Hardware attack detection method and device, storage medium and product

Abstract

The invention discloses a hardware attack detection method and device, a storage medium and a product, and relates to the technical field of computers, the hardware security of to-be-detected electronic equipment can be monitored in real time by collecting power consumption signals of the to-be-detected electronic equipment in real time, power consumption characteristics are collected from multiple dimensions, various state information of hardware operation can be comprehensively covered, and the hardware attack detection efficiency is improved. The accuracy and reliability of hardware attack detection are improved, the high-dimensional feature data are converted into the low-dimensional feature data, the calculation complexity can be reduced, and the discrimination of different hardware is enhanced. In addition, fine power consumption characteristics are captured through wavelet transform, and the detection precision can be improved. And inputting the standard feature data into a reference fingerprint database which is constructed by clustering the power consumption feature data of normal electronic equipment by using a Gaussian mixture model, calculating the similarity degree with each power consumption type, and outputting a hardware attack detection result through weighted summation, so that an unknown attack mode can be identified, and the false alarm rate is reduced.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a hardware attack detection method, device, storage medium and product. Background Art

[0002] As the hardware complexity of electronic devices increases day by day, covering multiple links from hardware design, manufacturing to transportation, hardware attacks have become a major challenge in the field of server security.

[0003] At present, the physical characteristics of the hardware are generally measured to identify whether there are hardware attack anomalies in electronic equipment, including using radiographic imaging technology to scan circuit boards, generate high-resolution images, and compare the images with design drawings to detect whether there are attack anomalies. However, the above physical detection method needs to be performed offline and cannot be implemented in production or operation environments. Summary of the invention

[0004] The present application provides a hardware attack detection method, device, storage medium and product to at least solve the problem that the related technology cannot be implemented in a production or operating environment.

[0005] The present application provides a hardware attack detection method, comprising: real-time acquisition of power consumption signals of an electronic device to be tested, and preprocessing the power consumption signals to obtain standard power consumption signal samples; extracting feature data from the standard power consumption signal samples; reducing the dimension of the feature data, and normalizing the feature data after the dimension reduction to obtain standard feature data; inputting the standard feature data into a reference fingerprint library, and outputting the similarity between the standard feature data and each power consumption type, wherein the reference fingerprint library is obtained by clustering power consumption feature data generated by normal electronic devices under different operating conditions using a Gaussian mixture model; performing weighted summation on the similarity between the standard feature data and each power consumption type to obtain a weighted similarity of the standard feature data; and outputting a hardware attack detection result of the electronic device to be tested according to the weighted similarity.

[0006] The present application also provides a hardware attack detection device, comprising:

[0007] The signal acquisition module is used to collect the power consumption signal of the electronic device to be tested in real time, and pre-process the power consumption signal to obtain a standard power consumption signal sample.

[0008] The feature extraction module is used to extract feature data from the standard power consumption signal sample.

[0009] The feature dimension reduction module is used to reduce the dimension of feature data and normalize the reduced feature data to obtain standard feature data.

[0010] The similarity comparison module is used to input the standard feature data into the reference fingerprint library and output the similarity between the standard feature data and each power consumption type, wherein the reference fingerprint library is obtained by clustering the power consumption feature data generated by normal electronic devices under different operating conditions using a Gaussian mixture model.

[0011] The similarity weighting module is used to perform weighted summation on the similarity between the standard feature data and each power consumption type to obtain the weighted similarity of the standard feature data.

[0012] The result output module is used to output the hardware attack detection result of the electronic device to be tested according to the weighted similarity degree.

[0013] The present application also provides a server, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned hardware attack detection methods when executing the computer program.

[0014] The present application also provides a computer-readable storage medium, in which a computer program is stored, wherein when the computer program is executed by a processor, the steps of any of the above-mentioned hardware attack detection methods are implemented.

[0015] The present application also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned hardware attack detection methods when executed by a processor.

[0016] Through this application, real-time acquisition of power consumption signals of electronic devices under test can monitor the hardware security of electronic devices under test in real time. Power consumption characteristics are collected from multiple dimensions, which can comprehensively cover various state information of hardware operation, improve the accuracy and reliability of hardware attack detection, and convert high-dimensional feature data into low-dimensional feature data, which can reduce computational complexity and enhance the distinguishability of different hardware. In addition, by capturing subtle power consumption characteristics through wavelet transform, the detection accuracy can be improved. The standard feature data is input into the benchmark fingerprint library constructed by clustering the power consumption feature data of normal electronic devices using the Gaussian mixture model, and the similarity with each power consumption type is calculated. After weighted summation, the hardware attack detection results are output, which can identify unknown attack modes and reduce the false alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 A schematic diagram of a scenario of a hardware attack detection method provided in an embodiment of the present application;

[0019] Figure 2 A flowchart of a hardware attack detection method provided in an embodiment of the present application;

[0020] Figure 2a A schematic diagram of power consumption ripple provided in an embodiment of the present application;

[0021] Figure 3 A schematic diagram of the structure of a hardware attack detection device provided in an embodiment of the present application;

[0022] Figure 4 A schematic diagram of the structure of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0024] It should be noted that, in the description of this application, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. The terms "first", "second", etc. in this application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0025] In order to clearly understand the technical solution of the present application, the solution of the prior art is first introduced in detail. With the increasing complexity of the hardware of electronic devices, covering multiple links from hardware design, manufacturing to transportation, hardware attacks have become a major challenge in the field of server security. Common forms of hardware attacks include hardware Trojans, counterfeit devices, and firmware tampering. The current detection technology for hardware attacks is to identify whether there are abnormalities in electronic devices by measuring the physical properties of the hardware, including the use of X-ray scanning, electron microscope detection, and thermal imaging analysis. However, the above-mentioned physical detection technology needs to be performed offline and cannot be implemented in a production or operating environment, and the cost of a single detection is high.

[0026] In order to solve the above technical problems, the inventors thought of installing sensors on the electronic device to be tested to collect power consumption signals in real time, extracting feature data from frequency domain features, time domain features and time-frequency joint features in multiple dimensions after preprocessing, and then inputting them into the benchmark fingerprint library built based on the Gaussian mixture model for matching, and obtaining the hardware attack detection results of the electronic device to be tested by weighted summation. Through multi-dimensional power consumption feature collection, it is possible to fully cover various state information of hardware operation, improve the accuracy and reliability of hardware attack detection, convert high-dimensional feature data into low-dimensional feature data, reduce computational complexity, enhance the distinguishability of different hardware, and monitor the hardware security of the electronic device to be tested in real time.

[0027] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0028] In conjunction with the specific application environment architecture or the specific hardware architecture on which the execution of the hardware attack detection method depends, the specific application environment architecture or the specific hardware architecture is described herein. Figure 1 , Figure 1 A schematic diagram of a scenario of a hardware attack detection method provided in an embodiment of the present application. Figure 1 As shown, the specific application scenario of the present application includes: a receiving device 101, a processor 102 and a display device 103.

[0029] It is understandable that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the hardware attack detection method. In other feasible implementations of the present application, the above architecture may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown may be implemented in hardware, software, or a combination of software and hardware.

[0030] In a specific implementation process, the receiving device 101 may be an input / output interface or a communication interface, and is used to obtain a power consumption signal of the electronic device under test collected in real time.

[0031] The processor 102 can pre-process the power consumption signal to obtain a standard power consumption signal sample; extract feature data from the standard power consumption signal sample; reduce the dimension of the feature data, and normalize the feature data after the dimension reduction to obtain standard feature data; input the standard feature data into a reference fingerprint library, and output the similarity between the standard feature data and each power consumption type, wherein the reference fingerprint library is obtained by clustering the power consumption feature data generated by normal electronic devices under different operating conditions using a Gaussian mixture model; perform weighted summation on the similarity between the standard feature data and each power consumption type to obtain a weighted similarity of the standard feature data; and output the hardware attack detection result of the electronic device to be tested according to the weighted similarity.

[0032] The display device 103 can be used to display the hardware attack detection results.

[0033] The display device may also be a touch display screen, which is used to receive user instructions while displaying the above content to achieve operational interaction with the user.

[0034] It should be understood that the above-mentioned processor can be implemented by a processor reading instructions in a memory and executing the instructions, or it can be implemented by a circuit.

[0035] Figure 2 A flowchart of a hardware attack detection method provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, an embodiment of the present application provides a hardware attack detection method, and the method is described in detail as follows:

[0036] S201: collecting power consumption signals of the electronic device to be tested in real time, and preprocessing the power consumption signals to obtain standard power consumption signal samples.

[0037] Specifically, the server continuously collects the power consumption signal of the electronic device under test, and uses a high-precision ADC (Analog-to-Digital Converter) on the hardware to capture the power consumption signal of the electronic device under test in the power supply path, and then removes the interference components in the power consumption signal and synchronizes the timing. The sampling rate is set to 1MS / s (1 million sampling points per second) to collect transient current ripples.

[0038] Specifically, the process of preprocessing the power consumption signal includes:

[0039] Sa1: Trigger sampling via the processor’s CLKOUT pin and timestamp each sampling point using a hardware timestamp counter.

[0040] Sa2: A differential amplifier circuit is used to eliminate the common-mode noise in the power consumption signal, where the common-mode noise has a power supply rejection ratio greater than 80 dB.

[0041] Sa3: Use a digital filter to remove high-frequency noise in the power consumption signal to obtain a standard power consumption signal sample, where the high-frequency noise is greater than 100kHz.

[0042] S202: Extracting characteristic data from the standard power consumption signal sample.

[0043] Among them, feature extraction is to extract key information that can characterize hardware characteristics from the original standard power consumption signal samples.

[0044] Among them, the feature data extracted from the standard power consumption signal sample includes time domain features, frequency domain features and time-frequency joint features. The time domain feature is the key information that can characterize the hardware characteristics extracted from the time domain waveform of the standard power consumption signal sample. The frequency domain feature is the key information that can characterize the hardware characteristics extracted from the frequency domain characteristics of the standard power consumption signal sample.

[0045] Specifically, the frequency domain features include the frequency components within a preset frequency range, the amplitude of each frequency component, the energy proportion of each frequency component, the energy proportion of each frequency band, and the harmonic distortion rate of each frequency band. The process of extracting frequency domain features includes:

[0046] Sb1: Sample the standard power consumption signal to obtain a discrete time domain signal.

[0047] Sb2: Use fast Fourier transform to convert discrete time domain signals into discrete frequency domain signals and extract frequency components within a preset frequency range.

[0048] Among them, the preset frequency range is 2kHz-100kHz.

[0049] Specifically, the formula for extracting the frequency components within the preset frequency range is:

[0050]

[0051] Where N represents the total number of sampling points, k represents the frequency index, k=0,1,…,N-1, x(n) represents the discrete frequency domain signal, and X(k) represents each frequency component.

[0052] Sb3: Calculate the amplitude of each frequency component based on each frequency component.

[0053] Specifically, the frequency component calculation formula can be used to calculate the information of the discrete frequency domain signal at the kth frequency, which is specifically expressed as a complex sequence containing amplitude and phase information. According to each frequency component, the formula for calculating the amplitude of each frequency component is:

[0054]

[0055] Where Re(X(k)) represents the real part of the frequency component X(k), Im(X(k)) represents the imaginary part of the frequency component X(k), and |X(k)| represents the amplitude of the frequency component.

[0056] Sb4: Calculate the energy proportion of each frequency component according to the amplitude of each frequency component.

[0057] Among them, energy proportion refers to the proportion of the energy of a specific frequency component in the total energy of the entire signal in the frequency domain analysis of the power consumption signal, which can intuitively reflect the contribution of different frequency components to the energy of the entire power consumption signal.

[0058] Specifically, by processing the standard power consumption signal sample, the amplitude of each frequency component is obtained. According to the principle that the signal energy is proportional to the square of the amplitude, the formula for calculating the energy proportion of each frequency component is:

[0059]

[0060] Where P(k) represents the energy proportion of the frequency component, |X(k)| represents the amplitude of the frequency component, and N represents the total number of sampling points.

[0061] Sb5: Apply wavelet transform to decompose the discrete time domain signal into a first number of frequency bands.

[0062] Among them, wavelet transform is a time-frequency analysis method, which can better analyze non-stationary signals than Fourier transform.

[0063] Specifically, according to the characteristics of the power consumption signal, the appropriate wavelet basis function is selected, and then the wavelet transform parameters are determined. The number of layers that can decompose the discrete time domain signal into 10 frequency bands is calculated, such as selecting 4-layer wavelet decomposition, and setting the boundary processing method. Finally, the discrete time domain signal is subjected to wavelet transform using the selected wavelet basis function and parameters, and 10 different frequency band signals are gradually decomposed through low-pass and high-pass filters.

[0064] Sb6: Calculate the energy proportion of each frequency band according to the discrete time domain signal of each frequency band.

[0065] Specifically, for the discrete time domain signal of each frequency band, according to the signal energy calculation formula, the value of each sampling point of the frequency band signal is squared and then accumulated to calculate the signal energy of each frequency band. Then, the energy of all frequency band signals is added to obtain the total energy, and the energy of each frequency band is divided by the total energy to obtain the energy proportion of each frequency band.

[0066] Sb7: Calculate the harmonic distortion rate of each frequency band based on the discrete time domain signal of each frequency band.

[0067] Among them, harmonic distortion rate is used to measure the degree of harmonic content in the signal.

[0068] Specifically, the discrete time domain signal of each frequency band is first subjected to Fourier transform and other means to extract the fundamental component, and the frequency domain representation is obtained by discrete Fourier transform to determine the component corresponding to the fundamental frequency, and then the fundamental component is obtained by inverse Fourier transform. Then, the fundamental component is subtracted from the frequency band signal to obtain the harmonic component, and its energy is calculated according to the harmonic component energy calculation formula, and the harmonic distortion rate of each frequency band is calculated by taking the square root of the ratio of the harmonic component energy to the fundamental component energy.

[0069] Specifically, the time-frequency joint feature includes the time-frequency variation pattern of the power consumption signal. The process of extracting the time-frequency joint feature from the standard power consumption signal sample includes:

[0070] Sc1: Sample the standard power consumption signal to obtain a discrete time domain signal.

[0071] Sc2: Divide the discrete time domain signal into multiple time segments through short-time Fourier transform.

[0072] Specifically, first determine the window function and window length of the short-time Fourier transform. Common window functions include Hanning window and Hamming window. Then, starting from the starting point of the discrete time domain signal, let the window function slide along the signal with the selected window length as the interval. Each time it slides, the signal part contained in the window is a time segment, so that the discrete time domain signal is divided into multiple time segments.

[0073] Among them, the window length determines the length of the time segment.

[0074] Sc3: For each time segment, the discrete time domain signal is converted into a discrete frequency domain signal through short-time Fourier transform to obtain the time-frequency information corresponding to each time segment.

[0075] Specifically, for each divided time segment, the short-time Fourier transform is used again. The discrete time domain signal in the window function is converted from the time domain to the frequency domain through the Fourier transform formula. The Fourier transform decomposes the signal into different frequency components and obtains the amplitude and phase information of each time segment at different frequencies.

[0076] Sc4: Construct a power consumption spectrum diagram according to the time-frequency information corresponding to each time segment, where the power consumption spectrum diagram reflects the intensity of the power consumption signal at the corresponding time-frequency position.

[0077] Specifically, a coordinate system is established with time as the horizontal axis and frequency as the vertical axis. For the time-frequency information corresponding to each time segment, the amplitude at different frequencies is used as the signal strength and marked at the corresponding time-frequency position. All time segments are processed in sequence, and each point is connected or filled to form a power consumption spectrum diagram that intuitively reflects the intensity distribution of the power consumption signal at different times and frequencies.

[0078] Sc5: Analyze the power consumption spectrum diagram to determine the time-frequency variation pattern of the power consumption signal.

[0079] Specifically, observe the change of the position of the signal strength peak in the spectrum graph over time. If the peak frequency gradually increases, it may mean that the hardware operating frequency is increasing; pay attention to the change trend of the intensity in different frequency regions. For example, if the intensity in a high-frequency region suddenly increases, it may indicate that the hardware is abnormal. At the same time, analyze the overall shape, symmetry and other characteristics of the spectrum graph, combine this information, summarize the change rules of the power consumption signal in the time and frequency dimensions, and determine its corresponding time-frequency change pattern.

[0080] Specifically, the time domain features include overall characteristics and transient characteristics. The process of extracting the time domain features from the standard power consumption signal sample includes:

[0081] Sd1: Get the time domain waveform of the power consumption signal from the standard power consumption signal sample.

[0082] Specifically, time domain data are extracted from the standard power consumption signal samples obtained after preprocessing such as denoising and filtering, and these time domain data are arranged in chronological order, with time as the horizontal axis and the power consumption signal amplitude as the vertical axis. These data points are connected through data visualization means, thereby intuitively presenting the time domain waveform of the power consumption signal.

[0083] Sd2: Calculate the mean, variance, and peak-to-peak value of the time domain waveform, where the mean, variance, and peak-to-peak value of the time domain waveform are used to reflect the overall characteristics of the standard power consumption signal sample.

[0084] Specifically, the amplitudes of all data points on the time domain waveform are added together and then divided by the total number of data points. The result is the mean, which represents the average level of the power consumption signal over a period of time. When calculating the variance, first find the difference between the amplitude of each data point and the mean, square these differences separately, sum them, and then divide them by the total number of data points. The variance reflects the degree of fluctuation of the signal around the mean. Calculating the peak-to-peak value is to find the maximum and minimum values ​​in the time domain waveform. The difference between the two is the peak-to-peak value, which reflects the maximum range of signal amplitude changes.

[0085] Sd3: Calculate the current pulse width, rise time, fall time and duty cycle of the time domain waveform, where the current pulse width, rise time, fall time and duty cycle of the time domain waveform are used to reflect the transient characteristics of the standard power consumption signal sample.

[0086] Specifically, for the current pulse width, the threshold of the pulse signal is first determined. When the signal amplitude exceeds the threshold, the pulse is considered to have started, and when it is lower than the threshold, the pulse is considered to have ended. The difference between the two time points is the current pulse width, which reflects how long the pulse lasts. The rise time is the time it takes for the pulse amplitude to rise from 10% to 90% of the threshold, and is used to measure how fast the pulse rises. The fall time is the time it takes for the pulse amplitude to drop from 90% to 10%, reflecting the speed at which the pulse drops. The duty cycle is calculated by the ratio of the current pulse width to the pulse period. The duty cycle reflects the activity of the pulse signal over a period of time.

[0087] S203: Reduce the dimension of the feature data, and normalize the reduced feature data to obtain standard feature data.

[0088] Specifically, the principal component analysis method is first used to reduce the dimension of the high-dimensional feature data extracted from the power consumption signal, and the high-dimensional feature data is projected into a low-dimensional space composed of 32 principal components, thereby completing the dimension reduction operation. Subsequently, the 32-dimensional feature data after dimension reduction is normalized, and the data of each dimension is mapped to a specific interval (such as [0,1]) using a Z-score normalization method to eliminate the differences in the dimensions and value ranges of data of different dimensions.

[0089] Among them, the principal component analysis method will perform characteristic decomposition on the covariance matrix of the original feature data to find the principal component that can explain the data variance to the greatest extent.

[0090] S204: inputting the standard feature data into a reference fingerprint library, and outputting the similarity between the standard feature data and each power consumption type, wherein the reference fingerprint library is obtained by clustering the power consumption feature data generated by normal electronic devices under different operating conditions using a Gaussian mixture model.

[0091] Among them, the benchmark fingerprint library is obtained by clustering the power consumption characteristic data generated by normal electronic devices under different operating conditions using a Gaussian mixture model. Each Gaussian distribution can be regarded as a pattern or a subset, describing the probability distribution of a specific power consumption mode.

[0092] Specifically, for each power consumption type in the reference fingerprint library, the formula for calculating the similarity between the standard feature data and the type is:

[0093]

[0094] In the formula, d represents the feature dimension, μ k represents the mean vector of the kth power consumption type, ∑ k represents the covariance matrix of the kth power consumption type, ∑ k -1represents the inverse matrix of the covariance matrix of the kth power consumption type, x represents the input standard feature data, Indicates the similarity between the standard feature data and the kth power consumption type.

[0095] For example, if there are 1000 normal devices with power consumption characteristics, a benchmark fingerprint library is generated by Gaussian mixture model training. The fingerprint of each normal device is represented by the model parameter set {μ k ,∑ k ,π k}, where μ k represents the mean vector, ∑ k represents the covariance matrix, π k Represents the weight coefficient. Input the reduced dimensional data of time domain features, frequency domain features, and time-frequency joint features extracted from the standard feature data, and generate a scatter plot of power consumption ripple. Figure 2a This is a schematic diagram of power consumption ripple provided in the embodiment of the present application. Figure 2a As shown in the figure, the contour lines in the figure represent the contour surface of the Gaussian distribution, and the surrounding points represent the actual observed data of the power consumption ripple, which is presented in the form of a set of two-dimensional coordinates. The horizontal and vertical coordinates of each point can be different power consumption characteristics. The data has an obvious clustering trend, and there may be multiple clusters, each cluster representing a different type of power consumption. For the extracted power consumption ripple data, the closer it is to the Gaussian distribution contour surface, the more it matches the benchmark fingerprint library. Among them, the mean vector is the center point of each Gaussian component will be located at the center of the contour line. The covariance in the covariance matrix determines the shape of the distribution. The components with larger covariance matrices will appear as relatively flat or extended ellipses, while the components with smaller covariance matrices will appear as relatively compact ellipses. Gaussian components with larger weights contribute more to the overall distribution of the data, and the contour lines will be wider.

[0096] S205: performing weighted summation on the similarity between the standard feature data and each power consumption type to obtain a weighted similarity of the standard feature data.

[0097] Specifically, the similarity of the Gaussian distribution of each power consumption type is weighted and summed, and the formula for obtaining the weighted similarity of the standard feature data is:

[0098]

[0099] In the formula, π k represents the weight coefficient of the kth power consumption type, It indicates the similarity between the standard feature data and each power consumption type, and K indicates the number of power consumption types.

[0100] S206: Outputting a hardware attack detection result of the electronic device to be tested according to the weighted similarity degree.

[0101] Specifically, a dynamic threshold such as 3σ is set. If p(x) is greater than the dynamic threshold, the electronic device to be tested is determined to be a normal device. If p(x) is less than the dynamic threshold, the electronic device to be tested is determined to be an abnormal device.

[0102] Among them, σ is the standard deviation of the weighted similarity, which indicates the degree of dispersion between the data points and the mean. According to the properties of the normal distribution, about 68% of the data points will fall within the range of ±1σ of the mean, about 95% of the data points will fall within the range of ±2σ, and about 99.7% of the data points will fall within the range of ±3σ, adapting to power consumption fluctuations in different environments.

[0103] In summary, by collecting the power consumption signals of the electronic device under test in real time, the hardware security of the electronic device under test can be monitored in real time. Collecting power consumption characteristics from multiple dimensions can comprehensively cover various state information of hardware operation, thereby improving the accuracy and reliability of hardware attack detection. Converting high-dimensional feature data into low-dimensional feature data can reduce computational complexity and enhance the distinguishability of different hardware.

[0104] In addition, the detection accuracy can be improved by capturing subtle power consumption characteristics through wavelet transform. The standard feature data is input into the benchmark fingerprint library constructed by clustering the power consumption feature data of normal electronic devices using the Gaussian mixture model, and the similarity with each power consumption type is calculated. Then, the hardware attack detection results are output through weighted summation, which can identify unknown attack modes and reduce the false alarm rate.

[0105] In another embodiment provided by the present application, there is a strong correlation between the power consumption and temperature of the hardware during operation. Increased power consumption will lead to increased temperature, but this relationship is not linear, but is affected by factors such as heat dissipation conditions and ambient temperature. If the attack detection result of the electronic device to be tested is abnormal, it is necessary to determine whether the abnormality is caused by human tampering or hardware aging, specifically including:

[0106] S301: Acquire temperature data and power consumption data of the electronic device to be tested during operation.

[0107] Specifically, the temperature data of the electronic device under test is obtained through a high-precision temperature sensor. The sensor monitors the device temperature in real time and converts the temperature signal into an electrical signal, which is then transmitted to the data receiving unit of the server through a wired connection or a wireless communication module. The data receiving unit analyzes the received signal and extracts the temperature data according to the set communication protocol.

[0108] Specifically, a power consumption sampling circuit is connected in series in the power supply circuit of the electronic device to be tested. When the electronic device to be tested is running, the current in the circuit passes through the sampling element, generating a voltage signal proportional to the current. Combined with the power supply voltage, the real-time power consumption of the electronic device to be tested can be calculated. The power consumption sampling circuit sends the calculated power consumption data to the data receiving unit through the data transmission interface or the internal data bus. The data receiving unit organizes and stores the received power consumption data according to the corresponding data format and protocol.

[0109] S302: Filter the power consumption data to obtain a power consumption sample with noise removed, wherein the power consumption sample includes a plurality of power consumption values.

[0110] Specifically, a digital filtering algorithm, such as mean filtering, median filtering or Kalman filtering, is used to process the raw power consumption data received from the power consumption sampling circuit. Taking mean filtering as an example, a filter window size is set, for example, 5 consecutive power consumption data points are taken, the average value of these 5 data points is calculated, and the average value is used as the first power consumption value output after filtering. Then the window slides back one data point, and the above calculation process is repeated to obtain a series of power consumption values ​​after noise removal, which together constitute the power consumption sample.

[0111] S303: Filter the temperature data to obtain temperature samples with noise removed, where the temperature samples include temperature values ​​corresponding to each power consumption value.

[0112] For example, a filter window size is set, for example, 3 consecutive temperature data points are taken, the average of the 3 data points is calculated, and the average is used as the first temperature value output after filtering. Then the window slides back one data point, and the above calculation process is repeated to obtain a series of temperature values ​​after noise removal, which together constitute the temperature sample.

[0113] S304: Input the power consumption samples into the pre-trained power consumption-temperature dynamic relationship model to output the predicted temperature value corresponding to each power consumption value.

[0114] Among them, the pre-trained power consumption-temperature dynamic relationship model is based on a large amount of historical power consumption and temperature data and is trained through a machine learning algorithm.

[0115] Specifically, each power consumption value in the power consumption sample after filtering is sequentially input into the model. The model calculates each input power consumption value based on the learned intrinsic relationship between power consumption and temperature, and outputs the corresponding predicted temperature value.

[0116] Specifically, for each power consumption value in the power consumption sample, the temperature residual corresponding to the power consumption value is obtained by subtracting the temperature value predicted by the power consumption-temperature dynamic relationship model from the corresponding actual measured temperature value. The temperature residuals corresponding to all power consumption values ​​are recorded in sequence to form temperature residual data.

[0117] Specifically, the process of constructing the power consumption-temperature dynamic relationship model is as follows:

[0118] Se1: Acquire multiple historical temperature data, where the multiple historical temperature data cover an idle state, a medium load state, and a high load state of the hardware device.

[0119] Specifically, through long-term, multi-condition monitoring, multiple historical temperature data covering different load states of hardware equipment are accumulated.

[0120] Se2: Acquire multiple historical power consumption data, where the multiple historical power consumption data cover an idle state, a medium load state, and a high load state of the hardware device.

[0121] Specifically, by tracking different operating states of the equipment over a long period of time, multiple historical power consumption data covering various load conditions are accumulated.

[0122] Se3: Preprocess multiple historical temperature data to obtain multiple historical temperature samples with noise interference removed.

[0123] Specifically, for the multiple historical temperature data collected, a variety of digital filtering techniques are used to remove noise interference. First, the mean filtering algorithm is used to set a suitable filtering window, such as taking the average of 5 consecutive temperature data points as the first temperature value output after filtering, and then sliding the window back by one data point, repeating the calculation, preliminarily smoothing the temperature curve, and removing high-frequency noise spikes. Then, the median filtering algorithm is used to process the mean filtered data again, and the middle value is selected as the output in the same window to further eliminate possible outlier interference. After this series of preprocessing steps, a series of continuous, smooth and noise-free historical temperature samples are obtained.

[0124] Se4: Preprocess multiple historical power consumption data to obtain multiple historical power consumption samples with noise interference removed.

[0125] Specifically, the filter window size is set according to the characteristics of the power consumption data. For example, 7 consecutive power consumption data points are taken to calculate the average value, and the original power consumption data is preliminarily smoothed. Then, a median filter is used to select the middle value in the same window to replace the original data, so as to further eliminate abnormal power consumption values.

[0126] Se5: Segment multiple historical temperature samples and multiple historical power consumption samples according to time series to construct a training data set.

[0127] The pre-processed multiple historical temperature samples and multiple historical power consumption samples are synchronously segmented according to the time sequence. For example, taking 1 minute as a time period, the corresponding temperature sample values ​​and power consumption sample values ​​in the time period are combined into a data pair. In this way, the data in the entire time span is divided into multiple data pairs, each of which contains the temperature and power consumption information at a specific moment. These data pairs together constitute the training data set.

[0128] Se6: Based on the training data set, the Kalman filter algorithm is used to establish a power consumption-temperature dynamic relationship model.

[0129] S306: Calculate temperature residual data corresponding to each power consumption value according to the temperature value corresponding to each power consumption value and the predicted temperature value.

[0130] Specifically, the state vector and covariance matrix of the model are first initialized. The state vector contains the power consumption and temperature estimates at the current moment, and the covariance matrix is ​​used to measure the uncertainty of the estimates. Then, for each data pair in the training data set, the state estimate and covariance matrix are continuously adjusted based on the state estimate at the previous moment and the measured value at the current moment using the prediction and update steps of the Kalman filter. In the prediction step, the state at the next moment is predicted based on the dynamic model of the system; in the update step, the predicted value is corrected in combination with the new measured value. Through iterative processing of the entire training data set, the Kalman filter algorithm gradually learns the dynamic relationship between power consumption and temperature, and establishes a power consumption-temperature dynamic relationship model that can accurately describe the relationship between the two.

[0131] S307: Determine the cause of the abnormality of the electronic device to be tested according to the temperature residual data.

[0132] Specifically, if the temperature residual data is generally large and fluctuates irregularly, it may mean that the device has a heat dissipation problem, causing the actual temperature to be higher than the predicted temperature corresponding to normal power consumption. If the residual data suddenly increases within a certain period of time, it may indicate that the device has an abnormally high power consumption operation or hardware failure at that moment. The specific judgment process is as follows:

[0133] Sf1: Draw a residual distribution diagram based on the temperature residual data, and input the residual distribution diagram into the Gaussian model for verification to determine whether the residual distribution diagram conforms to the normal distribution.

[0134] Specifically, based on the temperature residual data, the residual value is used as the ordinate, and the corresponding sample number or time point is used as the abscissa, and the residual distribution diagram is drawn using drawing software. Each point in the diagram represents the temperature residual corresponding to a power consumption value. After the drawing is completed, the data of the residual distribution diagram is input into the pre-built Gaussian model. The Gaussian model is based on the probability density function of the normal distribution. By calculating the theoretical probability distribution of the residual data in different value intervals, and comparing and analyzing it with the data distribution in the actual residual distribution diagram, the goodness of fit test and other methods are used to determine whether the residual distribution diagram conforms to the normal distribution.

[0135] Sf2: If the residual distribution graph does not conform to the normal distribution, the abnormal power consumption data is input into the pre-trained power consumption-temperature correlation analysis model to output the power consumption-temperature relationship curve.

[0136] Specifically, if it is determined that the residual distribution graph does not conform to the normal distribution, the power consumption data corresponding to the abnormal residual is first determined. These abnormal power consumption data are the power consumption values ​​collected when the temperature residual is abnormal. These abnormal power consumption data are input into the pre-trained power consumption-temperature correlation analysis model. The model analyzes the potential relationship between power consumption and temperature based on the input abnormal power consumption data through the internal calculation mechanism, and outputs the corresponding power consumption-temperature relationship curve.

[0137] Among them, the power consumption-temperature relationship curve intuitively shows the changing trend of power consumption and temperature under abnormal conditions.

[0138] Sf3: If the power consumption-temperature relationship curve shows a slow linear drift trend, it is judged as hardware aging.

[0139] Specifically, if the curve shows a slow linear upward or downward trend as time or power consumption increases, that is, the temperature increases or decreases at a relatively stable and gradual rate as power consumption changes, for example, due to long-term use, the internal transistor performance gradually declines, resulting in a gradual increase in heat generated at the same power consumption, which is reflected in the power consumption-temperature relationship curve as a slow linear drift. Based on this feature, it is determined that the cause of the device abnormality is hardware aging.

[0140] Sf4: If a sudden change occurs in the power consumption-temperature relationship curve, it is determined to be human tampering.

[0141] Specifically, when an obvious mutation point is observed in the power consumption-temperature relationship curve, that is, at a certain moment or at a certain power consumption value, the temperature suddenly rises or falls sharply, and this change does not conform to the relationship between power consumption and temperature when the device is operating normally. By identifying this mutation feature in the power consumption-temperature relationship curve, combined with the device's usage environment and historical operation records, it is determined that the device abnormality is caused by human tampering.

[0142] In summary, by receiving and processing the temperature and power consumption data of the device, the temperature is predicted using the pre-trained power consumption-temperature dynamic relationship model, and the temperature residual data is calculated to determine the cause of the abnormality. The residual distribution graph uses the Gaussian model to verify whether it conforms to the normal distribution. In the case of an abnormality, the power consumption-temperature correlation analysis model outputs the relationship curve, and the hardware aging and human tampering are distinguished based on the characteristics of the curve. At the same time, the model construction process covers the comprehensive collection of historical temperature and power consumption data under different load states, and the training data set is constructed by preprocessing and time series segmentation, and then the Kalman filter algorithm is used to establish the model. This series of technical means can accurately locate the root cause of equipment abnormalities, effectively distinguish between natural hardware aging and human tampering, provide strong support for hardware security, greatly improve the accuracy and reliability of detection, and timely discover potential hardware attack risks.

[0143] In the embodiment provided in the present application, when the hardware attack detection result of the electronic device to be tested is abnormal, a graded response will be triggered accordingly, and the specific process includes:

[0144] S401: Calculate the abnormal probability that the hardware attack detection result of the electronic device to be tested is abnormal according to the weighted similarity.

[0145] S402: If the abnormality probability is less than 68%, the abnormality log is recorded and the operation and maintenance personnel are notified.

[0146] Specifically, if the abnormal probability is less than 68%, the server will record in detail in a special log recording module the relevant information that the hardware attack detection result is abnormal, including the detection time, the preliminary judgment of the abnormal type, the hardware components involved, etc. At the same time, the system will promptly inform the operation and maintenance personnel of the abnormal situation through preset communication channels, such as SMS notifications, email push or pop-up reminders on the operation and maintenance management platform, so that the operation and maintenance personnel can further analyze and troubleshoot possible minor hardware abnormalities based on the log records and take corresponding maintenance measures.

[0147] S403: If the abnormal probability is greater than or equal to 68% and less than 99.7%, the electronic device under test is isolated and the trusted platform module firmware verification is started.

[0148] Specifically, if the abnormal probability is greater than or equal to 68% and less than 99.7%, the electronic device under test will be isolated from the current network environment and its data communication connection with other devices will be disconnected to prevent the spread of possible security risks. At the same time, the TPM firmware (Trusted Platform Module) verification process is automatically triggered. The system sends instructions to the TPM, and the TPM performs integrity verification on the firmware stored in itself based on the built-in verification algorithm. By comparing the firmware signature, hash value and other information, it checks whether the firmware has been tampered with to determine whether there are security risks at the underlying firmware level of the device.

[0149] S404: If the abnormality probability is greater than or equal to 99.7%, the power supply circuit is cut off, and the firmware is rolled back to the golden image through the platform firmware elastic mechanism.

[0150] Among them, the golden image is a firmware backup of the device in a safe and normal state.

[0151] Specifically, when the probability of anomaly is greater than or equal to 99.7%, the control circuit quickly cuts off the power supply of the electronic device under test, causing it to stop running, and starts the PFR (Platform Firmware Resilience) mechanism, which uses a pre-stored golden image to roll back the device firmware to a known safe version. During the rollback process, the PFR mechanism monitors and verifies the firmware recovery process to ensure that the firmware is successfully restored and the device can be restarted in a safe state.

[0152] In summary, when the hardware attack detection result is abnormal, the hierarchical response mechanism uses scientific algorithms to accurately quantify the abnormal probability and realize hierarchical processing of different risk levels. By recording logs and notifying operation and maintenance, minor abnormalities can be resolved in a timely manner; device isolation and TPM firmware verification can effectively curb the spread of medium risks and ensure the bottom layer security; cutting off power supply and rolling back firmware by PFR mechanism can quickly stop losses and restore the device to a safe state under high risk, comprehensively improving the device's protection, response and recovery capabilities when facing attacks, and effectively ensuring the security, stability and data integrity of the hardware system.

[0153] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method.

[0154] Figure 3 This is a schematic diagram of the structure of the hardware attack detection device provided in the embodiment of the present application. Figure 3 As shown, the embodiment of the present application also provides a hardware attack detection device, which includes: a signal acquisition module 301, a feature extraction module 302, a feature dimension reduction module 303, a similarity comparison module 304, a similarity weighting module 305 and a result output module 306.

[0155] The signal acquisition module 301 is used to acquire the power consumption signal of the electronic device to be tested in real time, and pre-process the power consumption signal to obtain a standard power consumption signal sample.

[0156] A feature extraction module 302 is used to extract feature data from a standard power consumption signal sample;

[0157] The feature dimension reduction module 303 is used to reduce the dimension of the feature data and normalize the reduced feature data to obtain standard feature data;

[0158] A similarity comparison module 304 is used to input the standard feature data into a reference fingerprint library and output the similarity between the standard feature data and each power consumption type, wherein the reference fingerprint library is obtained by clustering the power consumption feature data generated by normal electronic devices under different operating conditions using a Gaussian mixture model;

[0159] A similarity weighting module 305 is used to perform weighted summation on the similarity between the standard feature data and each power consumption type to obtain a weighted similarity of the standard feature data;

[0160] The result output module 306 is used to output the hardware attack detection result of the electronic device to be tested according to the weighted similarity degree.

[0161] In one possible implementation, the feature extraction module 302 is specifically used to sample the standard power consumption signal sample to obtain a discrete time domain signal; use fast Fourier transform to convert the discrete time domain signal into a discrete frequency domain signal, and extract the frequency components within a preset frequency range; calculate the amplitude of each frequency component according to each frequency component; calculate the energy proportion of each frequency component according to the amplitude of each frequency component; apply wavelet transform to decompose the discrete time domain signal into a first number of frequency bands; calculate the energy proportion of each frequency band according to the discrete time domain signal of each frequency band; calculate the harmonic distortion rate of each frequency band according to the discrete time domain signal of each frequency band.

[0162] In one possible implementation, the feature extraction module 302 is specifically used to sample the standard power consumption signal sample to obtain a discrete time domain signal; divide the discrete time domain signal into multiple time segments through short-time Fourier transform; for each time segment, convert the discrete time domain signal into a discrete frequency domain signal through short-time Fourier transform to obtain the time-frequency information corresponding to each time segment; construct a power consumption spectrum diagram based on the time-frequency information corresponding to each time segment, wherein the power consumption spectrum diagram reflects the intensity of the power consumption signal at the corresponding time-frequency position; analyze the power consumption spectrum diagram to determine the time-frequency change pattern of the power consumption signal.

[0163] In one possible implementation, the feature extraction module 302 is specifically used to obtain a time domain waveform of a power consumption signal from a standard power consumption signal sample; calculate the mean, variance, and peak-to-peak value of the time domain waveform, wherein the mean, variance, and peak-to-peak value of the time domain waveform are used to reflect the overall characteristics of the standard power consumption signal sample; calculate the current pulse width, rise time, fall time, and duty cycle of the time domain waveform, wherein the current pulse width, rise time, fall time, and duty cycle of the time domain waveform are used to reflect the transient characteristics of the standard power consumption signal sample.

[0164] In a possible implementation, the device also includes an abnormality cause determination module, which is used to obtain temperature data and power consumption data of the electronic device to be tested during operation; filter the power consumption data to obtain a power consumption sample with noise removed, wherein the power consumption sample includes multiple power consumption values; filter the temperature data to obtain a temperature sample with noise removed, wherein the temperature sample includes a temperature value corresponding to each power consumption value; input the power consumption sample into a pre-trained power consumption-temperature dynamic relationship model to output a predicted temperature value corresponding to each power consumption value; calculate the temperature residual data corresponding to each power consumption value based on the temperature value corresponding to each power consumption value and the predicted temperature value; and determine the cause of the abnormality of the electronic device to be tested based on the temperature residual data.

[0165] In one possible implementation, the abnormal cause determination module is specifically used to draw a residual distribution diagram based on the temperature residual data, and input the residual distribution diagram into a Gaussian model for verification to determine whether the residual distribution diagram conforms to the normal distribution; if the residual distribution diagram does not conform to the normal distribution, the abnormal power consumption data is input into a pre-trained power consumption-temperature correlation analysis model to output a power consumption-temperature relationship curve; if the power consumption-temperature relationship curve shows a slow linear drift trend, it is determined to be hardware aging; if a mutation occurs in the power consumption-temperature relationship curve, it is determined to be human tampering.

[0166] In a possible implementation, the device also includes a power consumption and temperature dynamic relationship model construction module, which is used to obtain multiple historical temperature data, wherein the multiple historical temperature data cover the idle state, medium load state and high load state of the hardware device; obtain multiple historical power consumption data, wherein the multiple historical power consumption data cover the idle state, medium load state and high load state of the hardware device; pre-process the multiple historical temperature data to obtain multiple historical temperature samples with noise interference removed; pre-process the multiple historical power consumption data to obtain multiple historical power consumption samples with noise interference removed; segment the multiple historical temperature samples and the multiple historical power consumption samples according to time series to construct a training data set; and establish a power consumption-temperature dynamic relationship model based on the training data set using a Kalman filtering algorithm.

[0167] In a possible implementation, the formula for extracting frequency components within a preset frequency interval in the feature extraction module 302 is:

[0168]

[0169] Where N represents the total number of sampling points, k represents the frequency index, k=0,1,…,N-1, x(n) represents the discrete frequency domain signal, and X(k) represents each frequency component.

[0170] In a possible implementation, the formula for calculating the amplitude of each frequency component in the feature extraction module 302 is:

[0171]

[0172] Where Re(X(k)) represents the real part of the frequency component X(k), Im(X(k)) represents the imaginary part of the frequency component X(k), and |X(k)| represents the amplitude of the frequency component.

[0173] In a possible implementation, the formula for calculating the energy proportion of each frequency component in the feature extraction module 302 is:

[0174]

[0175] Where P(k) represents the energy proportion of the frequency component, |X(k)| represents the amplitude of the frequency component, and N represents the total number of sampling points.

[0176] In a possible implementation, the calculation formula for the similarity between the standard feature data and each power consumption type in the similarity weighting module 305 is:

[0177]

[0178] In the formula, d represents the feature dimension, μ k represents the mean vector of the kth power consumption type, ∑ k represents the covariance matrix of the kth power consumption type, ∑ k -1 represents the inverse matrix of the covariance matrix of the kth power consumption type, x represents the input standard feature data, Indicates the similarity between the standard feature data and the kth power consumption type.

[0179] In a possible implementation, the calculation formula of the weighted similarity of the standard feature data in the similarity weighting module 305 is:

[0180]

[0181] In the formula, π k represents the weight coefficient of the kth power consumption type, It indicates the similarity between the standard feature data and each power consumption type, and K indicates the number of power consumption types.

[0182] For the description of the features in the embodiment corresponding to the hardware chain attack detection device, reference may be made to the relevant description of the embodiment corresponding to the hardware attack detection method, which will not be described in detail here.

[0183] Figure 4 This is a schematic diagram of the structure of the server provided in the embodiment of the present application. Figure 4 As shown, the server 40 provided in this embodiment includes: at least one processor 401 and a memory 402. Optionally, the server 40 also includes a communication component 403. The processor 401, the memory 402 and the communication component 403 are connected via a bus.

[0184] In a specific implementation process, at least one processor 401 executes the computer execution instructions stored in the memory 402, so that the at least one processor 401 executes the above-mentioned hardware attack detection method embodiment.

[0185] The specific implementation process of the processor 401 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0186] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the application may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0187] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0188] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0189] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above-mentioned hardware attack detection method embodiments when running.

[0190] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0191] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any of the above-mentioned hardware attack detection method embodiments are implemented.

[0192] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above-mentioned hardware attack detection method embodiments are implemented.

[0193] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0194] The above is a detailed introduction to a hardware attack detection method, device, storage medium and product provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A hardware attack detection method, characterized in that: include: Collecting power consumption signals of the electronic device to be tested in real time, and preprocessing the power consumption signals to obtain standard power consumption signal samples; Extracting characteristic data from the standard power consumption signal sample; Performing dimensionality reduction on the feature data, and normalizing the feature data after dimensionality reduction to obtain standard feature data; Inputting the standard feature data into a reference fingerprint library, and outputting the similarity between the standard feature data and each power consumption type, wherein the reference fingerprint library is obtained by clustering power consumption feature data generated by normal electronic devices under different operating conditions using a Gaussian mixture model; Performing weighted summation on the similarity between the standard feature data and each power consumption type to obtain a weighted similarity of the standard feature data; According to the weighted similarity, a hardware attack detection result of the electronic device to be tested is output.

2. The hardware attack detection method according to claim 1, characterized in that: The characteristic data includes frequency domain characteristics, and the frequency domain characteristics include frequency components within a preset frequency range, the amplitude of each frequency component, the energy proportion of each frequency component, the energy proportion of each frequency band, and the harmonic distortion rate of each frequency band; Accordingly, extracting characteristic data from the standard power consumption signal sample includes: Sampling the standard power consumption signal sample to obtain a discrete time domain signal; Using fast Fourier transform to convert the discrete time domain signal into a discrete frequency domain signal, and extract the frequency components within the preset frequency range; According to each frequency component, calculating the amplitude of each frequency component; Calculating the energy proportion of each frequency component according to the amplitude of each frequency component; applying a wavelet transform to decompose the discrete time domain signal into a first number of frequency bands; Calculate the energy proportion of each frequency band according to the discrete time domain signal of each frequency band; The harmonic distortion rate of each frequency band is calculated according to the discrete time domain signal of each frequency band.

3. The hardware attack detection method according to claim 1, characterized in that: The feature data includes a time-frequency joint feature, and the time-frequency joint feature includes a time-frequency variation pattern of a power consumption signal; Accordingly, extracting characteristic data from the standard power consumption signal sample includes: Sampling the standard power consumption signal sample to obtain a discrete time domain signal; Dividing the discrete time domain signal into a plurality of time segments by short-time Fourier transform; For each time segment, the discrete time domain signal is converted into a discrete frequency domain signal by short-time Fourier transform to obtain the time-frequency information corresponding to each time segment; Constructing a power consumption spectrum diagram according to the time-frequency information corresponding to each time segment, wherein the power consumption spectrum diagram reflects the intensity of the power consumption signal at the corresponding time-frequency position; The power consumption spectrum diagram is analyzed to determine the time-frequency variation pattern of the power consumption signal.

4. The hardware attack detection method according to claim 1, characterized in that: The characteristic data includes time domain characteristics, and the time domain characteristics include overall characteristics and transient characteristics; Accordingly, extracting characteristic data from the standard power consumption signal sample includes: Acquire a time domain waveform of a power consumption signal from the standard power consumption signal sample; Calculating the mean, variance and peak-to-peak value of the time domain waveform, wherein the mean, variance and peak-to-peak value of the time domain waveform are used to reflect the overall characteristics of the standard power consumption signal sample; The current pulse width, rise time, fall time and duty cycle of the time domain waveform are calculated, wherein the current pulse width, rise time, fall time and duty cycle of the time domain waveform are used to reflect the transient characteristics of the standard power consumption signal sample.

5. The hardware attack detection method according to claim 1, characterized in that: The attack detection result of the electronic device to be tested is abnormal; Correspondingly, after outputting the hardware attack detection result of the electronic device to be tested, the method further includes: Acquiring temperature data and power consumption data of the electronic device to be tested during operation; Performing filtering processing on the power consumption data to obtain a power consumption sample from which noise is removed, wherein the power consumption sample includes a plurality of power consumption values; Filtering the temperature data to obtain a temperature sample with noise removed, wherein the temperature sample includes a temperature value corresponding to each power consumption value; Inputting the power consumption samples into a pre-trained power consumption-temperature dynamic relationship model to output predicted temperature values ​​corresponding to each power consumption value; Calculating temperature residual data corresponding to each power consumption value according to the temperature value corresponding to each power consumption value and the predicted temperature value; The cause of the abnormality of the electronic device to be tested is determined according to the temperature residual data.

6. The hardware attack detection method according to claim 5, characterized in that: The determining, based on the temperature residual data, a cause of the abnormality of the electronic device to be tested, includes: According to the temperature residual data, a residual distribution diagram is drawn, and the residual distribution diagram is input into a Gaussian model for verification to determine whether the residual distribution diagram conforms to a normal distribution; If the residual distribution graph does not conform to the normal distribution, the abnormal power consumption data is input into the pre-trained power consumption-temperature correlation analysis model to output a power consumption-temperature relationship curve; If the power consumption-temperature relationship curve shows a slow linear drift trend, it is determined to be hardware aging; If a sudden change occurs in the power consumption-temperature relationship curve, it is determined to be artificial tampering.

7. The hardware attack detection method according to claim 5, characterized in that: The construction process of the power consumption-temperature dynamic relationship model is as follows: Acquire a plurality of historical temperature data, wherein the plurality of historical temperature data covers an idle state, a medium load state, and a high load state of the hardware device; Acquire a plurality of historical power consumption data, wherein the plurality of historical power consumption data covers an idle state, a medium load state, and a high load state of the hardware device; Preprocessing the plurality of historical temperature data to obtain a plurality of historical temperature samples with noise interference removed; Preprocessing the plurality of historical power consumption data to obtain a plurality of historical power consumption samples with noise interference removed; Segment the multiple historical temperature samples and the multiple historical power consumption samples according to time series to construct a training data set; According to the training data set, a Kalman filter algorithm is used to establish the power consumption-temperature dynamic relationship model.

8. The hardware attack detection method according to claim 2, characterized in that: The formula for extracting the frequency components within the preset frequency interval is: Where N represents the total number of sampling points, k represents the frequency index, k=0,1,…,N-1, x(n) represents the discrete frequency domain signal, and X(k) represents each frequency component.

9. The hardware attack detection method according to claim 2, characterized in that: The formula for calculating the amplitude of each frequency component is: Where Re(X(k)) represents the real part of the frequency component X(k), Im(X(k)) represents the imaginary part of the frequency component X(k), and |X(k)| represents the amplitude of the frequency component.

10. The hardware attack detection method according to claim 2, characterized in that: The formula for calculating the energy proportion of each frequency component is: Where P(k) represents the energy proportion of the frequency component, |X(k)| represents the amplitude of the frequency component, and N represents the total number of sampling points.

11. The hardware attack detection method according to claim 1, characterized in that: The calculation formula for the similarity between the standard characteristic data and each power consumption type is: In the formula, d represents the feature dimension, μ k represents the mean vector of the kth power consumption type, ∑ k represents the covariance matrix of the kth power consumption type, ∑ k -1 represents the inverse matrix of the covariance matrix of the k-th power consumption type, x represents the input standard feature data, Indicates the similarity between the standard feature data and the kth power consumption type.

12. The hardware attack detection method according to claim 1, characterized in that: The calculation formula of the weighted similarity of the standard feature data is: In the formula, π k represents the weight coefficient of the kth power consumption type, represents the similarity between the standard feature data and each power consumption type, and K represents the number of power consumption types.

13. A server, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the hardware attack detection method according to any one of claims 1 to 12 when executing the computer program.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the hardware attack detection method according to any one of claims 1 to 12.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the hardware attack detection method according to any one of claims 1 to 12 are implemented.

Images