Hardware attack detection method, device, storage medium and product

Abstract

The application discloses a hardware attack detection method and device, a storage medium and a product, relates to the technical field of computers, and comprises the following steps: collecting power consumption signals of a to-be-detected electronic device in real time to monitor the hardware security of the to-be-detected electronic device in real time, collecting power consumption characteristics from multiple dimensions, comprehensively covering various state information of hardware operation, improving the accuracy and reliability of hardware attack detection, converting high-dimensional feature data into low-dimensional feature data, reducing the calculation complexity, and enhancing the distinguishability of different hardware. In addition, the wavelet transform can capture subtle power consumption characteristics and improve the detection accuracy. The standard feature data is input into a benchmark fingerprint library constructed by using a Gaussian mixture model to cluster normal electronic device power consumption feature data, the similarity degrees with various power consumption types are calculated, and then the hardware attack detection result is output by weighted summation, unknown attack modes can be identified, and the false positive rate is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to a hardware attack detection method and device, a storage medium and a product. BACKGROUND

[0002] With the increasing complexity of the hardware of electronic devices, covering multiple links from hardware design, manufacturing to transportation, hardware attacks have become a major challenge in the field of server security.

[0003] At present, whether an electronic device exists hardware attack anomaly is generally identified by measuring the physical characteristics of the hardware, including scanning the circuit board using a radiographic imaging technique to generate a high-resolution image, and detecting whether there is an attack anomaly by comparing the image with a design drawing. However, the above physical detection method needs to be performed in an offline state and cannot be implemented in a production or running environment. SUMMARY

[0004] The present application provides a hardware attack detection method and device, a storage medium and a product to at least solve the problem that the related art cannot be implemented in a production or running environment.

[0005] The present application provides a hardware attack detection method, comprising: collecting a power consumption signal of a to-be-tested electronic device in real time, and pre-processing the power consumption signal to obtain a standard power consumption signal sample; extracting feature data from the standard power consumption signal sample; dimensionally reducing the feature data, and normalizing the dimensionally reduced feature data to obtain standard feature data; inputting the standard feature data into a reference fingerprint library to output the similarity of the standard feature data to each power consumption type, wherein the reference fingerprint library is obtained by clustering power consumption feature data generated by a normal electronic device under different running conditions using a Gaussian mixture model; performing weighted summation on the similarity of the standard feature data to each power consumption type to obtain a weighted similarity of the standard feature data; and outputting a hardware attack detection result of the to-be-tested electronic device according to the weighted similarity.

[0006] The present application also provides a hardware attack detection device, comprising:

[0007] A signal collection module is configured to collect a power consumption signal of a to-be-tested electronic device in real time, and pre-process the power consumption signal to obtain a standard power consumption signal sample.

[0008] A feature extraction module is configured to extract feature data from the standard power consumption signal sample.

[0009] A feature dimension reduction module is configured to dimensionally reduce the feature data, and normalize the dimensionally reduced feature data to obtain standard feature data.

[0010] The similarity comparison module is configured to input the standard feature data into a reference fingerprint library, and output similarity degrees of the standard feature data and each power consumption type, wherein the reference fingerprint library is obtained by clustering power consumption feature data of normal electronic devices under different operating conditions using a Gaussian mixture model.

[0011] The similarity degree weighting module is configured to weight and sum the similarity degrees of the standard feature data and each power consumption type to obtain a weighted similarity degree of the standard feature data.

[0012] The result output module is configured to output a hardware attack detection result of the to-be-tested electronic device according to the weighted similarity degree.

[0013] The application further provides a server, including a memory configured to store a computer program, and a processor configured to execute the computer program to implement the steps of any of the hardware attack detection methods.

[0014] The application further provides a computer readable storage medium, which stores a computer program, wherein the computer program is executed by a processor to implement the steps of any of the hardware attack detection methods.

[0015] The application further provides a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the steps of any of the hardware attack detection methods.

[0016] According to the application, real-time collection of power consumption signals of the to-be-tested electronic device can monitor the hardware security of the to-be-tested electronic device in real time, collection of power consumption features from multiple dimensions can comprehensively cover various state information of hardware operation, and the accuracy and reliability of hardware attack detection are improved. Conversion of high-dimensional feature data into low-dimensional feature data can reduce the computational complexity and enhance the distinguishability of different hardware. In addition, capture of subtle power consumption features through wavelet transform can improve the detection accuracy. Input of the standard feature data into a reference fingerprint library constructed by clustering power consumption feature data of normal electronic devices using a Gaussian mixture model, calculation of similarity degrees of the standard feature data and each power consumption type, and then weight sum and output of a hardware attack detection result can identify unknown attack modes and reduce the false positive rate. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the application, the drawings needed in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0018] Figure 1 A scene schematic diagram of the hardware attack detection method provided by the embodiments of the application is shown in the following figure.

[0019] Figure 2 A flowchart of a hardware attack detection method provided by an embodiment of the present application is shown in FIG. 1.

[0020] Figure 2a A power consumption ripple diagram provided by an embodiment of the present application is shown in FIG. 2.

[0021] Figure 3 A structural diagram of a hardware attack detection device provided by an embodiment of the present application is shown in FIG. 3.

[0022] Figure 4 A structural diagram of a server provided by an embodiment of the present application is shown in FIG. 4. DETAILED DESCRIPTION

[0023] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, any other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0024] It should be noted that, in the description of the present application, the terms “comprise”, “contain” or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes elements inherent to such process, method, article or device. The terms “first”, “second” and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0025] In order to clearly understand the technical solutions of the present application, the prior art solutions are first described in detail. With the increasing complexity of the hardware of electronic devices, covering multiple links from hardware design, manufacturing to transportation, hardware attacks have become a major challenge in the field of server security. Common attack forms of hardware attacks include hardware Trojan horses, counterfeit devices and firmware tampering, etc. The current detection technology for hardware attacks is to measure the physical characteristics of the hardware to identify whether the electronic device is abnormal, including using methods such as X-ray scanning, electron microscope detection and thermal imaging analysis, however, the above physical detection technology needs to be performed in an offline state, and cannot be implemented in a production or running environment, and the cost of single detection is high.

[0026] In order to solve the above technical problems, the inventors think of collecting power consumption signals in real time by installing sensors on the electronic device to be measured, extracting feature data from frequency domain features, time domain features and time-frequency joint features after preprocessing, inputting the feature data into the reference fingerprint library constructed based on the Gaussian mixture model after dimension reduction and normalization processing, and obtaining the hardware attack detection result of the electronic device to be measured by weighted summation. Through multi-dimensional power consumption feature collection, various state information of hardware operation can be comprehensively covered, the accuracy and reliability of hardware attack detection are improved, high-dimensional feature data is converted into low-dimensional feature data, the calculation complexity is reduced, the distinguishability of different hardware is enhanced, and the hardware security of the electronic device to be measured can be monitored in real time.

[0027] In order to enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0028] In combination with the specific application environment architecture or specific hardware architecture on which the hardware attack detection method is executed, the specific application environment architecture or specific hardware architecture is described herein. For reference Figure 1 , Figure 1 The scene schematic diagram of the hardware attack detection method provided by the embodiments of the present application is shown in FIG. 1. Figure 1 As shown in FIG. 1, the specific application scenarios of the present application include a receiving device 101, a processor 102 and a display device 103.

[0029] It can be understood that the structure shown in the embodiments of the present application does not constitute a specific limitation on the hardware attack detection method. In other feasible embodiments of the present application, the above-mentioned architecture can include more or fewer components than the schematic diagram, or combine certain components, or split certain components, or different component arrangement, which can be determined according to the actual application scenario, and is not limited herein. Figure 1 The components shown in the schematic diagram can be realized by hardware, software or a combination of software and hardware.

[0030] In the specific implementation process, the receiving device 101 can be an input / output interface or a communication interface, which is used to obtain the power consumption signals of the electronic device to be measured collected in real time.

[0031] The processor 102 can preprocess the power consumption signal to obtain a standard power consumption signal sample, extract feature data from the standard power consumption signal sample, reduce the dimension of the feature data, normalize the feature data after dimension reduction to obtain standard feature data, input the standard feature data into a reference fingerprint library, and output the similarity of the standard feature data to each power consumption type, wherein the reference fingerprint library is obtained by clustering the power consumption feature data of the normal electronic device under different operating conditions using a Gaussian mixture model; the similarity of the standard feature data to each power consumption type is weighted and summed to obtain the weighted similarity of the standard feature data; and the hardware attack detection result of the to-be-tested electronic device is output according to the weighted similarity.

[0032] The display device 103 can be used to display the hardware attack detection result.

[0033] The display device can also be a touch display screen, which is used to receive user instructions while displaying the above-mentioned content, so as to realize the operation interaction with the user.

[0034] It should be understood that the above processor can be realized by reading the instructions in the memory of the processor and executing the instructions, or by a circuit.

[0035] Figure 2 The flowchart of the hardware attack detection method provided by the embodiment of the application is shown in FIG. 1. Figure 2 The embodiment of the application provides a hardware attack detection method, which is described in detail as follows.

[0036] S201: Real-time acquisition of the power consumption signal of the to-be-tested electronic device, and preprocessing of the power consumption signal to obtain a standard power consumption signal sample.

[0037] Specifically, the server continuously acquires the power consumption signal of the to-be-tested electronic device, uses a high-precision ADC (Analog-to-Digital Converter) on the hardware to capture the power consumption signal of the to-be-tested electronic device on the power supply path, and then removes the interference components in the power consumption signal and synchronizes the time sequence. The sampling rate is set to 1MS / s (1 million sampling points per second) to collect transient current ripples.

[0038] Specifically, the preprocessing process of the power consumption signal includes:

[0039] Sa1: Trigger sampling through the CLKOUT pin of the processor, and use a hardware timestamp counter to mark the timestamp of each sampling point.

[0040] Sa2: Use a differential amplification circuit to eliminate common-mode noise in the power consumption signal, wherein the common-mode noise is a power supply rejection ratio greater than 80 decibels.

[0041] Sa3: removing high-frequency noise in the power consumption signal by using a digital filter to obtain standard power consumption signal samples, wherein the high-frequency noise is greater than 100 kHz.

[0042] S202: extracting feature data from the standard power consumption signal samples.

[0043] Among them, the feature extraction is to extract key information capable of representing hardware characteristics from the original standard power consumption signal samples.

[0044] Among them, the feature data extracted from the standard power consumption signal samples includes time domain features, frequency domain features, and time-frequency joint features. The time domain features are key information capable of representing hardware characteristics extracted from the time domain waveform of the standard power consumption signal samples. The frequency domain features are key information capable of representing hardware characteristics extracted from the frequency domain characteristics of the standard power consumption signal samples.

[0045] Specifically, the frequency domain features include frequency components in a preset frequency interval, amplitude of each frequency component, energy proportion of each frequency component, energy proportion of each frequency band, and harmonic distortion rate of each frequency band. The process of extracting the frequency domain features includes:

[0046] Sb1: sampling the standard power consumption signal samples to obtain a discrete time domain signal.

[0047] Sb2: converting the discrete time domain signal to a discrete frequency domain signal using fast Fourier transform, and extracting frequency components in a preset frequency interval.

[0048] Among them, the preset frequency interval is 2kHz-100kHz.

[0049] Specifically, the formula for extracting frequency components in the preset frequency interval is:

[0050]

[0051] In the formula, N represents the total number of sampling points, k represents the frequency index, k=0,1,…,N-1, x(n) represents the discrete frequency domain signal, and X(k) represents each frequency component.

[0052] Sb3: calculating the amplitude of each frequency component according to each frequency component.

[0053] Specifically, the frequency component calculation formula can calculate the information of the discrete frequency domain signal at the kth frequency, which is specifically represented as a complex number sequence containing amplitude and phase information. The formula for calculating the amplitude of each frequency component according to each frequency component is:

[0054]

[0055] In the formula, Re(X(k)) represents the real part of the frequency component X(k), Im(X(k)) represents the imaginary part of the frequency component X(k), and |X(k)| represents the amplitude of the frequency component.

[0056] Sb4: According to the amplitude of each frequency component, the energy proportion of each frequency component is calculated.

[0057] The energy proportion refers to the proportion of the energy of a specific frequency component in the total energy of the signal in the frequency domain analysis of the power consumption signal, and can intuitively reflect the contribution degree of different frequency components to the energy of the entire power consumption signal.

[0058] Specifically, by processing the standard power consumption signal sample, the amplitudes of the frequency components are obtained, and according to the principle that the signal energy is proportional to the square of the amplitude, the formula for calculating the energy proportion of each frequency component is:

[0059]

[0060] In the formula, P(k) represents the energy proportion of the frequency component, |X(k)| represents the amplitude of the frequency component, and N represents the total number of sampling points.

[0061] Sb5: The discrete time domain signal is decomposed into a first number of frequency bands by wavelet transform.

[0062] The wavelet transform is a time-frequency analysis method, which can better analyze non-stationary signals compared with Fourier transform.

[0063] Specifically, an appropriate wavelet basis function is selected according to the characteristics of the power consumption signal, then the wavelet transform parameters are determined, the number of layers that satisfy the decomposition of the discrete time domain signal into 10 frequency bands is calculated, for example, 4-layer wavelet decomposition is selected, and the boundary processing mode is set. Finally, the selected wavelet basis function and parameters are used to perform wavelet transform on the discrete time domain signal, and 10 different frequency band signals are obtained by gradually decomposing through low-pass and high-pass filters.

[0064] Sb6: According to the discrete time domain signal of each frequency band, the energy proportion of each frequency band is calculated.

[0065] Specifically, for the discrete time domain signal of each frequency band, the signal energy of each sampling point of the frequency band signal is squared and accumulated according to the signal energy calculation formula, and the energy of each frequency band signal is calculated. Then the total energy is obtained by adding the energy of all frequency band signals, and the energy proportion of each frequency band is obtained by dividing the energy of each frequency band by the total energy.

[0066] Sb7: According to the discrete time domain signal of each frequency band, the harmonic distortion rate of each frequency band is calculated.

[0067] The harmonic distortion rate is used to measure the degree of harmonic content in the signal.

[0068] Specifically, the fundamental component is extracted from each frequency band discrete time domain signal by Fourier transform and the like, the fundamental frequency corresponding component is determined after the frequency domain representation is obtained by discrete Fourier transform, and the fundamental component is obtained by inverse Fourier transform. Then the harmonic component is obtained by subtracting the fundamental component from the frequency band signal, the energy of the harmonic component is calculated according to the energy calculation formula of the harmonic component, and the harmonic distortion rate of each frequency band is calculated by taking the square root of the ratio of the energy of the harmonic component to the energy of the fundamental component.

[0069] Specifically, the time-frequency joint feature includes the time-frequency variation pattern of the standard power consumption signal. The process of extracting the time-frequency joint feature from the standard power consumption signal sample includes:

[0070] Sc1: sampling the standard power consumption signal sample to obtain a discrete time domain signal.

[0071] Sc2: dividing the discrete time domain signal into multiple time segments by short-time Fourier transform.

[0072] Specifically, first, the window function and window length of the short-time Fourier transform are determined. Common window functions include the Hanning window, the Hamming window, etc. Then, with the selected window length as the interval, the window function is slid along the signal from the starting point of the discrete time domain signal. Each time the window is slid, the signal part contained in the window is a time segment, and thus the discrete time domain signal is divided into multiple time segments.

[0073] Wherein, the window length determines the length of the time segment.

[0074] Sc3: for each time segment, the discrete time domain signal is converted into a discrete frequency domain signal by short-time Fourier transform to obtain the time-frequency information corresponding to each time segment.

[0075] Specifically, for each time segment divided, the short-time Fourier transform is used again. The discrete time domain signal in the window function is converted from the time domain to the frequency domain by the Fourier transform formula. The Fourier transform decomposes the signal into different frequency components to obtain the amplitude and phase information of each time segment at different frequencies.

[0076] Sc4: according to the time-frequency information corresponding to each time segment, a power spectrum diagram is constructed, wherein the power spectrum diagram reflects the intensity of the power consumption signal at the corresponding time-frequency position.

[0077] Specifically, a coordinate system is established with time as the horizontal axis and frequency as the vertical axis. For the time-frequency information corresponding to each time segment, the amplitude at different frequencies is taken as the signal intensity and is marked at the corresponding time-frequency position. All time segments are processed in turn, and the points are connected or filled to form a power spectrum diagram that directly reflects the intensity distribution of the power consumption signal at different times and different frequencies.

[0078] Sc5: Analyze the power spectrum diagram to determine the time-frequency variation pattern of the power consumption signal.

[0079] Specifically, the position of the signal intensity peak in the spectrum diagram is observed over time. If the peak frequency gradually increases, it may mean that the hardware operating frequency is increasing. The trend of intensity change in different frequency regions is observed, such as a sudden increase in intensity in a high frequency region, which may indicate that the hardware is abnormal. At the same time, the overall shape, symmetry and other characteristics of the spectrum diagram are analyzed, and these information is integrated to summarize the variation law of the power consumption signal in time and frequency dimensions, and determine the corresponding time-frequency variation pattern.

[0080] Specifically, the time domain features include overall characteristics and transient characteristics, and the process of extracting time domain features from standard power consumption signal samples includes:

[0081] Sd1: Obtain the time domain waveform of the power consumption signal from the standard power consumption signal sample.

[0082] Specifically, the time domain data is extracted from the standard power consumption signal sample after denoising, filtering and other preprocessing, and these time domain data are arranged in time sequence in turn, with time as the horizontal axis and power consumption signal amplitude as the vertical axis. The data points are connected by data visualization means, so as to intuitively present the time domain waveform of the power consumption signal.

[0083] Sd2: Calculate the mean, variance and peak-to-peak value of the time domain waveform, wherein the mean, variance and peak-to-peak value of the time domain waveform are used to reflect the overall characteristics of the standard power consumption signal sample.

[0084] Specifically, the amplitudes of all data points on the time domain waveform are added and then divided by the total number of data points to obtain the mean, which represents the average level of the power consumption signal in a period of time. When calculating the variance, first calculate the difference between each data point amplitude and the mean, square the difference values and then sum them up, and then divide by the total number of data points. The variance reflects the fluctuation degree of the signal around the mean. The peak-to-peak value is calculated by finding the maximum and minimum values in the time domain waveform, and the difference between the two is the peak-to-peak value, which reflects the maximum range of signal amplitude change.

[0085] Sd3: Calculate the current pulse width, rise time, fall time and duty cycle of the time domain waveform, wherein the current pulse width, rise time, fall time and duty cycle of the time domain waveform are used to reflect the transient characteristics of the standard power consumption signal sample.

[0086] Specifically, for the current pulse width, first determine the threshold of the pulse signal, when the signal amplitude exceeds the threshold, it is considered that the pulse starts, and when it is below the threshold, it is considered that the pulse ends, the difference between the two time points is the current pulse width, which reflects the duration of the pulse. The rise time is the time experienced from the pulse amplitude reaching 10% to 90%, which is used to measure the speed of the pulse rise. The fall time is the time spent from the pulse amplitude from 90% to 10%, which reflects the speed of the pulse fall. The duty cycle is calculated by the ratio of the current pulse width to the pulse period, and the duty cycle reflects the activity of the pulse signal in a period of time.

[0087] S203: Dimensionality reduction is performed on the feature data, and the dimensionality-reduced feature data is normalized to obtain standard feature data.

[0088] Specifically, first, the principal component analysis method is used to reduce the dimensionality of the high-dimensional feature data extracted from the power consumption signal, and the high-dimensional feature data is projected into a low-dimensional space composed of 32 principal components, thereby completing the dimensionality reduction operation. Subsequently, the 32-dimensional feature data after dimensionality reduction is normalized, and the Z-score standardization method is used to map the data of each dimension to a specific interval (such as [0, 1]), eliminating the differences in dimensions and value ranges of different dimensions.

[0089] Among them, the principal component analysis method will perform eigenvalue decomposition on the covariance matrix of the original feature data to find the principal components that can best explain the data variance.

[0090] S204: The standard feature data is input into the reference fingerprint library, and the similarity degree of the standard feature data to each power consumption type is output, wherein the reference fingerprint library is obtained by clustering the power consumption feature data generated by the normal electronic device under different operating conditions using a Gaussian mixture model.

[0091] Among them, the reference fingerprint library is obtained by clustering the power consumption feature data generated by the normal electronic device under different operating conditions using a Gaussian mixture model, and each Gaussian distribution can be regarded as a mode or a subset, describing the probability distribution of a certain specific power consumption mode.

[0092] Specifically, for each power consumption type in the reference fingerprint library, the similarity degree of the standard feature data to the type is calculated respectively, and the formula is:

[0093]

[0094] In the formula, d represents the feature dimension, μ k represents the mean vector of the kth power consumption type, ∑ k represents the covariance matrix of the kth power consumption type, ∑ k -1an inverse matrix of a covariance matrix of the kth power consumption type, x represents standard feature data of an input, representing the similarity of the standard feature data to the kth power consumption type.

[0095] Exemplarily, if there are 1000 power consumption features of normal devices, a baseline fingerprint library is generated by Gaussian mixture model training. The fingerprint of each normal device is represented as a model parameter set {μ k ,∑ k ,π k}, wherein μ k represents a mean vector, ∑ k represents a covariance matrix, and π k represents a weight coefficient. The input is the data after dimensionality reduction of the time domain features, frequency domain features and time-frequency joint features extracted from the standard feature data, and a power consumption ripple scatter plot is generated. Figure 2a A power consumption ripple schematic diagram provided by an embodiment of the present application. As shown in Figure 2a the contour line in the figure represents the contour surface of the Gaussian distribution, and the surrounding points represent the actual observation data of the power consumption ripple, which is presented in the form of a set of two-dimensional coordinates. The horizontal and vertical coordinates of each point can be different power consumption features. Among them, the data has an obvious clustering trend, and there can be multiple clusters, each cluster representing a different power consumption type. For the extracted power consumption ripple data, the closer it is to the contour surface of the Gaussian distribution, the more it matches the baseline fingerprint library. Among them, the mean vector is the center point of each Gaussian component, which will be located at the center of the contour line. The covariance in the covariance matrix determines the shape of the distribution, and the component with a larger covariance matrix will present a relatively flat or expanded ellipse, while the component with a smaller covariance matrix will present a relatively compact ellipse. The Gaussian component with a larger weight contributes more to the overall distribution of the data, and the contour line will be wider.

[0096] S205: Weighted summing the similarity of the standard feature data to each power consumption type to obtain a weighted similarity of the standard feature data.

[0097] Specifically, the similarity of the Gaussian distribution of each power consumption type is weighted and summed to obtain the formula of the weighted similarity of the standard feature data:

[0098]

[0099] In the formula, π k represents the weight coefficient of the kth power consumption type, represents the similarity of the standard feature data to each power consumption type, and K represents the number of power consumption types.

[0100] S206: Outputting the hardware attack detection result of the to-be-tested electronic device according to the weighted similarity.

[0101] Specifically, a dynamic threshold such as 3σ is set, if p(x) is greater than the dynamic threshold, it is determined that the to-be-tested electronic device is a normal device, and if p(x) is less than the dynamic threshold, it is determined that the to-be-tested electronic device is an abnormal device.

[0102] wherein σ is the standard deviation of the weighted similarity degree, indicating the dispersion degree between the data points and the mean value, according to the properties of normal distribution, about 68% of the data points will fall within ±1σ range of the mean value, about 95% of the data points will fall within ±2σ range, and about 99.7% of the data points will fall within ±3σ range, which is suitable for power consumption fluctuations in different environments.

[0103] In summary, by real-time collection of the power consumption signal of the to-be-tested electronic device, the hardware security of the to-be-tested electronic device can be monitored in real time, the power consumption characteristics are collected from multiple dimensions, which can comprehensively cover various state information of hardware operation, improve the accuracy and reliability of hardware attack detection, convert high-dimensional feature data into low-dimensional feature data, which can reduce the computational complexity and enhance the distinguishability of different hardware.

[0104] In addition, by capturing subtle power consumption characteristics through wavelet transform, the detection accuracy can be improved. The standard feature data is input into the reference fingerprint library constructed by using the Gaussian mixture model to cluster the power consumption feature data of the normal electronic device, the similarity degree with each power consumption type is calculated, and then the hardware attack detection result is output through weighted summation, which can identify unknown attack modes and reduce the false positive rate.

[0105] In another embodiment provided in the present application, there is a strong correlation between the power consumption and the temperature during the hardware operation, the increase of the power consumption will cause the temperature to rise, but this relationship is not linear, but is affected by factors such as heat dissipation conditions and environmental temperature. If the attack detection result of the to-be-tested electronic device is abnormal, it is necessary to determine whether this abnormality is caused by human tampering or by hardware aging, specifically including:

[0106] S301: Obtain temperature data and power consumption data of the to-be-tested electronic device during operation.

[0107] Specifically, the temperature data of the to-be-tested electronic device during operation is obtained through a high-precision temperature sensor, the sensor monitors the device temperature in real time, and converts the temperature signal into an electrical signal, and transmits the converted electrical signal to the data receiving unit of the server through a wired connection or a wireless communication module. The data receiving unit parses the received signal according to the set communication protocol, and extracts the temperature data.

[0108] Specifically, in the power supply circuit of the electronic device to be measured, a series power consumption sampling circuit is connected. When the electronic device to be measured is running, the current in the circuit passes through the sampling element, generating a voltage signal proportional to the current, which, combined with the power supply voltage, can calculate the real-time power consumption of the electronic device to be measured. The power consumption sampling circuit sends the calculated power consumption data to the data receiving unit through the data transmission interface or the internal data bus. The data receiving unit sorts and stores the received power consumption data according to the corresponding data format and protocol.

[0109] S302: filtering the power consumption data to obtain power consumption samples with noise removed, wherein the power consumption samples include a plurality of power consumption values.

[0110] Specifically, a digital filtering algorithm such as mean filtering, median filtering or Kalman filtering is used to process the original power consumption data received from the power consumption sampling circuit. Taking mean filtering as an example, a filter window size is set, for example, 5 consecutive power consumption data points are taken, and the average value of the 5 data points is calculated, which is taken as the first power consumption value after filtering. Then the window slides one data point backward, and the above calculation process is repeated to obtain a series of power consumption values with noise removed, which together constitute the power consumption samples.

[0111] S303: filtering the temperature data to obtain temperature samples with noise removed, wherein the temperature samples include temperature values corresponding to each power consumption value.

[0112] Exemplarily, a filter window size is set, for example, 3 consecutive temperature data points are taken, and the average value of the 3 data points is calculated, which is taken as the first temperature value after filtering. Then the window slides one data point backward, and the above calculation process is repeated to obtain a series of temperature values with noise removed, which together constitute the temperature samples.

[0113] S304: inputting the power consumption samples into a pre-trained power consumption-temperature dynamic relationship model to output predicted temperature values corresponding to each power consumption value.

[0114] The pre-trained power consumption-temperature dynamic relationship model is trained based on a large amount of historical power consumption and temperature data through a machine learning algorithm.

[0115] Specifically, each power consumption value in the filtered power consumption samples is input into the model in turn. The model calculates each input power consumption value according to the learned internal relationship between power consumption and temperature, and outputs the corresponding predicted temperature value.

[0116] Specifically, for each power consumption value in the power consumption sample, the corresponding actually measured temperature value is subtracted from the temperature value predicted by the power consumption-temperature dynamic relationship model to obtain a temperature residual corresponding to the power consumption value. The temperature residuals corresponding to all power consumption values are sequentially recorded to form temperature residual data.

[0117] Specifically, the construction process of the power consumption-temperature dynamic relationship model is as follows:

[0118] Se1: Obtain a plurality of historical temperature data, wherein the plurality of historical temperature data cover the idle state, the medium load state and the high load state of the hardware device.

[0119] Specifically, through long-term, multi-condition monitoring, a plurality of historical temperature data covering different load states of the hardware device are accumulated.

[0120] Se2: Obtain a plurality of historical power consumption data, wherein the plurality of historical power consumption data cover the idle state, the medium load state and the high load state of the hardware device.

[0121] Specifically, by tracking the different running states of the device for a long time, a plurality of historical power consumption data covering a plurality of load conditions are accumulated.

[0122] Se3: Preprocess the plurality of historical temperature data to obtain a plurality of historical temperature samples free of noise interference.

[0123] Specifically, for the collected plurality of historical temperature data, a plurality of digital filtering techniques are used to remove noise interference. First, a mean filtering algorithm is used, and a suitable filtering window is set, such as taking the average of 5 consecutive temperature data points as the first temperature value after filtering, and then the window is slid by one data point, and the calculation is repeated to preliminarily smooth the temperature curve and remove high-frequency noise peaks. Then, a median filtering algorithm is used to process the data after mean filtering again, and the median value is selected as the output in the same window to further eliminate possible abnormal value interference. After this series of preprocessing steps, a plurality of historical temperature samples that are continuous, smooth and free of noise interference are obtained.

[0124] Se4: Preprocess the plurality of historical power consumption data to obtain a plurality of historical power consumption samples free of noise interference.

[0125] Specifically, the filter window size is set according to the characteristics of the power consumption data, for example, the average of 7 consecutive power consumption data points is calculated to preliminarily smooth the original power consumption data, and then the median filtering is used to select the median value in the same window to replace the original data to further eliminate abnormal power consumption values.

[0126] Se5: Segment the plurality of historical temperature samples and the plurality of historical power consumption samples according to time sequence to construct a training data set.

[0127] The preprocessed plurality of historical temperature samples and plurality of historical power consumption samples are synchronously segmented according to chronological order. For example, 1 minute is taken as a time period, and the corresponding temperature sample value and power consumption sample value in the time period are combined into a data pair. In this way, the data in the entire time span is divided into a plurality of data pairs, and each data pair contains temperature and power consumption information at a specific time. These data pairs collectively constitute a training data set.

[0128] Se6: According to the training data set, a power consumption-temperature dynamic relationship model is established by using Kalman filtering algorithm.

[0129] S306: According to the temperature value corresponding to each power consumption value and the predicted temperature value, the temperature residual data corresponding to each power consumption value is calculated.

[0130] Specifically, first, the state vector and covariance matrix of the model are initialized, the state vector contains the current time power consumption and temperature estimation value, and the covariance matrix is used to measure the uncertainty of the estimation value. Then, for each data pair in the training data set, according to the state estimation value at the last time and the measurement value at the current time, the prediction and update steps of Kalman filtering are used to continuously adjust the state estimation value and covariance matrix. In the prediction step, the next time state is predicted according to the dynamic model of the system; in the update step, the predicted value is corrected combined with the new measurement value. Through the iterative processing of the entire training data set, the Kalman filtering algorithm gradually learns the dynamic relationship between power consumption and temperature, and establishes a power consumption-temperature dynamic relationship model that can accurately describe the relationship between the two.

[0131] S307: According to the temperature residual data, the reason for the abnormality of the electronic device to be measured is judged.

[0132] Specifically, if the temperature residual data is generally large and shows irregular fluctuations, it may mean that the device has a heat dissipation problem, causing the actual temperature to be higher than the predicted temperature corresponding to normal power consumption. If the residual data suddenly increases in a certain time period, it may indicate that the device has an abnormally high power consumption operation or hardware failure at that time. The specific judgment process is as follows:

[0133] Sf1: According to the temperature residual data, a residual distribution graph is drawn, and the residual distribution graph is input into a Gaussian model for verification to determine whether the residual distribution graph conforms to a normal distribution.

[0134] Specifically, based on the temperature residual data, residual values are taken as the ordinate, and the corresponding sample serial number or time point is taken as the abscissa, and a residual distribution graph is drawn using drawing software. Each point in the graph represents a temperature residual corresponding to a power consumption value. After drawing is completed, the data of the residual distribution graph is input into a pre-constructed Gaussian model. The Gaussian model is based on the probability density function of normal distribution, and by calculating the theoretical probability distribution of residual data in different value intervals and comparing and analyzing the data distribution in the actual residual distribution graph, the goodness-of-fit test and other methods are used to determine whether the residual distribution graph conforms to the normal distribution.

[0135] Sf2: If the residual distribution graph does not conform to the normal distribution, the abnormal power consumption data is input into a pre-trained power consumption-temperature correlation analysis model to output a power consumption-temperature relationship curve.

[0136] Specifically, if it is determined that the residual distribution graph does not conform to the normal distribution, first, the power consumption data corresponding to the abnormal residual is determined. These abnormal power consumption data are the power consumption values collected when the temperature residual is abnormal. These abnormal power consumption data are input into the pre-trained power consumption-temperature correlation analysis model. The model analyzes the potential relationship between power consumption and temperature according to the input abnormal power consumption data through an internal operation mechanism, and outputs the corresponding power consumption-temperature relationship curve.

[0137] Among them, the power consumption-temperature relationship curve intuitively shows the change trend of power consumption and temperature under abnormal conditions.

[0138] Sf3: If the power consumption-temperature relationship curve shows a slow linear drift trend, it is determined that the hardware is aging.

[0139] Specifically, if the curve shows a slow linear upward or downward trend as the time or power consumption value increases, that is, the temperature increases or decreases at a relatively stable and gradually changing rate as the power consumption changes, for example, due to long-term use, the performance of internal transistors gradually deteriorates, causing the heat generated at the same power consumption to gradually increase, which is reflected in the power consumption-temperature relationship curve as a slow linear drift. Based on this feature, it is determined that the device abnormality is caused by hardware aging.

[0140] Sf4: If there is a mutation in the power consumption-temperature relationship curve, it is determined that it is human tampering.

[0141] Specifically, when an obvious mutation point is observed in the power consumption-temperature relationship curve, that is, at a certain time or at a certain power consumption value, the temperature suddenly rises or falls greatly, and this change does not conform to the correlation rule of power consumption and temperature during normal operation of the device. By identifying this mutation feature in the power consumption-temperature relationship curve, combined with the use environment and historical operation records of the device, it is determined that the device abnormality is caused by human tampering.

[0142] In summary, by receiving and processing the temperature and power consumption data of the device, the pre-trained power consumption-temperature dynamic relationship model is used to predict the temperature, and the temperature residual data is calculated to determine the abnormal reason. The residual distribution diagram verifies whether it conforms to the normal distribution by means of the Gaussian model, and when it is abnormal, the relationship curve is output by the power consumption-temperature correlation analysis model, and the hardware aging and human tampering are distinguished according to the curve characteristics. At the same time, the model construction process covers comprehensive collection of historical temperature and power consumption data under different load conditions, pre-processing, time series segmentation to build training data set, and then using Kalman filtering algorithm to establish the model. This series of technical means can accurately locate the root cause of device anomaly, effectively distinguish between hardware natural aging and human tampering, provide strong support for hardware security, and greatly improve the accuracy and reliability of detection, and timely discover potential hardware attack risks.

[0143] In the embodiments provided in the present application, when the hardware attack detection result of the to-be-tested electronic device is abnormal, a corresponding graded response will be triggered, and the specific process includes:

[0144] S401: According to the weighted similarity degree, the abnormal probability of the hardware attack detection result of the to-be-tested electronic device is calculated.

[0145] S402: If the abnormal probability is less than 68%, record the abnormal log and notify the operation and maintenance personnel.

[0146] Specifically, if the abnormal probability is less than 68%, the server records the relevant information of this hardware attack detection result in the abnormal log in a special log recording module, including the detection time, the preliminary judgment of the abnormal type, the involved hardware components, etc. At the same time, the system timely informs the operation and maintenance personnel of the abnormal situation through a pre-set communication channel, such as short message notification, email push or pop-up window reminder of the operation and maintenance platform, etc., so that the operation and maintenance personnel can further analyze and troubleshoot possible minor hardware abnormal problems according to the log record, and take appropriate maintenance measures.

[0147] S403: If the abnormal probability is greater than or equal to 68% and less than 99.7%, isolate the to-be-tested electronic device and start the trusted platform module firmware verification.

[0148] Specifically, if the abnormal probability is greater than or equal to 68% and less than 99.7%, the to-be-tested electronic device is isolated from the current network environment, and the data communication connection with other devices is disconnected to prevent possible security risk from spreading. At the same time, the TPM firmware (Trusted Platform Module, firmware verification trusted platform module) verification process is automatically triggered. The system sends instructions to the TPM, and the TPM checks the integrity of the firmware stored in itself according to the built-in verification algorithm, checks whether the firmware is tampered by comparing the firmware signature, hash value and other information, to determine whether there is a security risk at the bottom firmware level of the device.

[0149] S404: If the anomaly probability is greater than or equal to 99.7%, cut off the power supply circuit, and roll back the firmware to the golden image through the platform firmware resilience mechanism.

[0150] The golden image is a firmware backup of the device in a safe and normal state.

[0151] Specifically, when the anomaly probability is greater than or equal to 99.7%, the power supply of the electronic device under test is quickly cut off by the control circuit, so that it stops running, and the PFR (Platform Firmware Resilience) mechanism is started. The mechanism uses the pre-stored golden image to roll back the device firmware to a known safe version. During the rollback process, the PFR mechanism monitors and verifies the firmware recovery process to ensure that the firmware is successfully recovered and the device can be restarted in a safe state.

[0152] As can be seen from the above, when the hardware attack detection result is abnormal, the hierarchical response mechanism quantifies the anomaly probability accurately by means of a scientific algorithm, and realizes layered processing of different risk levels. By recording logs and notifying operation and maintenance, slight abnormalities can be solved in time; device isolation and TPM firmware verification can effectively contain medium risk diffusion and ensure bottom security; cutting off the power supply and PFR mechanism rolling back the firmware can quickly stop loss and restore the safe state of the device under high risk, and comprehensively improve the protection, response and recovery capabilities of the device when facing attacks, and effectively guarantee the security, stability and data integrity of the hardware system.

[0153] Through the description of the above implementation manner, those skilled in the art can clearly understand that the method according to the above embodiment can be realized by means of software and necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better implementation manner.

[0154] Figure 3 The structural schematic diagram of the hardware attack detection device provided by the embodiment of the application is shown in FIG. 1. Figure 3 As shown in FIG. 1, the embodiment of the application further provides a hardware attack detection device. The device comprises a signal acquisition module 301, a feature extraction module 302, a feature dimension reduction module 303, a similarity comparison module 304, a similarity degree weighting module 305 and a result output module 306.

[0155] The signal acquisition module 301 is configured to acquire the power consumption signal of the electronic device under test in real time, and pre-process the power consumption signal to obtain a standard power consumption signal sample.

[0156] The feature extraction module 302 is configured to extract feature data from the standard power consumption signal sample.

[0157] The feature dimension reduction module 303 is configured to reduce the dimension of the feature data, and normalize the feature data after the dimension reduction to obtain standard feature data.

[0158] The similarity comparison module 304 is configured to input the standard feature data into a reference fingerprint library, and output the similarity of the standard feature data to each power consumption type, wherein the reference fingerprint library is obtained by clustering power consumption feature data generated by normal electronic devices under different operating conditions using a Gaussian mixture model.

[0159] The similarity degree weighting module 305 is configured to weight and sum the similarity of the standard feature data to each power consumption type to obtain a weighted similarity degree of the standard feature data.

[0160] The result output module 306 is configured to output a hardware attack detection result of the to-be-tested electronic device according to the weighted similarity degree.

[0161] In a possible implementation, the feature extraction module 302 is specifically configured to sample the standard power consumption signal sample to obtain a discrete time domain signal; convert the discrete time domain signal to a discrete frequency domain signal using fast Fourier transform, and extract frequency components in a preset frequency interval; calculate amplitudes of the frequency components according to the frequency components; calculate energy proportions of the frequency components according to the amplitudes of the frequency components; apply wavelet transform to decompose the discrete time domain signal into a first number of frequency bands; calculate energy proportions of the frequency bands according to the discrete time domain signals of the frequency bands; and calculate harmonic distortion rates of the frequency bands according to the discrete time domain signals of the frequency bands.

[0162] In a possible implementation, the feature extraction module 302 is specifically configured to sample the standard power consumption signal sample to obtain a discrete time domain signal; divide the discrete time domain signal into a plurality of time segments through short-time Fourier transform; convert the discrete time domain signal to a discrete frequency domain signal through short-time Fourier transform for each time segment to obtain time-frequency information corresponding to each time segment; construct a power consumption spectrum diagram according to the time-frequency information corresponding to each time segment, wherein the power consumption spectrum diagram reflects the intensity of the power consumption signal at the corresponding time-frequency position; and analyze the power consumption spectrum diagram to determine a time-frequency variation mode of the power consumption signal.

[0163] In a possible implementation, the feature extraction module 302 is specifically configured to obtain a time domain waveform of the power consumption signal from the standard power consumption signal sample; calculate a mean value, a variance and a peak-to-peak value of the time domain waveform, wherein the mean value, the variance and the peak-to-peak value of the time domain waveform are used to reflect overall characteristics of the standard power consumption signal sample; and calculate a current pulse width, a rise time, a fall time and a duty cycle of the time domain waveform, wherein the current pulse width, the rise time, the fall time and the duty cycle of the time domain waveform are used to reflect transient characteristics of the standard power consumption signal sample.

[0164] In a possible implementation, the apparatus further includes an abnormality reason determining module, configured to: acquire temperature data and power consumption data of the electronic device under test during runtime; perform filtering processing on the power consumption data to obtain power consumption samples from which noise is removed, wherein the power consumption samples include a plurality of power consumption values; perform filtering processing on the temperature data to obtain temperature samples from which noise is removed, wherein the temperature samples include temperature values corresponding to the power consumption values; input the power consumption samples into a pre-trained power consumption-temperature dynamic relationship model to output predicted temperature values corresponding to the power consumption values; and calculate temperature residual data corresponding to the power consumption values according to the temperature values corresponding to the power consumption values and the predicted temperature values; and determine the reason for the abnormality of the electronic device under test according to the temperature residual data.

[0165] In a possible implementation, the abnormality reason determining module is specifically configured to: draw a residual distribution graph according to the temperature residual data, and input the residual distribution graph into a Gaussian model for verification to determine whether the residual distribution graph conforms to a normal distribution; if the residual distribution graph does not conform to the normal distribution, input the abnormal power consumption data into a pre-trained power consumption-temperature correlation analysis model to output a power consumption-temperature relationship curve; if the power consumption-temperature relationship curve presents a slow linear drift trend, determine that the reason for the abnormality is hardware aging; and if a mutation appears in the power consumption-temperature relationship curve, determine that the reason for the abnormality is human tampering.

[0166] In a possible implementation, the apparatus further includes a power consumption-temperature dynamic relationship model constructing module, configured to: acquire a plurality of historical temperature data, wherein the plurality of historical temperature data cover an idle state, a medium load state and a high load state of the hardware device; acquire a plurality of historical power consumption data, wherein the plurality of historical power consumption data cover the idle state, the medium load state and the high load state of the hardware device; perform preprocessing on the plurality of historical temperature data to obtain a plurality of historical temperature samples from which noise interference is removed; perform preprocessing on the plurality of historical power consumption data to obtain a plurality of historical power consumption samples from which noise interference is removed; segment the plurality of historical temperature samples and the plurality of historical power consumption samples according to time sequences to construct a training data set; and establish a power consumption-temperature dynamic relationship model by using a Kalman filtering algorithm according to the training data set.

[0167] In a possible implementation, the formula for extracting frequency components in the preset frequency interval in the feature extraction module 302 is as follows:

[0168]

[0169] In the formula, N represents the total number of sampling points, k represents a frequency index, k=0, 1,..., N-1, x(n) represents a discrete frequency domain signal, and X(k) represents each frequency component.

[0170] In a possible implementation, the formula for calculating the amplitude of each frequency component in the feature extraction module 302 is:

[0171]

[0172] In the formula, Re(X(k)) represents the real part of the frequency component X(k), Im(X(k)) represents the imaginary part of the frequency component X(k), and |X(k)| represents the amplitude of the frequency component.

[0173] In a possible implementation, the formula for calculating the energy proportion of each frequency component in the feature extraction module 302 is:

[0174]

[0175] In the formula, P(k) represents the energy proportion of the frequency component, |X(k)| represents the amplitude of the frequency component, and N represents the total number of sampling points.

[0176] In a possible implementation, the formula for calculating the similarity degree of the standard feature data to each power consumption type in the similarity degree weighting module 305 is:

[0177]

[0178] In the formula, d represents the feature dimension, μ k represents the mean vector of the kth power consumption type, ∑ k represents the covariance matrix of the kth power consumption type, ∑ k -1 represents the inverse matrix of the covariance matrix of the kth power consumption type, x represents the input standard feature data, represents the similarity degree of the standard feature data to the kth power consumption type.

[0179] In a possible implementation, the formula for calculating the weighted similarity degree of the standard feature data in the similarity degree weighting module 305 is:

[0180]

[0181] In the formula, π k represents the weight coefficient of the kth power consumption type, represents the similarity degree of the standard feature data to each power consumption type, and K represents the number of power consumption types.

[0182] The features in the embodiments of the hardware chain attack detection apparatus can refer to the related descriptions of the embodiments of the hardware attack detection method, which will not be repeated here.

[0183] Figure 4 The server provided in the embodiments of the present application is shown in a structural schematic diagram. As shown in FIG. 6, the server includes a processor 601, a memory 602, a communication interface 603, and a bus 604.Figure 4 As shown, the server 40 provided by the embodiment includes at least one processor 401 and a memory 402. Optionally, the server 40 further includes a communication component 403. Wherein, the processor 401, the memory 402 and the communication component 403 are connected through a bus.

[0184] In the process of implementation, the at least one processor 401 executes the computer execution instructions stored in the memory 402, so that the at least one processor 401 executes the above-mentioned hardware attack detection method embodiment.

[0185] The specific implementation process of the processor 401 can refer to the above-mentioned method embodiments, which have similar implementation principles and technical effects, and will not be described here in detail.

[0186] In the above-mentioned embodiments, it should be understood that the processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC) and the like. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor and the like. The steps of the method disclosed in the application can be directly embodied as hardware processor execution, or executed by hardware and software modules in the processor.

[0187] The memory can contain a random access memory (RAM), and can also include a non-volatile memory (NVM), for example, at least one disk memory.

[0188] The bus can be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus or an extended industry standard architecture (EISA) bus and the like. The bus can be divided into an address bus, a data bus, a control bus and the like. For the convenience of representation, the bus in the drawings of the application does not limit to only one bus or one type of bus.

[0189] The embodiment of the application further provides a computer readable storage medium, the computer readable storage medium stores a computer program, wherein the computer program is set to execute the steps in any of the above-mentioned hardware attack detection method embodiments when running.

[0190] In an example embodiment, the computer readable storage medium described above can include, but is not limited to, a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.

[0191] Embodiments of the present application also provide a computer program product including a computer program, which, when executed by a processor, implements the steps in any of the hardware attack detection method embodiments described above.

[0192] Embodiments of the present application also provide another computer program product including a non-volatile computer readable storage medium, which stores a computer program, and the computer program, when executed by a processor, implements the steps in any of the hardware attack detection method embodiments described above.

[0193] The skilled in the art can further realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in the above description in a general manner. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. The skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0194] The above provides a detailed description of a hardware attack detection method, device, storage medium and product provided by the present application. The principles and implementation modes of the present application are described by applying specific examples in this paper, and the above description of the examples is only used to help understand the method of the present application and its core idea. It should be pointed out that, for those skilled in the art, without departing from the principles of the present application, some improvements and modifications can be made to the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.

Claims

1. A hardware attack detection method, characterized in that, include: The power consumption signal of the electronic device under test is acquired in real time, and the power consumption signal is preprocessed to obtain a standard power consumption signal sample. Feature data is extracted from the standard power consumption signal samples. The feature data includes frequency domain features, time-frequency joint features, and time domain features. The time domain features include overall characteristics and transient characteristics. The feature data is dimensionality reduced, and the dimensionality-reduced feature data is then normalized to obtain standard feature data. The standard feature data is input into the benchmark fingerprint database. For each power consumption type in the benchmark fingerprint database, the similarity between the standard feature data and each power consumption type is output. The benchmark fingerprint database is obtained by clustering the power consumption feature data generated by normal electronic devices under different operating conditions using a Gaussian mixture model. The weighted similarity between the standard feature data and each power consumption type is summed by weights to obtain the weighted similarity of the standard feature data. Based on the weighted similarity, the hardware attack detection result of the electronic device under test is output; if the weighted similarity is greater than the preset dynamic threshold, the hardware attack detection result of the electronic device under test is normal; if the weighted similarity is less than the preset dynamic threshold, the hardware attack detection result of the electronic device under test is abnormal. The hardware attack detection result of the electronic device under test is abnormal. After outputting the hardware attack detection result of the electronic device under test, the method further includes: Acquire the temperature and power consumption data of the electronic device under test during operation; The power consumption data is filtered to obtain a power consumption sample with noise removed, wherein the power consumption sample includes multiple power consumption values; The temperature data is filtered to obtain noise-removed temperature samples, wherein the temperature samples include temperature values ​​corresponding to each power consumption value; The power consumption samples are input into a pre-trained power consumption-temperature dynamic relationship model to output the predicted temperature value corresponding to each power consumption value. Based on the temperature value corresponding to each power consumption value and the predicted temperature value, calculate the temperature residual data corresponding to each power consumption value; Based on the temperature residual data, a residual distribution map is plotted, and the residual distribution map is input into a Gaussian model for verification to determine whether the residual distribution map conforms to a normal distribution. If the residual distribution plot does not conform to a normal distribution, the abnormal power consumption data will be input into the pre-trained power consumption-temperature correlation analysis model to output the power consumption-temperature relationship curve. If the power consumption-temperature relationship curve shows a slow linear drift trend, then the cause of the abnormality of the electronic device under test is determined to be hardware aging. If a sudden change occurs in the power consumption-temperature relationship curve, the cause of the abnormality of the electronic device under test is determined to be human tampering; Extracting time-domain features from the standard power consumption signal samples includes: Obtain the time-domain waveform of the power consumption signal from the standard power consumption signal sample; Calculate the mean, variance, and peak-to-peak value of the time-domain waveform, wherein the mean, variance, and peak-to-peak value of the time-domain waveform are used to reflect the overall characteristics of the standard power consumption signal sample; Calculate the current pulse width, rise time, fall time, and duty cycle of the time-domain waveform, wherein the current pulse width, rise time, fall time, and duty cycle of the time-domain waveform are used to reflect the transient characteristics of the standard power consumption signal sample.

2. The hardware attack detection method according to claim 1, characterized in that, The frequency domain features include frequency components within a preset frequency range, the amplitude of each frequency component, the energy proportion of each frequency component, the energy proportion of each frequency band, and the harmonic distortion rate of each frequency band. Accordingly, frequency domain features are extracted from the standard power consumption signal samples, including: The standard power consumption signal sample is sampled to obtain a discrete time-domain signal; The discrete time domain signal is converted to a discrete frequency domain signal using a fast Fourier transform, and the frequency components within the preset frequency range are extracted. Calculate the amplitude of each frequency component based on each frequency component; Calculate the energy percentage of each frequency component based on its amplitude. The discrete-time signal is decomposed into a first number of frequency bands using wavelet transform; The energy percentage of each frequency band is calculated based on the discrete time-domain signal of each frequency band. The harmonic distortion rate of each frequency band is calculated based on the discrete time-domain signal of each frequency band.

3. The hardware attack detection method according to claim 1, characterized in that, The time-frequency joint feature includes the time-frequency variation pattern of the power consumption signal; Accordingly, time-frequency joint features are extracted from the standard power consumption signal samples, including: The standard power consumption signal sample is sampled to obtain a discrete time-domain signal; The discrete time-domain signal is divided into multiple time segments using short-time Fourier transform; For each time segment, the discrete time domain signal is converted into a discrete frequency domain signal by short-time Fourier transform to obtain the time-frequency information corresponding to each time segment; Based on the time-frequency information corresponding to each time segment, a power consumption spectrum diagram is constructed, wherein the power consumption spectrum diagram reflects the intensity of the power consumption signal at the corresponding time-frequency position; The power consumption spectrum is analyzed to determine the time-frequency variation pattern of the power consumption signal.

4. The hardware attack detection method according to claim 1, characterized in that, The process of constructing the power consumption-temperature dynamic relationship model is as follows: Acquire multiple historical temperature data, wherein the multiple historical temperature data cover multiple historical temperature data under different load states of the hardware device; Acquire multiple historical power consumption data, wherein the multiple historical power consumption data cover multiple historical power consumption data under various load conditions of the hardware device; The multiple historical temperature data are preprocessed to obtain multiple historical temperature samples with noise interference removed; The multiple historical power consumption data are preprocessed to obtain multiple historical power consumption samples with noise interference removed; The multiple historical temperature samples and the multiple historical power consumption samples are segmented according to time series to construct a training dataset; Based on the training dataset, the power consumption-temperature dynamic relationship model is established using the Kalman filter algorithm.

5. The hardware attack detection method according to claim 2, characterized in that, The formula for extracting frequency components within the preset frequency range is as follows: In the formula, N represents the total number of sampling points, and k represents the frequency index. , Represents discrete frequency domain signals. This represents each frequency component.

6. The hardware attack detection method according to claim 5, characterized in that, The formula for calculating the amplitude of each frequency component is as follows: In the formula, Represents frequency components The real part, Represents frequency components The imaginary part, This represents the amplitude of the frequency component.

7. The hardware attack detection method according to claim 6, characterized in that, The formula for calculating the energy percentage of each frequency component is as follows: In the formula, This indicates the energy percentage of the frequency component. This represents the amplitude of the frequency component. This indicates the total number of sampling points.

8. The hardware attack detection method according to claim 1, characterized in that, The formula for calculating the similarity between the standard feature data and each power consumption type is as follows: In the formula, Representing feature dimension, Indicates the first A mean vector of power consumption types Indicates the first Covariance matrices of power consumption type Indicates the first The inverse matrix of the covariance matrix of power consumption type. This represents the standard feature data of the input. This indicates that the standard feature data is related to the first... The degree of similarity among power consumption types.

9. The hardware attack detection method according to claim 1, characterized in that, The formula for calculating the weighted similarity of the standard feature data is as follows: In the formula, Indicates the first Weighting coefficients for each power consumption type This indicates the degree of similarity between the standard feature data and each power consumption type. Indicates the number of power consumption types.

10. A server, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the hardware attack detection method as described in any one of claims 1 to 9 when executing the computer program.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the hardware attack detection method as described in any one of claims 1 to 9.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the hardware attack detection method as described in any one of claims 1 to 9.

Images