshold, it can be determined that at least one of the aforementioned feature quantization sub-information meets the preset quantization requirements. The first threshold can be a pre-set threshold requirement (e.g., 0.7). This disclosure does not limit the specific value of the first threshold, but rather focuses on meeting actual needs.

[0117] It should be noted that the weighted summation result obtained by weighted summation of at least one feature quantization sub-information can also be understood as the feature quantization information of the target task mentioned above. That is, if the feature quantization information of the target task meets the preset quantization requirements, then the operation performed by the target instruction in the target task is determined to be a preset hash operation.

[0118] In the above implementation, by setting a corresponding quantization weight for each feature quantization sub-information, more attention can be paid to feature quantization sub-informations with higher feature priority during the verification of the operation executed by the target instruction. This can improve the verification accuracy of the operation executed by the target instruction and thus obtain more accurate intrusion detection results.

[0119] In an optional implementation, step S62, determining that the at least one feature quantization sub-information meets the preset quantization requirements, further includes the following steps:

[0120] Step S81: Summate the at least one feature quantization sub-information to obtain the summation result;

[0121] Step S82: If the summation result is greater than or equal to the second threshold, determine that the at least one feature quantization sub-information satisfies the preset quantization requirement.

[0122] In this embodiment of the disclosure, after determining at least one feature quantization sub-information, the at least one feature quantization sub-information can be summed to obtain a summation result. Then, it can be determined whether the obtained summation result meets a preset quantization requirement. If the summation result meets the preset quantization requirement, it can be determined that the at least one feature quantization sub-information meets the preset quantization requirement.

[0123] For example, the feature quantization sub-information is as follows: 0.3 for instruction execution time, 0.2 for the number of threads, and 0.4 for instruction content. These three feature quantization sub-information can then be summed to obtain the summation result: 0.3 + 0.2 + 0.4 = 0.9.

[0124] Then, the summation result can be compared with the second threshold. If the summation result is greater than or equal to the second threshold, it can be determined that at least one of the aforementioned feature quantization sub-information meets the preset quantization requirements. The second threshold can be a pre-set threshold requirement (e.g., 0.8). This disclosure does not limit the specific value of the second threshold, but rather focuses on meeting actual needs.

[0125] It should be noted that in the embodiments of this disclosure, the specific values ​​of the first threshold and the second threshold may be the same or different. This disclosure does not limit this, but shall be based on actual needs.

[0126] It should be noted that the summation result obtained by summing at least one feature quantization sub-information can also be understood as the feature quantization information of the target task mentioned above. That is, if the feature quantization information of the target task meets the preset quantization requirements, then the operation performed by the target instruction in the target task is determined to be a preset hash operation.

[0127] In the above embodiments, by summing up each feature quantization sub-information, each feature quantization sub-information can be comprehensively integrated, thereby more accurately determining the relationship between at least one feature quantization sub-information and the preset quantization requirements.

[0128] In one optional implementation, the method of this disclosure further includes:

[0129] After determining that an unauthorized intrusion hash operation instruction has been detected, an intrusion warning message and / or a task termination signal are generated. The intrusion warning message is used to indicate that an intrusion operation has been detected, and the task termination signal is used to control the computing unit to terminate the execution of the target task.

[0130] In this embodiment of the disclosure, after determining that an illegal intrusion hash operation instruction has been detected, an intrusion warning message and / or a task end signal can be generated. The intrusion warning message can be displayed on the display screen of the terminal device where the chip is located in the form of a pop-up window, or it can be sent to the background in the form of real-time information.

[0131] In this embodiment of the disclosure, after detecting an intrusion operation against the chip, generating an intrusion warning message and a task completion signal, the chip can be restarted by having staff re-enter the security password and wait for the next task to arrive. Alternatively, the chip can be restarted after staff confirms that the intrusion warning message has been received, in order to wait for the next task to arrive.

[0132] In the above implementation, after detecting an unauthorized hash operation instruction, an intrusion warning can be generated, promptly alerting staff to investigate. Simultaneously, a task completion signal can be generated to terminate the target task in a timely manner, thereby saving equipment and power resources.

[0133] Those skilled in the art will understand that, in the above-described method of the specific implementation, the order in which each step is written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0134] Based on the same inventive concept, this disclosure also provides an instruction monitoring device corresponding to the instruction monitoring method. Since the principle of the device in this disclosure for solving the problem is similar to the instruction monitoring method described above in this disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0135] The instruction monitoring device disclosed in this embodiment can be program code written into the SoC (System on Chip) of the chip, or it can be the hardware intellectual property core (IP core) of the chip that can implement the function corresponding to the above instruction monitoring method.

[0136] See Figure 6 The diagram shown is a schematic of an instruction monitoring device provided in an embodiment of this disclosure. The instruction monitoring device includes a control unit 61, which is used for:

[0137] Obtain the target task being executed by the computing unit at the current moment; wherein the target task includes at least one target instruction; and

[0138] Determine the task execution information of the target task; wherein the task execution information is used to indicate the instruction operation characteristics of the target instructions contained in the target task; and

[0139] If, based on the task execution information, it is determined that the operation performed by the target instruction in the target task is a preset hash operation, then an illegal intrusion hash operation instruction is detected.

[0140] In the above embodiments, the operations performed by the chip can be detected in real time based on task execution information. If the operation performed by the chip is a preset hash operation, it can be determined that the chip has been illegally invaded, thereby improving the effectiveness and efficiency of chip intrusion detection and further enhancing chip security.

[0141] In one possible implementation, the control unit is further configured to: acquire sub-operation features of the target instruction under each preset operation feature dimension, and obtain at least one sub-operation feature; wherein the at least one sub-operation feature is used to indicate at least one of the following: instruction execution duration, the number of threads executing the target instruction in the operation unit, and the instruction content of the target instruction; and determine the instruction operation features of the target instruction based on the at least one sub-operation feature to obtain the task execution information.

[0142] In one possible implementation, the control unit is further configured to: determine feature quantization sub-information for each of the sub-operation features to obtain at least one feature quantization sub-information, wherein each feature quantization sub-information is used to indicate the degree of sub-matching between the operation performed by the target instruction in the target task and the preset hash operation under the preset operation feature dimension corresponding to the sub-operation feature; and, if it is determined that the at least one feature quantization sub-information satisfies the preset quantization requirement, determine that the operation performed by the target instruction in the target task is the preset hash operation.

[0143] In one possible implementation, the control unit is further configured to: determine the quantization weight corresponding to each of the feature quantization sub-informations; and perform a weighted summation on the at least one feature quantization sub-information based on the quantization weight to obtain a weighted summation result; and if the weighted summation result is greater than or equal to a first threshold, determine that the at least one feature quantization sub-information satisfies the preset quantization requirement.

[0144] In one possible implementation, the control unit is further configured to: sum the at least one feature quantization sub-information to obtain a summation result; and determine that the at least one feature quantization sub-information satisfies the preset quantization requirement if the summation result is greater than or equal to a second threshold.

[0145] In one possible implementation, the control unit is further configured to: determine feature quantization information of the target task based on the task execution information; the feature quantization information is used to indicate the degree of matching between the operation performed by the target instruction in the target task and the preset hash operation; and, if the feature quantization information satisfies the preset quantization requirements, determine that the operation corresponding to the target task is the preset hash operation.

[0146] In one possible implementation, the control unit is further configured to: acquire a sample instruction database; the sample instruction database contains preset instruction operation features of hash operation instructions that perform the preset hash operation; and determine the degree of matching between the instruction operation features indicated by the task execution information and the preset instruction operation features in the sample instruction database, and determine the feature quantification information of the target task based on the degree of matching.

[0147] In one possible implementation, the control unit is further configured to: record the instruction operation characteristics of the hash operation instruction executed by the computing unit within a preset recording time period when a target triggering event is detected; and save the instruction operation characteristics of the hash operation instruction as preset instruction operation characteristics of the hash operation instruction to the sample instruction database.

[0148] In one possible implementation, the control unit is further configured to: after determining that an unauthorized intrusion hash operation instruction has been detected, generate intrusion warning information and / or task end signal, wherein the intrusion warning information is used to indicate that an intrusion operation has been detected, and the task end signal is used to control the operation unit to end the execution of the target task.

[0149] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0150] Corresponding to Figure 1 In addition to the instruction monitoring method in the present disclosure, this embodiment also provides an electronic device 700, such as... Figure 7 The diagram shown is a structural schematic of an electronic device 700 provided in an embodiment of this disclosure, including:

[0151] The system includes a processing unit 71, a storage unit 72, and a bus 73. The storage unit 72 stores execution instructions and includes a memory 721 and an external storage unit 722. The memory 721, also called the internal storage unit, temporarily stores computational data in the processing unit 71, as well as data exchanged with external storage units 722 such as hard disks. The processing unit 71 exchanges data with the external storage unit 722 through the memory 721. When the electronic device 700 is running, the processing unit 71 communicates with the storage unit 72 via the bus 73, causing the processing unit 71 to execute the following instructions:

[0152] The target task executed by the computing unit at the current moment is obtained; wherein the target task includes at least one target instruction;

[0153] Determine the task execution information of the target task; wherein the task execution information is used to indicate the instruction operation characteristics of the target instructions contained in the target task;

[0154] If, based on the task execution information, it is determined that the operation performed by the target instruction in the target task is a preset hash operation, then an illegal intrusion hash operation instruction is detected.

[0155] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processing unit, performs the steps of the instruction monitoring method described in the above-described method embodiments. The storage medium may be a volatile or non-volatile computer-readable storage medium.

[0156] This disclosure also provides a computer program product carrying program code. The program code includes instructions that can be used to execute the steps of the instruction monitoring method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0157] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0158] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this disclosure, it should be understood that the disclosed systems and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0159] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0160] In addition, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0161] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium executable by a processing unit. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, a server unit, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0162] Finally, it should be noted that the above-described embodiments are merely specific implementations of this disclosure, used to illustrate the technical solutions of this disclosure, and not to limit it. The protection scope of this disclosure is not limited thereto. Although this disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this disclosure. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this disclosure, and should all be covered within the protection scope of this disclosure. Therefore, the protection scope of this disclosure should be determined by the protection scope of the claims.

Claims

1. A chip instruction monitoring apparatus characterized by comprising: The control unit comprises: The control unit is configured to obtain a target task executed by an operation unit at a current time; wherein the target task comprises at least one target instruction, and the operation unit is a unit arranged in a chip for executing an operation task; and determine task execution information of the target task; wherein the task execution information is used to indicate an instruction operation characteristic of the target instruction included in the target task; the instruction operation characteristic of the target instruction corresponds to a plurality of preset operation characteristic dimensions, and each preset operation characteristic dimension corresponds to at least one sub-operation characteristic; the task execution information of the target task is determined based on the sub-operation characteristics in the plurality of preset operation characteristic dimensions; and in a case where it is determined based on the task execution information that an operation performed by the target instruction in the target task is a preset hash operation, it is determined that a hash operation instruction of illegal intrusion is detected. The control unit is further configured to: determine feature quantization information of each target task based on the task execution information, wherein the feature quantization information is used to indicate a matching degree between an operation performed by the target instruction in the target task and the preset hash operation; and in a case where it is determined that the feature quantization information meets a preset quantization requirement, it is determined that the operation corresponding to the target task is the preset hash operation.

2. The chip instruction monitoring apparatus according to claim 1, characterized by The control unit is further configured to: obtain a sub-operation characteristic of the target instruction in each preset operation characteristic dimension, to obtain at least one sub-operation characteristic; wherein the at least one sub-operation characteristic is used to indicate at least one of the following: an instruction execution time length, a number of threads in the operation unit that execute the target instruction, and an instruction content of the target instruction.

3. The chip instruction monitoring apparatus according to claim 2, wherein The control unit is further configured to: determine feature quantization sub-information of each sub-operation characteristic, to obtain at least one feature quantization sub-information, wherein each feature quantization sub-information is used to indicate a sub-matching degree between an operation performed by the target instruction in the target task and the preset hash operation in the preset operation characteristic dimension corresponding to the sub-operation characteristic; and in a case where it is determined that the at least one feature quantization sub-information meets a preset quantization requirement, it is determined that the operation performed by the target instruction in the target task is the preset hash operation.

4. The chip instruction monitoring apparatus according to claim 3, wherein The control unit is further configured to: determine a quantization weight corresponding to each feature quantization sub-information; and perform weighted summation on the at least one feature quantization sub-information based on the quantization weight, to obtain a weighted summation result; and in a case where the weighted summation result is greater than or equal to a first threshold value, it is determined that the at least one feature quantization sub-information meets the preset quantization requirement.

5. The chip instruction monitoring apparatus according to claim 3 or 4, characterized by The control unit is further configured to: perform cumulative summation on the at least one feature quantization sub-information, to obtain a cumulative summation result; and in a case where the cumulative summation result is greater than or equal to a second threshold value, it is determined that the at least one feature quantization sub-information meets the preset quantization requirement.

6. The chip instruction monitoring apparatus according to claim 5, wherein The control unit is further configured to: obtain a sample instruction database; the sample instruction database contains preset instruction operation characteristics of hash operation instructions for performing the preset hash operation; and determine a matching degree between the instruction operation characteristics indicated by the task execution information and the preset instruction operation characteristics in the sample instruction database, and determine feature quantization information of the target task based on the matching degree.

7. The chip instruction monitoring apparatus according to claim 6, wherein The control unit is further configured to: in a case where a target triggering event is detected, record instruction operation characteristics of hash operation instructions executed by the operation unit within a preset recording time period; and save the instruction operation characteristics of the hash operation instructions as preset instruction operation characteristics of the hash operation instructions in the sample instruction database.

8. The chip instruction monitoring apparatus according to claim 1, wherein The control unit is further configured to: after determining the hash operation instruction of illegal intrusion is detected, generate an intrusion warning information and / or a task end signal, wherein the intrusion warning information is used to indicate that an intrusion operation is monitored, and the task end signal is used to control the operation unit to end the execution of the target task.

9. A method of monitoring chip instructions, the method comprising: comprising: obtain a target task executed by an operation unit at a current time; wherein the target task contains at least one target instruction, and the operation unit is a unit arranged in a chip for executing an operation task; determine task execution information of the target task; wherein the task execution information is used to indicate instruction operation characteristics of the target instruction contained in the target task; the instruction operation characteristics of the target instruction correspond to sub-operation characteristics of a plurality of preset operation characteristic dimensions, wherein for each preset operation characteristic dimension, at least one sub-operation characteristic is corresponded; the task execution information of the target task is determined based on the sub-operation characteristics under the plurality of preset operation characteristic dimensions; in a case where it is determined based on the task execution information that the operation executed by the target instruction in the target task is a preset hash operation, it is determined that a hash operation instruction of illegal intrusion is detected; determine feature quantization information of each target task based on the task execution information, wherein the feature quantization information is used to indicate a matching degree between the operation executed by the target instruction in the target task and the preset hash operation; and in a case where it is determined that the feature quantization information meets a preset quantization requirement, it is determined that the operation corresponding to the target task is the preset hash operation.

10. A chip, characterized by comprise the chip instruction monitoring device of any one of claims 1-8.

11. An electronic device, comprising: comprising: a processing unit, a storage unit and a bus, the storage unit stores machine unit readable instructions executable by the processing unit, when the electronic device is running, the processing unit and the storage unit communicate through the bus, the machine unit readable instructions are executed by the processing unit to execute the steps of the chip instruction monitoring method of claim 9, or the chip of claim 10.

12. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, which is executed by the processing unit to execute the steps of the chip instruction monitoring method of claim 9.

Images