A method for detecting bit-flipping based machine learning codebase memory fault injection vulnerabilities
By inserting detection instructions into the machine learning codebase, calculating the imbalance of branch jump instructions, and using bit flipping technology, potential memory fault injection vulnerabilities are detected and confirmed. This solves the problem of detecting memory fault injection vulnerabilities in machine learning codebases and ensures the security and integrity of the model.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHANGHAI JIAOTONG UNIV
- Filing Date
- 2022-07-20
- Publication Date
- 2026-06-02
AI Technical Summary
Existing technologies lack effective methods to detect memory fault injection vulnerabilities in machine learning codebases, which threaten the security and integrity of machine learning models, especially posing a high risk of tampering with model parameters, model implementation code, and machine learning codebases.
By inserting detection instructions into the machine learning codebase, calculating the imbalance of branch jump instructions, combining the actual machine learning model and dataset, using bit flipping technology to inject memory faults, analyzing and confirming potential vulnerability locations, constructing a set of risk and vulnerability instructions, and optimizing the detection process to reduce performance overhead.
It achieves accurate detection of instructions in machine learning codebases that can be exploited by malicious attacks within an acceptable time overhead, ensuring the security and integrity of the model and reducing the risk of memory fault injection.
Smart Images
Figure CN117473505B_ABST
Abstract
Description
[Technical Field]
[0001] This invention relates to the field of information security protection technology, specifically to a method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping. [Background Technology]
[0002] With the widespread application of machine learning technology, algorithmic innovations centered on machine learning models are emerging in various aspects of production and daily life, such as autonomous driving and medical imaging. In these fields, the security of machine learning models, as the core component of the algorithm, is paramount. In recent years, as research into the security of computer hardware has deepened, security research on machine learning technology has expanded from the software level to the hardware level. The hardware level of machine learning technology includes all computer hardware related to model computation, such as processors, caches, memory, and storage devices. Since the hardware system is the foundation for the operation of machine learning model code and framework, and the actual execution unit of computation, hardware-level machine learning security is extremely important.
[0003] At the hardware level of machine learning technology, fault injection vulnerabilities originating from memory devices pose a significant threat. Memory devices store the code and parameters of machine learning models and exchange data directly with the processor. Therefore, fault injection targeting memory devices can tamper with the code and parameters of machine learning models, directly threatening their integrity. Currently, this type of fault injection poses two threats to the security of machine learning technology: (1) misclassification attacks: significantly reducing the prediction accuracy of machine learning models, causing them to make incorrect predictions with a high probability; (2) backdoor injection attacks: implanting backdoors into machine learning models, causing them to make incorrect predictions about a specific set of data without affecting their functionality, making them more covert. Therefore, proposing an effective vulnerability detection method to address this type of threat is an urgent need for all parties involved.
[0004] Memory fault injection attacks targeting machine learning models can be categorized into three attack angles: (1) tampering with model parameters, (2) tampering with model implementation code, and (3) tampering with the machine learning codebase. The machine learning codebase refers to the code framework used to implement machine learning models, primarily including open-source framework projects maintained by the machine learning community and closed-source modules provided by third-party vendors. Mainstream machine learning codebases include PyTorch, TensorFlow, Caffe, and Apache MXNet. Machine learning codebases are widely used, significantly reducing the time required for implementing and deploying machine learning models. Therefore, vulnerabilities targeting machine learning codebases have high prevalence and repeatability among the three attack angles. However, there is currently no effective method to detect potential memory fault injection vulnerabilities in machine learning codebases. Therefore, proposing a vulnerability detection mechanism to protect machine learning codebases is particularly important.
[0005] This invention addresses the dangerous code containing memory fault injection vulnerabilities in machine learning codebases by providing technical improvements to the detection method for such vulnerabilities. [Summary of the Invention]
[0006] The purpose of this invention is to provide a method for detecting memory fault injection vulnerabilities in machine learning codebases, thereby reducing or eliminating the risks and harms caused by tampering with machine learning codebases and ensuring the security and integrity of machine learning models.
[0007] To achieve the above objectives, the technical solution adopted by this invention is a method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping, comprising the following steps:
[0008] S1. The machine learning code library data acquisition module adds extended functions to the programmable compiler and inserts detection instructions into sensitive code in the machine learning code library. The sensitive code corresponds to one or more sensitive instructions. The detection instructions are used to collect the running data of the sensitive code in the machine learning code library on the machine learning model and dataset in the actual application scenario.
[0009] S2, the imbalance calculation program module uses machine learning models and datasets from real-world application scenarios, runs machine learning code library data acquisition program module to obtain machine learning code library data acquisition data for insertion detection instructions, calculates and discovers risk-sensitive code points, that is, calculates and analyzes the imbalance of sensitive instructions, and determines the set of risk-sensitive instructions that are easily affected by memory fault injection vulnerabilities.
[0010] S3, the hardware system analysis module, is based on the hardware system in actual use of the machine learning code library. It injects memory faults by injecting bit flips into the actual memory hardware to obtain the distribution file of fault injection vulnerabilities in the actual memory hardware.
[0011] S4. The hardware system analysis module analyzes each possible memory fault injection vulnerability in the risk-sensitive instruction set of the machine learning code library to see if it matches the actual memory hardware fault injection vulnerability distribution file, thereby obtaining the vulnerability-sensitive instruction set for subsequent machine learning code library repair and maintenance.
[0012] Preferably, the sensitive code refers to branch jump statements in the machine learning codebase, and the sensitive instruction refers to branch jump instructions.
[0013] Preferably, the branch jump statement includes if-else statement, while statement and switch statement, and the branch jump instruction includes if-else instruction, while instruction and switch instruction.
[0014] Preferably, in the method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping, step S2 specifically includes the following sub-steps:
[0015] S21. The number of branches in the branch jump statement is exactly two. The number of times the program control flow enters branch i (i = 0, 1) is B. i The probability of program control flow entering each branch
[0016] S22. Imbalance (R) of branch jump instruction R: Imbalance (R) = |P0-P1|, with a value range of [0,1].
[0017] S23. Using machine learning models and datasets in real-world application scenarios, calculate the imbalance (Imbalance(R)) of each branch jump instruction R. If it exceeds the set threshold, the branch jump instruction is susceptible to memory fault injection vulnerabilities and is added to the risk-sensitive instruction set S.
[0018] Preferably, the set threshold is 0.5.
[0019] Preferably, the bit flipping in step S3 is based on Rowhammer technology.
[0020] Preferably, the method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping further includes the following steps:
[0021] S5. The hardware system analysis program module analyzes and confirms whether there are security issues in the vulnerability-sensitive instructions in the matched vulnerability-sensitive instruction set.
[0022] Preferably, in the method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping, step S5:
[0023] Software simulations are used to simulate scenarios where vulnerable sensitive commands are exploited by malicious attackers to confirm whether security issues exist;
[0024] Alternatively, memory page relocation can be used to place the sensitive code corresponding to the sensitive risk instructions in the machine learning codebase into the location of the fault injection vulnerability in the actual memory hardware. Memory fault injection can be performed by injecting bit flips into the actual memory hardware. The scenario of the vulnerable sensitive instructions being exploited by malicious attackers can be tested on the actual memory hardware system to confirm whether there is a security problem.
[0025] Alternatively, the actual memory hardware fault injection vulnerability distribution file from step S3 can be used as one of the constraints of software simulation to simulate a scenario where vulnerability-sensitive instructions are exploited by malicious attackers to confirm whether a security issue exists.
[0026] Preferably, the memory page relocation bypasses the operating system's process isolation mechanism to obtain the actual physical address of the target page, specifically:
[0027] S51. By utilizing the lazy allocation feature of the operating system, a physical address is allocated in memory only when the target page is accessed. The file content is accessed page by page to gradually occupy the memory buffer capacity until the target page in the memory buffer is moved out of memory.
[0028] S52. When the target page is accessed again, the operating system will reallocate a new physical address for the target page, thereby achieving target page relocation.
[0029] S53. Repeat steps S51 and S52 until the target page is relocated to the physical address corresponding to the location of the fault injection vulnerability in the actual memory hardware.
[0030] Preferably, the memory page relocation utilizes the big page feature of the operating system or utilizes the side channel of the memory buffer to bypass the process isolation mechanism of the operating system.
[0031] The beneficial effects of this invention are as follows: First, by extending the compiler's functionality, detection instructions are inserted into sensitive code in the machine learning codebase. Then, the branch jump instruction imbalance is used to calculate the impact of each sensitive instruction, combined with the specific machine learning model and dataset under the actual situation, thereby obtaining instructions susceptible to memory fault injection vulnerabilities, forming a risk instruction set. Finally, memory fault injection based on Rowhammer technology is used to verify the instructions in the risk instruction set according to the actual situation, obtaining all instructions with security issues in the machine learning codebase under the current application scenario and specific hardware system, forming a vulnerable instruction set. Simultaneously, the time performance of the detection method is optimized, making it more practical. Within an acceptable time overhead, it can accurately detect instructions in the machine learning codebase that can be exploited by malicious attackers under various actual situations, thereby ensuring the security and integrity of the machine learning model in application. [Attached Image Description]
[0032] Figure 1 This is a flowchart illustrating the overall process of a machine learning codebase memory fault injection vulnerability detection method based on bit flipping.
Detailed Implementation Methods
[0033] The features and exemplary embodiments of various aspects of the present invention will now be described in detail. In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention may be practiced without requiring some of these specific details. The following description of embodiments is merely intended to provide a better understanding of the invention by illustrating examples of the invention. The invention is by no means limited to any specific configurations and algorithms presented below, but covers any modifications, substitutions, and improvements to elements, components, and algorithms without departing from the inventive concept. In the accompanying drawings and the following description, well-known structures and techniques are not shown in order to avoid unnecessarily obscuring the invention.
[0034] Example
[0035] This embodiment implements a method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping.
[0036] Figure 1 This is a flowchart illustrating the overall process of a machine learning codebase memory fault injection vulnerability detection method based on bit flipping. (See attached diagram.) Figure 1 As shown in the attached document Figure 1This embodiment presents a method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping. Targeting the characteristics of memory fault injection vulnerabilities, it uses dynamic analysis to detect potentially risky code points. It leverages extended compiler functionality to insert detection instructions into sensitive code within the machine learning codebase, performing computations on specific machine learning models and datasets in real-world application scenarios to discover code vulnerability points. Then, using Rowhammer technology, it scans the actual hardware system for memory fault injection vulnerability points, obtaining a memory fault injection profile. Finally, combining the code vulnerability points in the machine learning codebase with the memory fault injection profile, it identifies the memory fault injection vulnerabilities present in the codebase under the current application scenario. Ultimately, it detects code points with memory fault injection vulnerabilities that can be exploited by malicious attackers and promptly reports the relevant information to the maintainers of the machine learning codebase. This allows the maintainers to promptly modify the machine learning codebase or take other preventative measures against reported memory fault injection vulnerabilities, thereby protecting the security and integrity of the machine learning model in application.
[0037] This embodiment analyzes the operation of sensitive code under specific machine learning models and datasets in real-world scenarios. By analyzing the principles and properties of memory fault injection vulnerabilities targeting codebases, it proposes using the imbalance of branch jump instructions to measure the ease with which instructions are affected by memory fault injection vulnerabilities. This scientifically and effectively analyzes the code locations in sensitive code that may contain memory fault injection vulnerabilities. Then, based on the risk instruction set obtained from the analysis, combined with the hardware system constraints under actual conditions, it judges from the detection results whether each risk instruction can be exploited by malicious attackers.
[0038] In this embodiment, the entire detection algorithm is deployed on the hardware system where the machine learning model actually runs, and the performance of the detection process for memory fault injection vulnerabilities has been optimized. It can detect memory fault injection vulnerabilities in the machine learning codebase with high accuracy and low performance overhead.
[0039] This embodiment presents a method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping. It mainly comprises four steps: codebase data acquisition, imbalance calculation, hardware system analysis, and performance optimization, as detailed below:
[0040] Codebase Data Acquisition (Machine Learning Codebase Data Acquisition Program Module):
[0041] The method uses dynamic analysis to detect potentially risky code locations. It inserts detection instructions into sensitive code in the machine learning codebase through an extended compiler. Then, the detection instructions collect running data of the sensitive code on specific machine learning models and specific datasets in real-world situations for subsequent analysis.
[0042] This embodiment presents a method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping. The machine learning codebase data acquisition module first adds extended functions to the programmable compiler, such as adding extended functions to the LLVM compiler, so that the machine learning codebase automatically inserts detection instructions for sensitive code when it is compiled using the LLVM compiler.
[0043] This embodiment defines branching statements in machine learning code as sensitive code, such as if-else statements, while statements, and switch statements. In these types of statements, a malicious attacker only needs to inject a single bit-flip fault to cause the semantics of the branching statement to be reversed. For example, for the JE (0x74) instruction that might correspond to the compiled if-else statement, injecting just one bit-flip fault can produce the JNE (0x75) instruction, whose semantics are exactly the opposite of the JE instruction. Similar situations exist for other branching statements.
[0044] Furthermore, this embodiment considers that at the machine code level, the number of branches in a branching instruction is exactly two.
[0045] Specifically, each piece of sensitive code corresponds to one or more sensitive (machine code) instructions. For each sensitive instruction R, a pair of integer counter variables (B0, B1) are created and bound to instruction R. These counters are used to calculate the number of times the program control flow selects a branch from the instruction when the sensitive code runs on a specific machine learning model and dataset in a real-world scenario. The values of the counter variables are further processed by the imbalance calculation module to calculate the imbalance of the sensitive instruction. The imbalance of the sensitive instruction is classified according to a pre-set threshold. Sensitive instructions with imbalances exceeding the threshold need to be further submitted to the hardware system analysis module for risk verification.
[0046] The number of detection instructions inserted into a machine learning codebase by an extended compiler (a compiler with added compiler extension modules) is proportional to the number of sensitive codes in the codebase. Detection instructions used for data acquisition can be reused for different application scenarios of the machine learning codebase. Furthermore, the algorithm complexity of the detection instructions is O(1), so inserting detection instructions does not impose a significant performance burden on the machine learning codebase.
[0047] Unbalance calculation (unbalance calculation program module):
[0048] The imbalance calculation module calculates and analyzes the imbalance of sensitive instructions based on the sensitive code execution data obtained from the machine learning codebase data acquisition module. Sensitive instruction imbalances are categorized based on a pre-set threshold. Instructions exceeding the threshold are considered more susceptible to memory injection vulnerabilities and are added to the risk instruction set S. Instructions with imbalances below the threshold are considered less susceptible to memory injection vulnerabilities and do not pose a substantial threat to the security and integrity of the machine learning codebase. After the imbalance calculation, the risk instruction set S is obtained, containing all sensitive instructions susceptible to memory injection vulnerabilities. The instructions in the risk instruction set S need to be considered in conjunction with the actual hardware system constraints to confirm the potential harm.
[0049] Suppose that for a sensitive instruction R, the two possible target labels for a branch jump are i=0 and i=1. Consider the data acquisition step of a machine learning codebase. When the sensitive instruction R runs on a specific machine learning model and a specific dataset in a real-world situation, obtain the number of times the program control flow enters the two branch jump targets, corresponding to the values of the counter variable B. i (i = 0, 1). Based on the counter variable, the probability of the program control flow entering each branch is defined as the branch probability, denoted as P. i , is the ratio of the number of times the control flow enters each branch to the total number of times it enters both branches. Branch probability:
[0050]
[0051] Among them, B i The branch probability of instruction R represents the number of jumps between its two branch targets, obtained by running on a specific machine learning model and dataset based on real-world conditions during the data acquisition step of the machine learning codebase. The branch probability of a sensitive instruction reflects the probability that the program control flow will choose different branches in the application scenario. By definition, the sum of the probabilities of the two branches of an instruction is one, satisfying...
[0052] P0 + P1 = 1 (2)
[0053] Next, we define the imbalance of the sensitive instruction R. The imbalance of the sensitive instruction R reflects the difference in probability between the two branches of the program control flow choosing the same instruction in a real-world application scenario. Therefore, the imbalance of the sensitive instruction R is defined as the difference in probability between the program control flow entering the two branches of the sensitive instruction. Imbalance of the sensitive instruction R:
[0054]
[0055] Where P0 and P1 represent the branch probabilities of the program control flow choosing branch 0 and branch 1 respectively in the actual application scenario of the sensitive instruction R. Considering that the calculation of the imbalance degree is not relative but absolute for a specific branch of the sensitive instruction, the absolute value is taken when expressing the imbalance degree. According to the definition, the value range of the imbalance degree is [0, 1]. When Imbalance(R) = 0, that is, when the value of the imbalance degree of the sensitive instruction R is zero, we can get from formula (2) that P0 = P1 = 0.5, that is, the program control flow selects the two branch targets of instruction R with the same probability, and the imbalance degree of the sensitive instruction R is the lowest at this time. In addition, if the value of the imbalance degree is larger, it indicates that the program control flow is more inclined, that is, it is more likely to select one of the branch targets of R. Since the imbalance degree is absolute, the specific branch target is not distinguished at this time.
[0056] It is important to note that the imbalance of sensitive instructions needs to be calculated based on specific real-world scenarios. For a sensitive instruction R, the imbalance (Imbalance(R)) needs to be calculated for a specific neural network model and a specific dataset under real-world conditions. For specific technical details, please refer to the data acquisition steps in the code repository.
[0057] For a sensitive instruction R, after calculating the imbalance (Imbalance(R)) for a specific neural network model and dataset under real-world conditions, it should be further determined whether the imbalance exceeds a set threshold. Generally, the threshold for Imbalance(R) is set to 0.5. If so, it indicates that the instruction has a high imbalance, and if subjected to a memory fault injection attack, there is a higher probability of significant errors in the program's control flow. Therefore, the sensitive instruction should be considered susceptible to memory fault injection vulnerabilities and added to the risk instruction set S. If not, the sensitive instruction should be considered less affected by memory fault injection vulnerabilities and does not need to be added to the risk instruction set S. In the imbalance calculation step, this embodiment describes a method for detecting memory fault injection vulnerabilities in a machine learning codebase based on bit flipping. The imbalance calculation module uses the defined sensitive instruction imbalance to filter out risk instructions that are significantly affected by memory fault injection vulnerabilities from a large number of sensitive instructions, forming the risk instruction set S. The risk instruction set S should be further submitted to the hardware system analysis module to confirm the potential harm based on the actual hardware system constraints.
[0058] Hardware system analysis (hardware system analysis program module):
[0059] This embodiment presents a method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping. The hardware system analysis program module has two main functions. First, it analyzes the actual hardware system to derive constraints related to the actual memory hardware, thereby guiding the selection of risky instruction sets and improving the accuracy and practical significance of the detection results. Second, it tests each instruction in the risky instruction set to detect the actual security problems caused by the memory fault injection vulnerability, obtaining a vulnerable instruction set to provide a basis for subsequent remediation and maintenance work.
[0060] This embodiment describes a method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping. First, the hardware system analysis module uses Rowhammer technology to perform memory fault injection to identify memory device fault injection vulnerability files. Rowhammer technology is a technique that injects bit flipping into memory. It utilizes electromagnetic interference between memory device storage elements to frequently refresh specific rows in memory, allowing malicious attackers to flip bit information stored in memory storage elements outside their read-only access scope. The memory rows frequently refreshed by the attacker are called activation rows, and the flipped memory rows are called target rows. Typically, target rows are adjacent to activation rows. For a given memory device, the hardware system analysis module randomly selects a set of activation rows and uses the `clflush` instruction to frequently refresh them. Then, the hardware system analysis module detects rows near the activation rows; if bit flipping occurs, it is recorded as a target row. An additional test can be performed to confirm that the bit flipping is reproducible. All records of activation rows and target rows constitute the memory device fault injection vulnerability file.
[0061] Based on the fault injection vulnerability profile of the memory device, for each instruction in the risky instruction set, it is matched against the fault injection vulnerability profile of the memory device according to the possible fault injection vulnerabilities. The matching of the fault injection vulnerability profile of the memory device mainly requires that two characteristic values be the same: the direction of the flip and the offset of the flip position on the memory page (Page Offset). If no match is found, it means that the risky instruction cannot be triggered on this memory device and is not added to the vulnerable instruction set. If a match is found, page relocation technology should be used to further detect the harm of the risky instruction. In this embodiment, the page relocation technology uses file memory mapping technology to place the potentially risky code points at the location of the fault injection vulnerability in the memory device for subsequent detection.
[0062] Regarding the security issues of detecting risky instructions, this embodiment proposes three detection methods. For each instruction R in the set S, there are three methods to confirm whether this instruction actually has a security problem. First, software simulation can be used to simulate the scenario where instruction R is exploited by a malicious attacker. This involves directly modifying the corresponding risky instruction in the machine learning codebase using software, running the model on the modified codebase, and confirming the security issues caused by memory fault injection vulnerabilities at the risky instruction. The advantage is fast verification speed, but the disadvantage is that it cannot simulate actual hardware constraints. Second, Rowhammer-based memory fault injection technology can be used to test the scenario where instruction R is exploited by a malicious attacker on a real-world hardware system. Based on memory device fault injection vulnerability profiles, without modifying the codebase, Rowhammer technology is used to inject bit flips into the running codebase to detect security issues. The advantage is accurate results, but the disadvantage is a longer testing cycle. Third, a combination of the first two methods can be used, with memory device fault injection vulnerability profiles as one of the constraints of the software detection method. First, Rowhammer-based memory fault injection technology is used to obtain memory fault injection profiles on a real-world hardware system. Then, these memory fault injection profiles are used as one of the constraints of software simulation to simulate the scenario where instruction R is exploited by a malicious attacker. The advantage is fast verification speed and accurate results, but the disadvantage is the long time required to obtain the memory fault injection profiles. Each of the three methods has its advantages and disadvantages, and the choice should be made based on the actual needs.
[0063] Performance optimization (hardware system analyzer module):
[0064] In the process of hardware system analysis, this embodiment adopts a file memory mapping-based method to realize page relocation in memory, so that the vulnerability detection system can ensure the efficiency of risk instruction testing without causing excessive system overhead or affecting the normal function of the system.
[0065] In this embodiment, the hardware system analysis module utilizes page relocation technology to place potentially risky code points into locations within the memory device where fault injection vulnerabilities exist. Due to the special nature of memory devices, the location of code pages within them is typically managed by the operating system according to certain strategies. For example, the Linux system uses buddy memory allocation technology to autonomously manage processes within the memory device. While operating system-level memory allocation is more efficient and secure, it also means that developers cannot intervene in the memory allocation process using conventional methods. In existing work, the mainstream approach uses memory exhaustion technology to control the operating system's memory allocation strategy. However, memory exhaustion technology places a significant burden on memory and can cause other processes to suspend or terminate. This is unacceptable for high-performance devices running machine learning models. Therefore, this embodiment requires the use of a novel file memory mapping technology to avoid the memory pressure caused by traditional memory exhaustion technology, thereby reducing the system resource overhead of the hardware system analysis module.
[0066] Specifically, in practice, the system's hugepage feature or the side-channel of the cache can be used to bypass the operating system's process isolation mechanism and obtain the actual physical address of the target page. File memory mapping technology refers to allocating a special file in the file system and establishing a file-to-memory mapping; typically, the size of this file is equal to the capacity of the memory device. Next, utilizing the operating system's lazy allocation feature, memory is allocated only when a page is accessed, allowing for page-by-page access to gradually occupy the memory cache capacity. It's important to note that occupying the memory cache capacity does not affect the available memory capacity, thus avoiding excessive pressure on memory. When the file's memory buffer occupancy reaches a certain value, the target page in the memory buffer is removed from memory. At this point, accessing the target page again will cause the operating system to reallocate a new physical address for the target page, thus achieving page relocation. Testing shows that the above process takes only a few seconds. If it is necessary to locate the target page to a specific physical address, the above process needs to be repeated multiple times.
[0067] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM).
[0068] The above description is only a preferred embodiment of the present invention. It should be noted that those skilled in the art can make several improvements and additions without departing from the principle of the present invention, and these improvements and additions should also be considered within the scope of protection of the present invention.
Claims
1. A method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping, characterized in that... Includes the following steps: S1. The machine learning code library data acquisition module adds extended functions to the programmable compiler and inserts detection instructions into sensitive code in the machine learning code library. The sensitive code corresponds to one or more sensitive instructions. The detection instructions are used to collect the running data of the sensitive code in the machine learning code library on the machine learning model and dataset in the actual application scenario. S2, the imbalance calculation program module uses machine learning models and datasets from real-world application scenarios, runs machine learning code library data acquisition program module to obtain machine learning code library data acquisition data for insertion detection instructions, calculates and discovers risk-sensitive code points, that is, calculates and analyzes the imbalance of sensitive instructions, and determines the set of risk-sensitive instructions that are easily affected by memory fault injection vulnerabilities. S3, the hardware system analysis module, is based on the hardware system in actual use of the machine learning code library. It injects memory faults by injecting bit flips into the actual memory hardware to obtain the distribution file of fault injection vulnerabilities in the actual memory hardware. S4. The hardware system analysis program module analyzes each possible memory fault injection vulnerability in the risk-sensitive instruction set of the machine learning code library to see if it matches the actual memory hardware fault injection vulnerability distribution file, and obtains the vulnerability-sensitive instruction set for subsequent machine learning code library repair and maintenance. The sensitive code refers to branch jump statements in the machine learning codebase code, and the sensitive instructions refer to branch jump instructions; Step S2 specifically includes the following sub-steps: S21. The number of branches in the branch jump statement is exactly two, and the program control flow enters the branch. The number of times The probability of program control flow entering each branch : ; S22, Branch Jump Instruction Imbalance : The range of values is ; S23. Using machine learning models and datasets from real-world application scenarios, calculate and obtain the branch jump instructions. Imbalance If the threshold is exceeded, the branch jump instruction is susceptible to memory fault injection vulnerabilities and will be added to the risk-sensitive instruction set. .
2. The method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping, as described in claim 1, is characterized in that: The branch jump statements include if-else statements, while statements, and switch statements, and the branch jump instructions include if-else instructions, while instructions, and switch instructions.
3. The method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping, as described in claim 1, is characterized in that: The set threshold is 0.
5.
4. The method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping, as described in claim 1, is characterized in that... Step S3: The injected bit flipping is based on Rowhammer technology.
5. The method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping, as described in claim 1, is characterized in that... It also includes the following steps: S5. The hardware system analysis program module analyzes and confirms whether there are security issues in the vulnerability-sensitive instructions in the matched vulnerability-sensitive instruction set.
6. The method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping, as described in claim 5, is characterized in that... Step S5: Software simulations are used to simulate scenarios where vulnerable sensitive commands are exploited by malicious attackers to confirm whether security issues exist; Alternatively, memory page relocation can be used to place the sensitive code corresponding to the sensitive risk instructions in the machine learning codebase into the location of the fault injection vulnerability in the actual memory hardware. Memory fault injection can be performed by injecting bit flips into the actual memory hardware. The scenario of the vulnerable sensitive instructions being exploited by malicious attackers can be tested on the actual memory hardware system to confirm whether there is a security problem. Alternatively, the actual memory hardware fault injection vulnerability distribution file from step S3 can be used as one of the constraints of software simulation to simulate a scenario where vulnerability-sensitive instructions are exploited by malicious attackers to confirm whether a security issue exists.
7. The method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping, as described in claim 6, is characterized in that... The memory page relocation bypasses the operating system's process isolation mechanism to obtain the actual physical address of the target page. Specifically: S51. By utilizing the lazy allocation feature of the operating system, a physical address is allocated in memory only when the target page is accessed. The file content is accessed page by page to gradually occupy the memory buffer capacity until the target page in the memory buffer is moved out of memory. S52. When the target page is accessed again, the operating system will reallocate a new physical address for the target page, thereby achieving target page relocation. S53. Repeat steps S51 and S52 until the target page is relocated to the physical address corresponding to the location of the fault injection vulnerability in the actual memory hardware.
8. The method for detecting memory fault injection vulnerabilities in machine learning codebases based on bit flipping, as described in claim 7, is characterized in that: The memory page relocation utilizes the big page feature of the operating system or bypasses the process isolation mechanism of the operating system by using the side channel of the memory buffer.