A trusted computing method and system

Abstract

The present invention relates to the field of trusted computing technology, and in particular to a trusted computing method and system. In the present invention, by reading historical component data and real-time component data, a static component hash value is calculated according to the component binary in the historical component data; an abnormal analysis model is constructed according to the component behavior and component state in the historical component data; a hash value corresponding to the component in the real-time component data is calculated according to the component binary in the real-time component data, and the hash value is compared with the static component hash value to generate a hash comparison result; a dynamic trust score is predicted according to the component behavior in the real-time component data and the constructed abnormal analysis model; a comprehensive metric value is calculated according to the hash comparison result and the dynamic trust score; the comprehensive metric values ​​corresponding to all components in the real-time component data are calculated, and fluctuations are checked to determine whether the current state of each component is credible and the untrustworthy position.

Description

Technical Field

[0001] The present invention relates to the field of trusted computing technology, and in particular to a trusted computing method and system. Background Art

[0002] Traditional trusted computing systems often rely on static behavioral baselines to perform trustworthiness assessments when faced with dynamic changes in component behavior. This approach has many technical limitations.

[0003] First, system updates or configuration changes often lead to legitimate changes in component behavior, but static behavior baselines cannot adapt to these changes and are prone to misjudging normal component behavior as abnormal, resulting in a large number of false positives. This not only increases the burden on system operation and maintenance, but may also cause interference with normal operations and false blocking.

[0004] Secondly, traditional trusted computing systems usually rely only on binary file hash comparison to determine the integrity of components. Although this method can detect whether a component has been tampered with, it cannot evaluate the trustworthiness of the component's behavior during runtime. If you only rely on hash comparison results, you may miss some components with abnormal behavior because the binary files of these components may not have been tampered with, but their running behavior is abnormal.

[0005] In addition, traditional systems lack effective anomaly analysis mechanisms and are unable to dynamically predict and identify the degree of abnormality of component behavior, resulting in untimely or inaccurate responses when faced with real security threats. At the same time, static integrity verification and behavior assessment methods are insufficiently flexible and unable to provide comprehensive security protection when faced with complex and changing operating environments. These technical issues make traditional trusted computing systems unable to cope with modern dynamic and complex computing environments, and it is difficult to take into account the comprehensive and accurate assessment of component integrity and behavior credibility. Summary of the invention

[0006] The purpose of the present invention is to provide a trusted computing method and system to solve the problems raised in the above background technology.

[0007] To achieve the above objectives, one of the objectives of the present invention is to provide a trusted computing system, including a data reading module, a dynamic and static analysis module, a comprehensive measurement module and a trusted verification module, wherein:

[0008] The data reading module reads historical component data and real-time component data; wherein the historical component data and the real-time component data both include components, component binaries and component behaviors, and the historical component data also includes component states;

[0009] The dynamic and static analysis module calculates the hash value of each component according to the component binary in the historical component data as the static component hash value; constructs an abnormal analysis model according to the component behavior and component status in the historical component data, and the constructed abnormal analysis model is used to predict the abnormal degree value;

[0010] The comprehensive metric module calculates the hash value corresponding to the component in the real-time component data according to the component binary in the real-time component data, and compares it with the static component hash value to generate a hash comparison result; predicts the abnormality degree value corresponding to the component in the real-time component data according to the component behavior in the real-time component data and the constructed abnormality analysis model, and uses the inverse of the abnormality degree value as the dynamic trust score; calculates the comprehensive metric value according to the hash comparison result and the dynamic trust score;

[0011] The trusted verification module calculates the comprehensive measurement values ​​corresponding to all components in the real-time component data and performs fluctuation checks. By calculating the degree of deviation between the comprehensive measurement value corresponding to each component and its average value, it determines whether the current state of each component is trustworthy. If it is untrustworthy, the dynamic trust score and hash comparison result corresponding to the untrustworthy component are checked separately to determine the untrustworthy location.

[0012] As a further improvement of the present technical solution, the dynamic and static analysis module includes a static analysis unit, which reads the binary file of each component from the historical component data and uses a hash algorithm to calculate the hash value of each component binary; the hash algorithm converts the binary file into a string of fixed length, which uniquely identifies the binary file; and stores the calculated hash value as the static hash value of the component.

[0013] As a further improvement of the technical solution, the dynamic and static analysis module includes a dynamic analysis unit, and the process of the dynamic analysis unit constructing the abnormal analysis model specifically includes:

[0014] Extract behavioral features from component behaviors in historical component data, including the number of file reads, network accesses, and memory operations, and merge the extracted behavioral features into a behavioral feature vector; generate labels based on component status, where the normal status is 0 and the abnormal status is 1;

[0015] Randomly select a behavior feature in a behavior feature vector, and randomly select a split point between the minimum and maximum values ​​of the feature, recursively split the data until each component in the historical component data is isolated; each split generates a new tree node, and the leaf node of the tree contains a single data sample that is isolated; the depth of the tree reflects the number of steps required to isolate the sample; a forest is formed by multiple trees, each of which is built based on different randomly selected behavior features and split points;

[0016] For each component behavior and component state corresponding to the historical component data, calculate its depth in the tree. The depth represents the length of the path that the sample passes from the root to the leaf node, that is, the number of steps required for the sample to be isolated.

[0017] For each component in the historical component data, the abnormality value is calculated according to its depth in the tree. , the calculation formula is as follows:

[0018] ,in Yes all The average depth of components, Indicates the depth of the component in the tree.

[0019] As a further improvement of the technical solution, the process of generating the hash comparison result by the comprehensive metric module specifically includes:

[0020] Calculate the hash value corresponding to the component in the real-time component data according to the component binary in the real-time component data, and process each component binary file in the real-time component data by using the same hash algorithm as the static analysis unit to generate a corresponding hash value as the real-time component hash value;

[0021] The real-time component hash value is compared with the static component hash value. The hash comparison result is used to determine whether the component binary file has been tampered with, where:

[0022] If the real-time component hash value is consistent with the static component hash value, the hash comparison result is normal and is quantized to 1;

[0023] If the real-time component hash value is inconsistent with the static component hash value, the hash comparison result is abnormal and is quantized to 0.

[0024] As a further improvement of the technical solution, the process of calculating the comprehensive metric value by the comprehensive metric module specifically includes:

[0025] Extract the behavior features of each component from the real-time component data as the real-time component behavior features; input the extracted real-time component behavior features into the constructed anomaly analysis model; calculate the depth of each component in the model tree by recursively and randomly splitting the feature space, and calculate the abnormality value of the component based on the depth, and calculate the dynamic trust score by the inverse of the abnormality value;

[0026] Combine the hash comparison results and the dynamic trust score to calculate the comprehensive measurement value of each component. By setting the component integrity weight and the behavior credibility weight, the hash comparison results and the dynamic trust score are weighted and summed; the component integrity weight is used to adjust the hash comparison results, and the behavior credibility weight is used to adjust the dynamic trust score.

[0027] As a further improvement of the technical solution, the process of the trusted verification module performing fluctuation detection specifically includes:

[0028] Calculate the average value of the comprehensive measurement values ​​of all components in the real-time component data. This average value represents the overall trust level of the components in the system. For each component, calculate the degree of deviation of its comprehensive measurement value from the average value, and calculate the degree of deviation of the component by the absolute value difference method.

[0029] According to the degree of deviation, each component is sorted from large to small to generate a sorted list; a deviation threshold is set, components in the sorted list are selected in turn, and compared with the deviation threshold. If the deviation of the component is less than the deviation threshold, the current state of the component is credible; otherwise, it is untrustworthy; if it is untrustworthy, the dynamic trust score and hash comparison result corresponding to the untrustworthy component are checked respectively to determine the untrustworthy position, including:

[0030] Obtain the dynamic trust score and hash comparison result corresponding to the untrusted component, and analyze the dynamic trust score and hash comparison result respectively;

[0031] For dynamic trust scores, if the size of the dynamic trust score is lower than the specified threshold, the behavior feature with the highest abnormality value is selected as the untrustworthy location according to the abnormality analysis model;

[0032] For the hash comparison result, if the hash comparison result is 1, the binary data corresponding to the component is divided into several blocks, the hash value of each block is calculated separately, the hash value of each block is compared with the corresponding static hash value, the tampered block is identified, and the specific byte position that is modified is determined as the untrusted position.

[0033] A second object of the present invention is to provide a method for using the above-mentioned trusted computing system, comprising the following method steps:

[0034] S1. Read historical component data and real-time component data; the historical component data includes components, component binaries, component behaviors, and component states; the real-time component data does not include component states;

[0035] S2. Calculate the hash value of each component as the static component hash value based on the component binary in the historical component data; construct an abnormality analysis model based on the component behavior and component status in the historical component data, and use the constructed abnormality analysis model to predict the abnormality degree value;

[0036] S3. Calculate the hash value corresponding to the component in the real-time component data according to the component binary in the real-time component data, and compare it with the static component hash value to generate a hash comparison result; predict the abnormality degree value corresponding to the component in the real-time component data according to the component behavior in the real-time component data and the constructed abnormality analysis model, and use the inverse of the abnormality degree value as the dynamic trust score; calculate the comprehensive metric value according to the hash comparison result and the dynamic trust score;

[0037] S4. Calculate the comprehensive metric values ​​corresponding to all components in the real-time component data, and perform fluctuation checks. Determine whether the current state of each component is credible by calculating the degree of deviation between the comprehensive metric value corresponding to each component and its average value. If it is untrustworthy, check the dynamic trust score and hash comparison results corresponding to the untrustworthy component to determine the untrustworthy location.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] This trusted computing method and system calculates a static hash value based on the component binary file in the historical component data, and recalculates the hash value in the real-time component data. By comparing the two, it is determined whether the component binary file has been tampered with, which ensures the integrity of the component; however, the hash comparison result alone is not enough to fully evaluate the trustworthiness of the component, because legitimate behavior changes (such as system updates) may cause hash value changes but do not mean that the component is untrustworthy; therefore, the system further introduces a dynamic trust score, which is based on an anomaly analysis model and predicts its abnormality value by analyzing the real-time behavior characteristics of the component; the dynamic trust score can not only adapt to the legitimate changes in component behavior, but also accurately identify abnormal behavior, thereby effectively avoiding the false positive problem caused by the static baseline. Through the combination of hash comparison results and dynamic trust scores, the system can not only ensure the integrity of the component, but also dynamically evaluate its behavior credibility, thereby greatly improving the accuracy and security of the system.

[0040] In addition, hash comparison results and dynamic trust scores have demonstrated their important role in multiple key links, ensuring that the trust evaluation of components is comprehensive and accurate. First, by comparing the hash values ​​of real-time component data and static data, hash comparison results can quickly identify whether component binary files have been tampered with, thereby ensuring the integrity of the component. However, relying solely on hash comparison is not comprehensive enough, so the system further introduces dynamic trust scores, which are based on anomaly analysis models and evaluate the degree of abnormality of component behavior, thereby making up for the deficiency that hash comparison alone cannot determine behavioral abnormalities. Next, the system calculates the comprehensive metric values ​​of all components, combines hash comparison results and dynamic trust scores, and derives the overall credibility of each component. By comparing the comprehensive metric value of the component with its average value, the system can determine whether the component is in a trusted state. For those components that are judged to be untrustworthy, the system will further analyze the hash comparison results and dynamic trust scores in detail: if the dynamic trust score is low, the system will determine the behavioral features with the highest abnormality value based on the abnormal analysis model; if the hash comparison result is abnormal, the system will accurately locate the tampered binary block through block hash comparison; this double verification and multi-level analysis mechanism can not only comprehensively and accurately evaluate the credibility of the component, but also accurately locate the problem when it is found, ensuring the overall security and stability of the system. Through the synergy of hash comparison results and dynamic trust scores, the system realizes all-round monitoring and accurate judgment of component status, effectively improving security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a schematic diagram of the overall method flow of the present invention;

[0042] Figure 2 It is a schematic diagram of the overall module unit of the present invention;

[0043] Figure 3 It is a schematic diagram of the system layer and virtual layer structure of the present invention.

[0044] In the figure: 100, data reading module; 200, dynamic and static analysis module; 201, static analysis unit; 202, dynamic analysis unit; 300, comprehensive measurement module; 400, trusted verification module. DETAILED DESCRIPTION

[0045] The following will be combined with the accompanying drawings in the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Next, see Figure 1-Figure 2 One of the purposes of this embodiment is to provide a trusted computing system, including a data reading module 100, a dynamic and static analysis module 200, a comprehensive measurement module 300 and a trusted verification module 400.

[0047] The data reading module 100 reads historical component data and real-time component data; wherein the historical component data includes components, component binaries, component behaviors and component states, specifically including:

[0048] Component: A unique identification name for each component. For example, component A may be a module responsible for processing file reading. It is used to match components in historical component data and real-time component data, and to distinguish different components when analyzing component behavior later.

[0049] Component binary: The binary code or executable file of the component, which is used to calculate the hash value to determine the integrity of the component;

[0050] Component behavior: The behavior exhibited by the component during execution, such as file reading, network access, memory operation, etc.; used to train the anomaly analysis model and predict the degree of abnormality of component behavior;

[0051] Component status: The internal status of a component at a certain point in time, such as whether it is running or blocked; used to analyze the running status of the component and determine whether it is abnormal.

[0052] The real-time component data read by the data reading module 100 does not include the component status, and other data feature types are consistent with the historical component data.

[0053] The static analysis unit 201 in the dynamic and static analysis module 200 calculates the hash value of each component as the static component hash value according to the component binary in the historical component data, which specifically includes:

[0054] Read the binary file of each component from the historical component data, and use a hash algorithm (such as SHA-256) to calculate the hash value of each component binary; the hash algorithm converts the binary file into a fixed-length string that uniquely identifies the binary file; the calculated hash value is stored as the static hash value of the component; in the subsequent process, the hash value calculated based on the real-time component data will be compared with the static hash value to determine whether the component binary has been tampered with; the static hash value is an important indicator of component integrity and directly affects the credibility assessment of the component.

[0055] The dynamic analysis unit 202 in the dynamic and static analysis module 200 constructs an abnormal analysis model based on the component behavior and component status in the historical component data. The constructed abnormal analysis model is used to predict the abnormal degree value, specifically including:

[0056] Extract behavioral features from component behaviors in historical component data, including the number of file reads, network accesses, and memory operations, and merge the extracted behavioral features into a behavioral feature vector; generate labels based on component status, where the normal status is 0 and the abnormal status is 1. For example, if a component is blocked at a certain point in time, its status label is 1 (abnormal);

[0057] Randomly select a behavior feature in a behavior feature vector, and randomly select a split point between the minimum and maximum values ​​of the feature, recursively split the data until each component in the historical component data is isolated; each split generates a new tree node, and the leaf node of the tree contains a single data sample that is isolated; the depth of the tree reflects the number of steps required to isolate the sample; a forest is formed by multiple trees, each of which is built based on different randomly selected behavior features and split points;

[0058] For each component behavior and component state corresponding to the historical component data, calculate its depth in the tree. The depth represents the length of the path that the sample passes from the root to the leaf node, that is, the number of steps required for the sample to be isolated.

[0059] For each component in the historical component data, the abnormality value is calculated according to its depth in the tree. , the calculation formula is as follows:

[0060] ,in Yes all The average depth of components, Indicates the depth of the component in the tree.

[0061] The comprehensive metric module 300 calculates the hash value corresponding to the component in the real-time component data according to the component binary in the real-time component data, and compares it with the static component hash value to generate a hash comparison result, which specifically includes:

[0062] Calculate the hash value corresponding to the component in the real-time component data according to the component binary in the real-time component data, and process each component binary file in the real-time component data by using the same hash algorithm as the static analysis unit 201 to generate a corresponding hash value as the real-time component hash value;

[0063] The real-time component hash value is compared with the static component hash value (the hash value pre-calculated and stored in the historical component data). The hash comparison result is used to determine whether the component binary file has been tampered with, where:

[0064] If the real-time component hash value is consistent with the static component hash value, it means that the binary data of the component has not changed, the component integrity is not damaged, the hash comparison result is normal, and it is quantified as 1;

[0065] If the real-time component hash value is inconsistent with the static component hash value, it means that the binary data of the component may be tampered with, the component integrity is damaged, the hash comparison result is abnormal, and it is quantized to 0; the quantization result in this process is different from the state label in the dynamic analysis unit 202. The quantization result of this process is for the subsequent calculation of the comprehensive measurement value. Therefore, quantizing the result in the abnormal state to 0 helps to reduce the result of the comprehensive measurement value, thereby reducing the trustworthy result.

[0066] The comprehensive metric module 300 predicts the abnormality level value corresponding to the component in the real-time component data according to the component behavior in the real-time component data and the constructed abnormality analysis model, and uses the inverse of the abnormality level value as the dynamic trust score; calculates the comprehensive metric value according to the hash comparison result and the dynamic trust score, specifically including:

[0067] Extract the behavior features of each component from the real-time component data as the real-time component behavior features; input the extracted real-time component behavior features into the constructed anomaly analysis model; calculate the depth of each component in the model tree by recursively and randomly splitting the feature space, and calculate the abnormality value of the component based on the depth, and calculate the dynamic trust score by the reciprocal of the abnormality value; the lower the abnormality value, the closer the component behavior is to the normal state, and the higher its credibility. By taking the reciprocal of the abnormality value, this relationship can be intuitively quantified as a dynamic trust score. The higher the trust score, the higher the credibility of the component, thereby providing an accurate credibility assessment basis for the system; in addition, the reciprocal of the abnormality value has a larger dynamic range in value. For example, when the abnormality value increases from 0.1 to 0.2, its reciprocal decreases from 10 to 5, and the change range is larger. This high dynamic range makes the system more sensitive in evaluating component credibility, and can more accurately capture subtle changes in component behavior and detect potential abnormalities in a timely manner;

[0068] Combine the hash comparison results and the dynamic trust score to calculate the comprehensive measurement value of each component. By setting the component integrity weight and the behavior credibility weight, the hash comparison results and the dynamic trust score are weighted and summed. The component integrity weight is used to adjust the hash comparison results, and the behavior credibility weight is used to adjust the dynamic trust score. For example, in a system with high security requirements, component integrity is extremely important. The component integrity weight will be set to a larger value (such as 0.7), while the behavior credibility weight will be relatively small (such as 0.3).

[0069] The trust verification module 400 calculates the comprehensive metric values ​​corresponding to all components in the real-time component data and performs fluctuation check. By calculating the degree of deviation between the comprehensive metric value corresponding to each component and its average value, it determines whether the current state of each component is trustworthy, which specifically includes:

[0070] Calculate the average value of the comprehensive measurement values ​​of all components in the real-time component data. This average value represents the overall trust level of the components in the system. For each component, calculate the degree of deviation of its comprehensive measurement value from the average value, and calculate the degree of deviation of the component by the absolute value difference method.

[0071] According to the degree of deviation, each component is sorted from large to small to generate a sorted list; a deviation threshold is set, components in the sorted list are selected in turn, and compared with the deviation threshold. If the deviation of the component is less than the deviation threshold, the current state of the component is credible; otherwise, it is untrustworthy; if it is untrustworthy, the dynamic trust score and hash comparison result corresponding to the untrustworthy component are checked respectively to determine the untrustworthy position, including:

[0072] Obtain the dynamic trust score and hash comparison result corresponding to the untrusted component, and analyze the dynamic trust score and hash comparison result respectively;

[0073] For dynamic trust scores, if the size of the dynamic trust score is lower than the specified threshold, the behavior feature with the highest abnormality value is selected as the untrustworthy location according to the abnormality analysis model;

[0074] For the hash comparison result, if the hash comparison result is 1, the binary data corresponding to the component is divided into several blocks, the hash value of each block is calculated separately, the hash value of each block is compared with the corresponding static hash value, the tampered block is identified, and the specific byte position that is modified is determined as the untrusted position.

[0075] See also Figure 3 The system module runs in the virtual layer and provides protection for application layer software and physical layer hardware. Specifically:

[0076] The data reading module 100 runs in the virtual layer and is responsible for reading historical component data and real-time component data; these data may come from the virtual layer, system layer, application layer or physical layer, including components, component binaries, component behaviors and historical component states; in this way, the module can collect component information at different levels and provide comprehensive data support for subsequent analysis and verification;

[0077] The dynamic and static analysis module 200 also runs in the virtual layer, and calculates the static component hash value based on the historical component binary data to ensure the integrity of the component binary code in different times and environments; at the same time, an abnormal analysis model is constructed based on the historical component behavior and status, and the model can predict the abnormal degree value of the component in real-time operation, thereby strengthening the monitoring and analysis of the application layer software behavior;

[0078] The comprehensive metric module 300 runs in the virtual layer, uses the component binary in the real-time component data to calculate the hash value, and compares it with the static component hash value to generate a hash comparison result to ensure the integrity of the component code; in addition, the dynamic trust score is predicted based on the real-time component behavior and anomaly analysis model, and then the comprehensive metric value is calculated by combining the hash comparison result and the dynamic trust score to achieve a multi-dimensional trust evaluation of the component;

[0079] The trusted verification module 400 runs in the virtual layer, calculates the comprehensive measurement values ​​of all components and performs fluctuation checks. By comparing the degree of deviation between the comprehensive measurement value of each component and its average value, it determines whether the current state of each component is trustworthy. If an untrustworthy component is found, the module will further check its dynamic trust score and hash comparison results, determine the specific location of the untrustworthy component, and take corresponding security measures to ensure a trusted operating environment for the application layer software and physical layer hardware.

[0080] A second objective of this embodiment is to provide a method for using a trusted computing system, including the following method steps:

[0081] S1. Read historical component data and real-time component data; the historical component data includes components, component binaries, component behaviors, and component states; the real-time component data does not include component states;

[0082] S2. Calculate the hash value of each component as the static component hash value based on the component binary in the historical component data; construct an abnormality analysis model based on the component behavior and component status in the historical component data, and use the constructed abnormality analysis model to predict the abnormality degree value;

[0083] S3. Calculate the hash value corresponding to the component in the real-time component data according to the component binary in the real-time component data, and compare it with the static component hash value to generate a hash comparison result; predict the abnormality degree value corresponding to the component in the real-time component data according to the component behavior in the real-time component data and the constructed abnormality analysis model, and use the inverse of the abnormality degree value as the dynamic trust score; calculate the comprehensive metric value according to the hash comparison result and the dynamic trust score;

[0084] S4. Calculate the comprehensive metric values ​​corresponding to all components in the real-time component data, and perform fluctuation checks. Determine whether the current state of each component is credible by calculating the degree of deviation between the comprehensive metric value corresponding to each component and its average value. If it is untrustworthy, check the dynamic trust score and hash comparison results corresponding to the untrustworthy component to determine the untrustworthy location.

[0085] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments. The above embodiments and descriptions are only preferred examples of the present invention and are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A trusted computing system, characterized in that: It comprises a data reading module (100), a dynamic and static analysis module (200), a comprehensive measurement module (300) and a trusted verification module (400), wherein: The data reading module (100) reads historical component data and real-time component data; wherein the historical component data and the real-time component data both include components, component binaries and component behaviors, and the historical component data also includes component states; The dynamic and static analysis module (200) calculates the hash value of each component according to the component binary in the historical component data as the static component hash value; constructs an abnormal analysis model according to the component behavior and component status in the historical component data, and the constructed abnormal analysis model is used to predict the abnormality degree value; The comprehensive metric module (300) calculates the hash value corresponding to the component in the real-time component data according to the component binary in the real-time component data, and compares it with the static component hash value to generate a hash comparison result; predicts the abnormality degree value corresponding to the component in the real-time component data according to the component behavior in the real-time component data and the constructed abnormality analysis model, and uses the inverse of the abnormality degree value as a dynamic trust score; calculates the comprehensive metric value according to the hash comparison result and the dynamic trust score; The trust verification module (400) calculates the comprehensive metric values ​​corresponding to all components in the real-time component data, and performs fluctuation check, and determines whether the current state of each component is trustworthy by calculating the degree of deviation between the comprehensive metric value corresponding to each component and its average value, wherein: if it is not trustworthy, the dynamic trust score and hash comparison result corresponding to the untrustworthy component are checked respectively to determine the untrustworthy position; The dynamic and static analysis module (200) comprises a dynamic analysis unit (202), and the process of constructing an abnormal analysis model by the dynamic analysis unit (202) specifically comprises: Extract behavioral features from component behaviors in historical component data, including the number of file reads, network accesses, and memory operations, and merge the extracted behavioral features into a behavioral feature vector; generate labels based on component status, where the normal status is 0 and the abnormal status is 1; Randomly select a behavior feature in a behavior feature vector, and randomly select a split point between the minimum and maximum values ​​of the feature, recursively split the data until each component in the historical component data is isolated; each split generates a new tree node, and the leaf node of the tree contains a single data sample that is isolated; the depth of the tree reflects the number of steps required to isolate the sample; a forest is formed by multiple trees, each of which is built based on different randomly selected behavior features and split points; For each component behavior and component state corresponding to the historical component data, calculate its depth in the tree. The depth represents the length of the path that the sample passes from the root to the leaf node, that is, the number of steps required for the sample to be isolated. For each component in the historical component data, the abnormality value is calculated according to its depth in the tree. , the calculation formula is as follows: ,in Yes all The average depth of components, Indicates the depth of the component in the tree; The process of the trusted verification module (400) performing fluctuation checking specifically includes: Calculate the average value of the comprehensive measurement values ​​of all components in the real-time component data. This average value represents the overall trust level of the components in the system. For each component, calculate the degree of deviation of its comprehensive measurement value from the average value, and calculate the degree of deviation of the component by the absolute value difference method. According to the degree of deviation, each component is sorted from large to small to generate a sorted list; a deviation threshold is set, components in the sorted list are selected in turn, and compared with the deviation threshold. If the deviation of the component is less than the deviation threshold, the current state of the component is credible; otherwise, it is untrustworthy; if it is untrustworthy, the dynamic trust score and hash comparison result corresponding to the untrustworthy component are checked respectively to determine the untrustworthy position, including: Obtain the dynamic trust score and hash comparison result corresponding to the untrusted component, and analyze the dynamic trust score and hash comparison result respectively; For dynamic trust scores, if the size of the dynamic trust score is lower than the specified threshold, the behavior feature with the highest abnormality value is selected as the untrustworthy location according to the abnormality analysis model; For the hash comparison result, if the hash comparison result is 1, the binary data corresponding to the component is divided into several blocks, the hash value of each block is calculated separately, the hash value of each block is compared with the corresponding static hash value, the tampered block is identified, and the specific byte position that is modified is determined as the untrusted position.

2. The trusted computing system according to claim 1, characterized in that: The dynamic and static analysis module (200) comprises a static analysis unit (201), wherein the static analysis unit (201) reads the binary file of each component from the historical component data and calculates the hash value of each component binary using a hash algorithm; The hash algorithm converts a binary file into a fixed-length string that uniquely identifies the binary file; the calculated hash value is stored as the static hash value of the component.

3. The trusted computing system according to claim 1, characterized in that: The process of generating the hash comparison result by the comprehensive metric module (300) specifically includes: Calculate the hash value corresponding to the component in the real-time component data according to the component binary in the real-time component data, and process each component binary file in the real-time component data by using the same hash algorithm as the static analysis unit (201) to generate a corresponding hash value as the real-time component hash value; The real-time component hash value is compared with the static component hash value. The hash comparison result is used to determine whether the component binary file has been tampered with, where: If the real-time component hash value is consistent with the static component hash value, the hash comparison result is normal and is quantized to 1; If the real-time component hash value is inconsistent with the static component hash value, the hash comparison result is abnormal and is quantized to 0.

4. The trusted computing system according to claim 3, characterized in that: The process of calculating the comprehensive metric value by the comprehensive metric module (300) specifically includes: Extract the behavior features of each component from the real-time component data as the real-time component behavior features; input the extracted real-time component behavior features into the constructed anomaly analysis model; calculate the depth of each component in the model tree by recursively and randomly splitting the feature space, and calculate the abnormality value of the component based on the depth, and calculate the dynamic trust score by the inverse of the abnormality value; Combine the hash comparison results and the dynamic trust score to calculate the comprehensive measurement value of each component. By setting the component integrity weight and the behavior credibility weight, the hash comparison results and the dynamic trust score are weighted and summed; the component integrity weight is used to adjust the hash comparison results, and the behavior credibility weight is used to adjust the dynamic trust score.

5. A method for using the trusted computing system according to any one of claims 1 to 4, characterized in that: The method comprises the following steps: S1. Read historical component data and real-time component data; the historical component data includes components, component binaries, component behaviors, and component states; the real-time component data does not include component states; S2. Calculate the hash value of each component according to the component binary in the historical component data as the static component hash value; According to the component behavior and component status in the historical component data, an abnormal analysis model is constructed, and the constructed abnormal analysis model is used to predict the abnormal degree value; S3. Calculate the hash value corresponding to the component in the real-time component data according to the component binary in the real-time component data, and compare it with the static component hash value to generate a hash comparison result; predict the abnormality degree value corresponding to the component in the real-time component data according to the component behavior in the real-time component data and the constructed abnormality analysis model, and use the inverse of the abnormality degree value as the dynamic trust score; Calculate the comprehensive metric value based on the hash comparison result and the dynamic trust score; S4. Calculate the comprehensive metric values ​​corresponding to all components in the real-time component data, and perform fluctuation checks. Determine whether the current state of each component is credible by calculating the degree of deviation between the comprehensive metric value corresponding to each component and its average value. If it is untrustworthy, check the dynamic trust score and hash comparison results corresponding to the untrustworthy component to determine the untrustworthy location.

Images