Abnormality detection method and device, equipment and storage medium

Abstract

The embodiment of the invention provides an anomaly detection method and device, equipment and a storage medium, and the method comprises the steps: obtaining a first program physical address of a target program under the condition of detecting that the target program access exists in a system, retrieving the first program physical address in a pre-stored target initial physical address, if it is determined that the first program physical address belongs to the initial physical address according to the retrieval result, obtaining a first byte of the target program, comparing the first byte with a pre-stored target byte, and if it is determined that the first program physical address does not belong to the initial physical address according to the retrieval result, determining a first task identifier to which the target program belongs, and comparing the first task identifier with a pre-stored target task identifier, and determining an exception detection result of the target program according to a comparison result, so that the security and the stability of the chip embedding system are improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an anomaly detection method, device, equipment and storage medium. Background Art

[0002] At present, the main attack methods against chip embedded systems are virus intrusion attacks. The purpose of the attack includes stealing confidential information or affecting the normal operation of the system. Once the virus successfully invades the system, it will cause serious security threats and functional damage to the system. For example, the virus can replicate itself and spread to other programs or files, causing data loss or damage; or occupy a large amount of memory resources, causing the embedded system to run slowly or crash; or attack the data storage area, making the data or program unrecoverable; or delete, rename, encrypt, replace the file content, etc., causing file damage or loss, etc.

[0003] At present, the prevention of virus intrusion attacks mainly relies on anti-virus software and firewall technology. Anti-virus software, also known as anti-virus software or anti-virus software, is a type of software used to eliminate system threats such as system viruses, Trojans and malware. It usually integrates monitoring and identification, virus scanning and removal, automatic upgrades, active defense and other functions. Some anti-virus software also has data recovery, prevention of hacker intrusion, network traffic control and other functions. It is an important part of the defense system (including anti-virus software, firewalls, Trojan and malware detection and killing programs, intrusion prevention systems, etc.). The function of firewall technology is mainly to timely discover and deal with security risks and data transmission problems that may exist during the operation of the system network. The treatment measures include isolation and protection. At the same time, it can record and detect various operations in the system network security to ensure the security of the system network operation, protect the integrity of user data and information, and provide users with a better and safer network experience.

[0004] However, antivirus software is easily damaged during use, the virus database is difficult to update in a timely manner, and new viruses with unclear characteristics cannot be identified and disinfected. Firewalls only protect against external attacks but not internal attacks when in use. The processing performance is poor at certain times and the management of firewall rules is complex. Summary of the invention

[0005] The purpose of the embodiments of the present invention is to provide an anomaly detection method, device, equipment and storage medium to solve the problems that the antivirus software is easily damaged when using the chip for anomaly detection, the virus database is difficult to update in time, new viruses with unclear characteristics cannot be identified and disinfected, the firewall does not prevent the inside when used, the processing performance is poor at certain times, and the management of firewall rules is complicated. The specific technical solution is as follows:

[0006] In a first aspect of the present invention, a method for detecting anomalies is provided, the method comprising:

[0007] When it is detected that a target program is accessed in the system memory, obtaining a first program physical address of the target program;

[0008] Retrieving the first program physical address from the pre-stored target starting physical address;

[0009] If it is determined according to the search result that the first program physical address belongs to the starting physical address, obtaining the first byte of the target program and comparing the first byte with the pre-stored target byte;

[0010] If it is determined according to the search result that the first program physical address does not belong to the starting physical address, then determining a first task identifier to which the target program belongs, and comparing the first task identifier with a pre-stored target task identifier;

[0011] An abnormality detection result for the target program is determined according to the comparison result.

[0012] Optionally, before acquiring the first program physical address of the target program when detecting that the target program is accessed in the system memory, the method further includes:

[0013] Pre-setting a system software patch and a virus detection logic hardware module for the target hardware, wherein the virus detection logic hardware module includes a program information storage unit and an alarm logic unit, the system software patch is used to receive the alarm information sent by the virus detection logic hardware module, and the alarm logic unit is used to send a pause instruction to the processor;

[0014] Pre-setting a target storage structure for storing data for the program information storage unit;

[0015] When it is detected that the target hardware system is powered on, a number of programs to be executed within a target time period are determined by using the system software patch;

[0016] Obtaining target information of each of the programs to be executed, including a first starting physical address, a program size, a second byte and a second task identifier;

[0017] According to the target storage structure, the first starting physical address, the program size, the second byte and the second task identifier to which it belongs are stored in a program information storage unit, wherein the target information of each program to be executed belongs to a group of storage data stored according to the target storage structure;

[0018] Establish target association for each group of stored data;

[0019] When it is determined that the target information storage of several programs to be executed is completed, the first starting physical address in the program information storage unit is determined as the target starting physical address, the second byte in the program information storage unit is determined as the target byte, and the second task identifier in the program information storage unit is determined as the target task identifier.

[0020] Optionally, if it is determined according to the search result that the first program physical address belongs to the starting physical address, obtaining the first byte of the target program and comparing the first byte with a pre-stored target byte includes:

[0021] If it is found that the target starting physical address has a target physical address that is consistent with the first program physical address, determining that the first program physical address belongs to the starting physical address;

[0022] Determining, by means of the target association relationship, a third byte corresponding to the target physical address from pre-stored target bytes;

[0023] A first byte of the target program is obtained, and the first byte is compared with the third byte.

[0024] Optionally, determining the abnormality detection result of the target program according to the comparison result includes:

[0025] If the first byte is consistent with the third byte, it is determined that the target program is normal, and the target program is executed;

[0026] If the first byte is inconsistent with the third byte, the target program is determined to be abnormal, a pause instruction is sent to the processor, and an alarm message is sent to the system software patch so that the system software patch displays the alarm message on the target screen.

[0027] Optionally, if it is determined according to the search result that the first program physical address does not belong to the starting physical address, determining a first task identifier to which the target program belongs, and comparing the first task identifier with a pre-stored target task identifier, includes:

[0028] If no physical address consistent with the first program physical address is found in the target starting physical address, determining that the first program physical address does not belong to the starting physical address;

[0029] Then, a first task identifier to which the target program belongs is determined, and the first task identifier is compared with a pre-stored target task identifier.

[0030] Optionally, comparing the first task identifier with a pre-stored target task identifier further includes:

[0031] Acquire several groups of stored data in the program information storage unit;

[0032] Determine the target program physical address range of the program to be executed corresponding to each group of storage data by using the first starting physical address in the storage data and the program size;

[0033] Retrieving the first program physical address in the target program physical address range to determine a second starting physical address corresponding to the target program in the program information storage unit;

[0034] Determine, from the target task identifier, a third task identifier corresponding to the second starting physical address through the target association relationship;

[0035] The first task identifier is compared with the third task identifier.

[0036] Optionally, determining the abnormality detection result of the target program according to the comparison result further includes:

[0037] If the first task identifier is consistent with the third task identifier, determining that the target program is normal, and executing the target program;

[0038] If the first task identifier is inconsistent with the third task identifier, the target program is determined to be abnormal, a pause instruction is sent to the processor, and an alarm message is sent to the system software patch so that the system software patch displays the alarm message on the target screen.

[0039] In a second aspect of the present invention, there is also provided an abnormality detection device, comprising:

[0040] A first acquisition module, configured to acquire a first program physical address of a target program when detecting that a target program accesses the system memory;

[0041] A first retrieval module, used for retrieving the first program physical address from a pre-stored target starting physical address;

[0042] A second acquisition module, configured to acquire a first byte of the target program and compare the first byte with a pre-stored target byte if it is determined according to the search result that the first program physical address belongs to the starting physical address;

[0043] A first determination module, configured to determine a first task identifier to which the target program belongs if it is determined according to the search result that the first program physical address does not belong to the starting physical address, and compare the first task identifier with a pre-stored target task identifier;

[0044] The second determination module is used to determine the abnormality detection result of the target program according to the comparison result.

[0045] In a third aspect of the implementation of the present invention, there is also provided a communication device, comprising: a transceiver, a memory, a processor, and a program stored in the memory and executable on the processor;

[0046] The processor is used to read the program in the memory to implement any of the above-mentioned abnormality detection methods.

[0047] In a fourth aspect of the implementation of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute any of the above-mentioned anomaly detection methods.

[0048] The abnormality detection method provided by the embodiment of the present invention obtains the first program physical address of the target program when it is detected that there is a target program access in the system, and searches the first program physical address in the pre-stored target starting physical address. If it is determined according to the search result that the first program physical address belongs to the starting physical address, the first byte of the target program is obtained, and the first byte is compared with the pre-stored target byte. If it is determined according to the search result that the first program physical address does not belong to the starting physical address, the first task identifier to which the target program belongs is determined, and the first task identifier is compared with the pre-stored target task identifier. The abnormality detection result of the target program is determined according to the comparison result. In the embodiment of the present invention, different subsequent detection methods are determined by detecting the physical address of the target program. If it is determined to be the starting physical address, the first byte is compared. If it is not the starting physical address, the task identifier is compared, so as to realize the abnormality detection of the target program. This detection method can quickly and accurately identify the abnormality in the target hardware (chip), solves the problem that the antivirus software is easily damaged when using it, the virus library is difficult to update in time, and the new virus with unclear characteristics cannot be identified and disinfected. It also solves the problem that the firewall does not prevent the outside but not the inside, has poor performance and complex management, and improves the security and stability of the chip embedded system. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below.

[0050] Figure 1 A flowchart of a method for detecting anomalies according to an embodiment of the present invention;

[0051] Figure 2 for Figure 1 A diagram showing an architecture of an abnormality detection system provided by an embodiment of the present invention;

[0052] Figure 3 for Figure 1 The illustrated embodiment of the present invention provides a logic hardware module architecture diagram of virus detection in anomaly detection;

[0053] Figure 4 for Figure 1 A schematic diagram of a storage structure of a program information storage unit in anomaly detection provided by an embodiment of the present invention is shown;

[0054] Figure 5 for Figure 1 The flowchart of step 103 in anomaly detection provided by the embodiment of the present invention is shown;

[0055] Figure 6 for Figure 1 A schematic diagram of an alarm format of alarm information in anomaly detection provided by an embodiment of the present invention is shown;

[0056] Figure 7 is a structural schematic diagram of a fault handling device provided by an embodiment of the present invention;

[0057] Figure 8 It is a structural diagram of a communication device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0058] To make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present invention, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented. The division of the following embodiments is for the convenience of description, and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined and referenced with each other without contradiction.

[0059] Currently, virus intrusion attacks are mainly resolved through anti-virus software and firewall technology. However, anti-virus software programs are easily damaged, and the virus database of intranet anti-virus software is difficult to update in time. New viruses with unclear characteristics cannot be identified and disinfected. Firewalls are mainly designed to protect internal networks from external threats, so they cannot monitor the legitimate operations of internal network users. They can only protect against external threats but not internal ones, especially when internal network users become the source of attacks. Moreover, when processing large amounts of data streams and concurrent requests, firewalls may cause network congestion and reduce the speed of data stream processing. In addition, the management of firewall rules is complex and may cause rule conflicts, overlaps, or errors, thereby reducing security and making it difficult to cope with complex distributed network attacks. In this embodiment, the chip embedded system needs to be protected against intrusion, so a firewall cannot be used, and anti-virus software has certain defects. Therefore, an anomaly detection method provided in an embodiment of the present invention refers to Figure 1 , shows a flowchart of the steps of an abnormality detection method provided by an embodiment of the present invention, the method may include:

[0060] Step 101 : when it is detected that a target program is accessed in a system memory, a first program physical address of the target program is obtained.

[0061] In the embodiment of the present invention, the physical address is generated by a memory management unit or a similar hardware component, and it points to a specific location in the physical memory. Because the storage location of the target program in the memory is fixed, and the target program has a certain size, the target program will occupy a fixed location in the memory and a certain range of storage physical address space, and the first program physical address is a specific physical address in the storage physical address space.

[0062] It should be noted that the embodiment of the present invention detects the information of the target program on the chip embedded system, but preparations need to be made before the detection. To this end, the embodiment of the present invention sets up a system software patch and a virus detection logic hardware module, such as Figure 2 As shown, a system software patch is set on the operating system running on the chip. This is the software part, which is responsible for receiving the alarm information of the hardware part (chip), and setting the processor core, storage unit and virus detection logic hardware module on the chip. Among them, the storage unit stores a variety of information used and unused by the hardware part, including program information, and the virus detection logic hardware module is responsible for detecting hardware anomalies.

[0063] Specifically, multiple units are set in the virus detection logic hardware module, such as Figure 3As shown, it includes a control logic unit, a program information storage unit and an alarm logic unit. Among them, the control logic unit controls the work of the entire invention logic, searches for the storage logic through the program physical address operation, performs detection, can independently access the storage space, and obtains the relevant information of the storage file or program; the alarm logic unit sends an interrupt instruction (or a pause instruction) to the processor to let the system enter an idle state, only executing the system's necessary tasks and system patch programs, and at the same time, it will also send alarm information to the system software patch; a storage structure is set in the program information storage unit to store all program information running in the corresponding storage system. When storing data, it is necessary to first detect all possible executable programs through the system software patch, and then obtain the relevant data of all possible executable programs according to the storage requirements of the program information storage unit, and store them according to the storage structure of the program information storage unit. The specific steps include:

[0064] Pre-setting a system software patch and a virus detection logic hardware module for the target hardware, wherein the virus detection logic hardware module includes a program information storage unit and an alarm logic unit, the system software patch is used to receive alarm information sent by the virus detection logic hardware module, and the alarm logic unit is used to send a pause instruction to the processor;

[0065] Pre-setting a target storage structure for storing data for the program information storage unit;

[0066] When it is detected that the target hardware system is powered on, several programs to be executed within the target time period are determined through the system software patch;

[0067] Obtaining target information of each program to be executed, including a first starting physical address, a program size, a second byte and a second task identifier of the target information;

[0068] According to the target storage structure, the first starting physical address, the program size, the second byte and the corresponding second task identifier are stored in the program information storage unit, wherein the target information of each program to be executed belongs to a group of storage data stored according to the target storage structure;

[0069] Establish target association for each group of stored data;

[0070] When it is determined that the target information storage of several programs to be executed is completed, the first starting physical address in the program information storage unit is determined as the target starting physical address, the second byte in the program information storage unit is determined as the target byte, and the second task identifier in the program information storage unit is determined as the target task identifier.

[0071] The target hardware system can be a chip embedded system or a system of other hardware devices. When the system is powered on, there will be some self-starting programs due to the user's previous settings. At this time, these self-starting programs are several programs to be executed within the target time period when the system is powered on. The second byte of the program to be executed refers to the first 8 bytes of the program to be executed. The second task identifiers corresponding to different programs to be executed are different, so the unique program to be executed can be identified by the second task identifier.

[0072] For example, several groups of storage data are stored in the program information storage unit according to the target storage structure. The target storage structure includes a starting physical address column, a program size column, a first 8-byte column of the program, and a task identification column. Therefore, after obtaining the first starting physical address, program size, second byte, and second task identification of each program to be executed, the first starting physical address is stored in the starting physical address column, the program size is stored in the program size column, the second byte is stored in the first 8-byte column of the program, and the second task identification is stored in the task identification column. The first 8 bytes of the program contain user information, context information, etc. of the program. A row of data represents the information of a program, such as Figure 4 As shown, a set of storage data corresponding to program 0 in the program information storage unit includes: starting physical address 0, program size 0, first 8 bytes of program 0, and task identifier 0; a set of storage data corresponding to program 1 in the program information storage unit includes: starting physical address 1, program size 1, first 8 bytes of program 1, and task identifier 1; ...; a set of storage data corresponding to program X in the program information storage unit includes: starting physical address X, program size X, first 8 bytes of program X, and task identifier X. The target starting physical address obtained thereby includes: starting physical address 0, starting physical address 1...starting physical address X, target bytes include: first 8 bytes of program 0, first 8 bytes of program 1...first 8 bytes of program X, and target task identifiers include: task identifier 0, task identifier 1...task identifier X.

[0073] The above settings ensure that the hardware system can promptly detect potential viruses or malware with unclear or newly emerging features when running programs, and prevent the execution of these programs through alarms and pause instructions, thereby protecting the system from malware.

[0074] Step 102: Search the first program physical address from the pre-stored target starting physical addresses.

[0075] In the embodiment of the present invention, it is first determined whether the first program physical address is the starting physical address (first physical address) of the target program, so as to select different subsequent detection methods according to the determination result. The first program physical address is searched in the pre-stored target starting physical address by comparing the first program physical address with each first starting physical address in the target starting physical address to determine whether there is a completely consistent physical address.

[0076] Step 103: If it is determined according to the search result that the first program physical address belongs to the starting physical address, the first byte of the target program is obtained, and the first byte is compared with the pre-stored target byte.

[0077] In an embodiment of the present invention, if it is detected that the target starting physical address has a target physical address that is consistent with the first program physical address (this indicates that the target physical address and the character string content and the character order therein are completely consistent with the first program physical address), then it is considered that the first program physical address belongs to the starting physical address of the target program. At this time, the first byte of the target program will be obtained and compared with the pre-stored target byte. In addition, because the target physical address has been determined in the target starting physical address, and each group of storage data in the program information storage unit has a target association relationship, the storage data in the same group as the target physical address can be determined based on the target association relationship, and then the third byte corresponding to the target physical address can be determined. When comparing, the first byte is compared with the third byte.

[0078] Further, step 103, such as Figure 5 As shown, including:

[0079] Step 1031 , if the target starting physical address is found to be consistent with the first program physical address, it is determined that the first program physical address belongs to the starting physical address.

[0080] Step 1032: Determine the third byte corresponding to the target physical address from the pre-stored target bytes through the target association relationship.

[0081] Step 1033, obtain the first byte of the target program, and compare the first byte with the third byte.

[0082] In the above process, because the first program physical address is determined to be the starting physical address, the first byte obtained at this time is the first 8 bytes of the target program, and the second byte stored in the program information storage unit is also the first 8 bytes of the program to be executed. Therefore, at this time, whether there is an exception in the target program can be determined by comparing the first byte with the third byte.

[0083] By setting up a physical address detection mechanism to make a preliminary judgment on the target program and determine whether it is the starting physical address, it is convenient to perform more accurate detection based on the actual starting position of the program. This helps to reduce false positives and also reduces the time for abnormal detection.

[0084] Step 104: If it is determined according to the search result that the first program physical address does not belong to the starting physical address, then determine the first task identifier to which the target program belongs, and compare the first task identifier with a pre-stored target task identifier.

[0085] In the embodiment of the present invention, if it is detected that there is no target physical address consistent with the first program physical address in the target starting physical address, it means that the first program physical address of the target program obtained at this time is not the starting physical address, which means that the target program may be a program to be executed not from the beginning, but from a certain intermediate process, or it is not the starting physical address of the program to be executed, that is, there is a new program inserted for execution. For the former, since it is not executed from the beginning, the first 8 bytes obtained are not the first 8 bytes of the target program, but the 8 bytes of the intermediate process of the target program. At this time, the bytes cannot be obtained for comparison. Therefore, the embodiment of the present invention obtains the first task identifier to which the target program belongs and compares it with the target task identifier. The specific steps include:

[0086] If no physical address consistent with the first program physical address is found in the target starting physical address, it is determined that the first program physical address does not belong to the starting physical address;

[0087] Then, a first task identifier to which the target program belongs is determined, and the first task identifier is compared with a pre-stored target task identifier.

[0088] By determining whether the first program physical address of the target program is the starting physical address to execute different methods of detecting whether the target program has an exception, more accurate detection can be performed based on the actual starting position of the program, which helps to reduce false alarms and can skip certain time-consuming detection steps, thereby speeding up the loading and execution of the program.

[0089] Furthermore, in the embodiment of the present invention, before comparing the first task identifier with the pre-stored target task identifier, the second starting physical address of the target program is first determined by the first program physical address, and then the third task identifier corresponding to the second starting physical address in the program information storage unit is determined according to the target association relationship, and then the first task identifier to which the target program belongs is obtained, and the third task identifier is compared with the first task identifier to determine whether the target program has an abnormality. The specific steps include:

[0090] Acquire several groups of stored data in the program information storage unit;

[0091] Determine the target program physical address range of the program to be executed corresponding to each group of stored data by using the first starting physical address in the stored data and the program size;

[0092] Retrieving the first program physical address in the target program physical address range to determine the second starting physical address corresponding to the target program in the program information storage unit;

[0093] Determine, from the target task identifier, a third task identifier corresponding to the second starting physical address through the target association relationship;

[0094] The first task identifier is compared with the third task identifier.

[0095] For example, several groups of stored data in the program information storage unit include: the starting physical address of task 0 is 00000000, and the program size is 128 bytes; the starting physical address of task 1 is 00000080, and the program size is 128 bytes, so the target program physical address range of task 0 is [00000000~0000007F], the target program physical address range of task 1 is [00000080~00000100], the first program physical address is 00000064, which is in [00000000~0000007F], so the corresponding second starting physical address of the target program is 00000000, and the third task identifier determined at this time is task 0.

[0096] By verifying the program's starting physical address and task identification, the system can prevent unauthorized program execution, detect potential security threats, and protect the system from malware.

[0097] In addition, since the information of several programs to be executed within the target time period is obtained and stored in the program information storage unit, the newly inserted execution program will also be determined as an abnormal program, but in fact the program is normal, so the storage data in the program information storage unit needs to be updated according to this situation. The specific steps include:

[0098] Retrieving the first program physical address in the target program physical address range;

[0099] If the first program physical address is retrieved and does not belong to the target program physical address range, a pause instruction is sent to the processor, and an exception confirmation selection prompt is sent to the system software patch, wherein the exception confirmation selection prompt includes an exception selection and a non-exceptional selection;

[0100] In response to a user input of a non-exceptional selection, obtaining a first task identifier, a first byte and a size of the target program to which the target program belongs;

[0101] According to the target storage structure, the first program physical address, the target program size, the first byte and the corresponding first task identifier are stored in the program information storage unit.

[0102] The above settings allow the system to update the stored data through the confirmation of the user or administrator when a newly inserted program is detected, thus avoiding misjudgment as an abnormal program. This increases the flexibility and adaptability of the system.

[0103] In addition, the system will still pause the execution of the program before the user confirms to ensure that the security of the system is not threatened.

[0104] Step 105: Determine an abnormality detection result for the target program according to the comparison result.

[0105] The embodiment of the present invention has two comparison methods according to whether the first program physical address is the starting physical address. If it is determined that the first program physical address is the starting physical address, the first byte of the target program is compared with the pre-stored target byte. If they are consistent, the relevant data of the target program is returned to the processor, and the target program is executed by the processor. If they are inconsistent, a pause instruction is sent to the processor, and an alarm message is sent to the system software patch. After the system patch module receives it, the dangerous task identification and related information are displayed on the screen, and the management personnel are reminded to deal with it urgently. The specific steps include:

[0106] If the first byte is consistent with the third byte, the target program is determined to be normal and the target program is executed;

[0107] If the first byte is inconsistent with the third byte, the target program is determined to be abnormal, a pause instruction is sent to the processor, and an alarm message is sent to the system software patch so that the system software patch displays the alarm message on the target screen.

[0108] If the first byte is consistent with the third byte, it is considered that the target program is normal at this time and the beginning part of the program has not been modified or damaged. If the first byte is inconsistent with the third byte, it is considered that the target program has been modified, damaged or implanted with malicious code. At this time, the alarm logic unit in the virus detection logic hardware module sends a pause instruction to the processor to put the system into an idle state to prevent potential malware from causing damage to the system. This reflects the system's rapid response mechanism when a program abnormality is detected, ensuring the security and stability of the system.

[0109] If it is determined that the first program physical address is not the starting physical address, the first task identifier of the target program is compared with the pre-stored target task identifier. If they are consistent, the relevant data of the target program is returned to the processor, and the target program is executed by the processor. If they are inconsistent, a pause instruction is sent to the processor, and an alarm message is sent to the system software patch. After receiving the dangerous task identifier and related information, the system patch module displays the dangerous task identifier and related information on the screen, and reminds the management personnel to deal with it urgently. The specific steps include:

[0110] If the first task identifier is consistent with the third task identifier, it is determined that the target program is normal, and the target program is executed;

[0111] If the first task identifier is inconsistent with the third task identifier, the target program is determined to be abnormal, a pause instruction is sent to the processor, and an alarm message is sent to the system software patch so that the system software patch displays the alarm message on the target screen.

[0112] It should be noted that, in the embodiment of the present invention, a prescribed alarm format is also set when sending alarm information, such as Figure 6 As shown, it includes the task identifier of the abnormal program, the storage physical address, the access time, the existence time and the user name, wherein the storage physical address can be the starting physical address of the abnormal program stored on the chip or the storage physical address range of the entire occupied storage space, the access time is the time point when the abnormal program arrives at the chip embedded system, the existence time is the time period from the abnormal program arriving at the chip embedded system to the detection of the abnormality, and the user name is the user identifier carried by the abnormal program.

[0113] The abnormality detection method provided by the embodiment of the present invention obtains the first program physical address of the target program when it is detected that there is a target program access in the system, and searches the first program physical address in the pre-stored target starting physical address. If it is determined according to the search result that the first program physical address belongs to the starting physical address, the first byte of the target program is obtained, and the first byte is compared with the pre-stored target byte. If it is determined according to the search result that the first program physical address does not belong to the starting physical address, the first task identifier to which the target program belongs is determined, and the first task identifier is compared with the pre-stored target task identifier. The abnormality detection result of the target program is determined according to the comparison result. In the embodiment of the present invention, different subsequent detection methods are determined by detecting the physical address of the target program. If it is determined to be the starting physical address, the first byte is compared. If it is not the starting physical address, the task identifier is compared, so as to realize the abnormality detection of the target program. This detection method can quickly and accurately identify the abnormality in the target hardware (chip), solves the problem that the antivirus software is easily damaged when using it, the virus library is difficult to update in time, and the new virus with unclear characteristics cannot be identified and disinfected, and also solves the problem that the firewall does not prevent the inside but prevents the outside, has poor performance and complex management.

[0114] Reference Figure 7 , which shows a schematic diagram of the structure of an abnormality detection device provided by an embodiment of the present invention, such as Figure 7 As shown, the device may include:

[0115] The first acquisition module 201 is used to acquire a first program physical address of a target program when it is detected that the target program accesses the system memory.

[0116] The first search module 202 is used to search the first program physical address in the pre-stored target starting physical addresses.

[0117] The second acquisition module 203 is used to acquire the first byte of the target program and compare the first byte with the pre-stored target byte if it is determined according to the search result that the first program physical address belongs to the starting physical address.

[0118] The first determination module 204 is used to determine the first task identifier to which the target program belongs if it is determined according to the search result that the first program physical address does not belong to the starting physical address, and compare the first task identifier with a pre-stored target task identifier.

[0119] The second determination module 205 is used to determine the abnormality detection result of the target program according to the comparison result.

[0120] Optionally, the anomaly detection device further includes:

[0121] The first setting module is used to pre-set the system software patch and the virus detection logic hardware module for the target hardware, wherein the virus detection logic hardware module includes a program information storage unit and an alarm logic unit, the system software patch is used to receive the alarm information sent by the virus detection logic hardware module, and the alarm logic unit is used to send a pause instruction to the processor.

[0122] The second setting module is used to pre-set a target storage structure for storing data for the program information storage unit.

[0123] The third determination module is used to determine a number of programs to be executed within a target time period through a system software patch when it is detected that the target hardware system is powered on.

[0124] The third acquisition module is used to acquire the target information of each program to be executed, the target information first starting physical address, program size, second byte and the second task identifier.

[0125] The first storage module is used to store the first starting physical address, program size, second byte and the corresponding second task identifier into the program information storage unit according to the target storage structure, wherein the target information of each program to be executed belongs to a group of storage data stored according to the target storage structure.

[0126] The relationship building module is used to establish a target association relationship for each group of stored data.

[0127] The fourth determination module is used to determine the first starting physical address in the program information storage unit as the target starting physical address, the second byte in the program information storage unit as the target byte, and the second task identifier in the program information storage unit as the target task identifier when it is determined that the target information storage of several programs to be executed is completed.

[0128] Optionally, the second acquisition module 203 specifically includes:

[0129] The first determination submodule is used to determine that the first program physical address belongs to the starting physical address if a target starting physical address that is consistent with the first program physical address is found.

[0130] The second determining submodule is used to determine the third byte corresponding to the target physical address from the pre-stored target bytes through the target association relationship.

[0131] The first comparison submodule is used to obtain the first byte of the target program and compare the first byte with the third byte.

[0132] Optionally, the second determining module 205 specifically includes:

[0133] The third determination submodule is used to determine that the target program is normal and execute the target program if the first byte is consistent with the third byte.

[0134] The fourth determination submodule is used to determine that the target program is abnormal if the first byte is inconsistent with the third byte, send a pause instruction to the processor, and send an alarm message to the system software patch so that the system software patch displays the alarm message on the target screen.

[0135] Optionally, the first determining module 204 specifically includes:

[0136] The fifth determining submodule is configured to determine that the first program physical address does not belong to the starting physical address if no physical address consistent with the first program physical address is found in the target starting physical address.

[0137] The second comparison submodule is used to determine the first task identifier to which the target program belongs, and compare the first task identifier with a pre-stored target task identifier.

[0138] Optionally, the second comparison submodule specifically includes:

[0139] The acquisition unit is used to acquire several groups of stored data in the program information storage unit.

[0140] The first determining unit is used to determine a target program physical address range of a to-be-executed program corresponding to each group of storage data according to a first starting physical address in the storage data and a program size.

[0141] The second determining unit is used to search the first program physical address in the target program physical address range to determine the second starting physical address corresponding to the target program in the program information storage unit.

[0142] The third determining unit is used to determine a third task identifier corresponding to the second starting physical address from the target task identifier through the target association relationship.

[0143] The comparing unit is used to compare the first task identifier with the third task identifier.

[0144] Optionally, the second determining module 205 specifically further includes:

[0145] The sixth determination submodule is used to determine that the target program is normal and execute the target program if the first task identifier is consistent with the third task identifier.

[0146] The seventh determination submodule is used to determine that the target program is abnormal if the first task identifier is inconsistent with the third task identifier, send a pause instruction to the processor, and send an alarm message to the system software patch so that the system software patch displays the alarm message on the target screen.

[0147] The abnormality detection method provided by the embodiment of the present invention obtains the first program physical address of the target program when it is detected that there is a target program access in the system, and searches the first program physical address in the pre-stored target starting physical address. If it is determined according to the search result that the first program physical address belongs to the starting physical address, the first byte of the target program is obtained, and the first byte is compared with the pre-stored target byte. If it is determined according to the search result that the first program physical address does not belong to the starting physical address, the first task identifier to which the target program belongs is determined, and the first task identifier is compared with the pre-stored target task identifier. The abnormality detection result of the target program is determined according to the comparison result. In the embodiment of the present invention, different subsequent detection methods are determined by detecting the physical address of the target program. If it is determined to be the starting physical address, the first byte is compared. If it is not the starting physical address, the task identifier is compared, so as to realize the abnormality detection of the target program. This detection method can quickly and accurately identify the abnormality in the target hardware (chip), solves the problem that the antivirus software is easily damaged when using it, the virus library is difficult to update in time, and the new virus with unclear characteristics cannot be identified and disinfected, and also solves the problem that the firewall does not prevent the inside but prevents the outside, has poor performance and complex management.

[0148] The embodiment of the present invention also provides a communication device, such as Figure 8 As shown, it includes a processor 301, a communication interface 302, a memory 303 and a communication bus 304, wherein the processor 301, the communication interface 302, and the memory 303 communicate with each other through the communication bus 304.

[0149] Memory 303, used for storing computer programs;

[0150] The processor 301 is used to execute the program stored in the memory 303 to implement the following steps:

[0151] When it is detected that a target program is accessed in the system memory, obtaining a first program physical address of the target program;

[0152] Retrieving the first program physical address from the pre-stored target starting physical address;

[0153] If it is determined according to the search result that the first program physical address belongs to the starting physical address, obtaining the first byte of the target program and comparing the first byte with the pre-stored target byte;

[0154] If it is determined according to the search result that the first program physical address does not belong to the starting physical address, then determining a first task identifier to which the target program belongs, and comparing the first task identifier with a pre-stored target task identifier;

[0155] An abnormality detection result for the target program is determined according to the comparison result.

[0156] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0157] The communication interface is used for communication between the above terminal and other devices.

[0158] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0159] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0160] The present invention also provides a readable storage medium, when the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the abnormality detection method of the aforementioned embodiment.

[0161] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0162] The algorithm and display provided herein are not inherently related to any particular computer, virtual device or other equipment. According to the above description, it is obvious that the structure required for constructing this type of device is. In addition, the present invention is not directed to any specific programming language. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific language is to disclose the best mode of the present invention.

[0163] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0164] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than those expressly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in less than all of the features of the individual embodiments disclosed above. Therefore, the claims that follow the detailed description are hereby expressly incorporated into the detailed description, with each claim itself serving as a separate embodiment of the present invention.

[0165] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0166] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components in the sorting device according to the present invention. The present invention may also be implemented as a device or apparatus program for executing part or all of the methods described herein. Such a program for implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0167] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

[0168] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices, apparatuses and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0169] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0170] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

[0171] It should be noted that the various data-related processes in the embodiments of the present application are all carried out in compliance with the corresponding data protection laws and policies of the country where the device is located, and with the authorization given by the owner of the corresponding device.

Claims

1. An anomaly detection method, characterized in that: The method comprises: When it is detected that a target program is accessed in the system memory, obtaining a first program physical address of the target program; Retrieving the first program physical address from the pre-stored target starting physical address; If it is determined according to the search result that the first program physical address belongs to the starting physical address, obtaining the first byte of the target program and comparing the first byte with the pre-stored target byte; If it is determined according to the search result that the first program physical address does not belong to the starting physical address, then determining a first task identifier to which the target program belongs, and comparing the first task identifier with a pre-stored target task identifier; An abnormality detection result for the target program is determined according to the comparison result.

2. The method according to claim 1, characterized in that Before acquiring the first program physical address of the target program when detecting that the target program accesses the system memory, the method further includes: Pre-setting a system software patch and a virus detection logic hardware module for the target hardware, wherein the virus detection logic hardware module includes a program information storage unit and an alarm logic unit, the system software patch is used to receive the alarm information sent by the virus detection logic hardware module, and the alarm logic unit is used to send a pause instruction to the processor; Pre-setting a target storage structure for storing data for the program information storage unit; When it is detected that the target hardware system is powered on, a number of programs to be executed within a target time period are determined by using the system software patch; Obtaining target information of each of the programs to be executed, including a first starting physical address, a program size, a second byte and a second task identifier; According to the target storage structure, the first starting physical address, the program size, the second byte and the second task identifier to which it belongs are stored in a program information storage unit, wherein the target information of each program to be executed belongs to a group of storage data stored according to the target storage structure; Establish target association for each group of stored data; When it is determined that the target information storage of several programs to be executed is completed, the first starting physical address in the program information storage unit is determined as the target starting physical address, the second byte in the program information storage unit is determined as the target byte, and the second task identifier in the program information storage unit is determined as the target task identifier.

3. The method according to claim 2, characterized in that If it is determined according to the search result that the first program physical address belongs to the starting physical address, obtaining the first byte of the target program and comparing the first byte with the pre-stored target byte include: If it is found that the target starting physical address has a target physical address that is consistent with the first program physical address, determining that the first program physical address belongs to the starting physical address; Determining, by means of the target association relationship, a third byte corresponding to the target physical address from pre-stored target bytes; A first byte of the target program is obtained, and the first byte is compared with the third byte.

4. The method according to claim 3, characterized in that Determining the abnormality detection result of the target program according to the comparison result includes: If the first byte is consistent with the third byte, it is determined that the target program is normal, and the target program is executed; If the first byte is inconsistent with the third byte, the target program is determined to be abnormal, a pause instruction is sent to the processor, and an alarm message is sent to the system software patch so that the system software patch displays the alarm message on the target screen.

5. The method according to claim 2, characterized in that: If it is determined according to the search result that the first program physical address does not belong to the starting physical address, then determining the first task identifier to which the target program belongs, and comparing the first task identifier with a pre-stored target task identifier, including: If no physical address consistent with the first program physical address is found in the target starting physical address, determining that the first program physical address does not belong to the starting physical address; Then, a first task identifier to which the target program belongs is determined, and the first task identifier is compared with a pre-stored target task identifier.

6. The method according to claim 5, characterized in that The comparing the first task identifier with a pre-stored target task identifier also includes: Acquire several groups of stored data in the program information storage unit; Determine the target program physical address range of the program to be executed corresponding to each group of storage data by using the first starting physical address in the storage data and the program size; Retrieving the first program physical address in the target program physical address range to determine a second starting physical address corresponding to the target program in the program information storage unit; Determine, from the target task identifier, a third task identifier corresponding to the second starting physical address through the target association relationship; The first task identifier is compared with the third task identifier.

7. The method according to claim 6, characterized in that The step of determining the abnormality detection result of the target program according to the comparison result further includes: If the first task identifier is consistent with the third task identifier, determining that the target program is normal, and executing the target program; If the first task identifier is inconsistent with the third task identifier, the target program is determined to be abnormal, a pause instruction is sent to the processor, and an alarm message is sent to the system software patch so that the system software patch displays the alarm message on the target screen.

8. An abnormality detection device, characterized in that: include: A first acquisition module is used to acquire a first program physical address of the target program when it is detected that the target program is accessed in the system; A first retrieval module, used for retrieving the first program physical address from a pre-stored target starting physical address; A second acquisition module, configured to acquire a first byte of the target program and compare the first byte with a pre-stored target byte if it is determined according to the search result that the first program physical address belongs to the starting physical address; A first determination module, configured to determine a first task identifier to which the target program belongs if it is determined according to the search result that the first program physical address does not belong to the starting physical address, and compare the first task identifier with a pre-stored target task identifier; The second determination module is used to determine the abnormality detection result of the target program according to the comparison result.

9. A communication device, characterized in that: include: A transceiver, a memory, a processor, and a program stored on the memory and executable on the processor; The processor is used to read the program in the memory to implement the steps in the abnormality detection method as described in any one of claims 1-7.

10. A readable storage medium for storing a program, characterized in that: When the stored program is executed by a processor, the steps of the abnormality detection method as described in any one of claims 1 to 7 are implemented.

Images