A method and system for real-time threat monitoring and defense of digital infrastructure

Abstract

The present invention relates to the field of computer network security technology, and discloses a real-time threat monitoring and defense method and system for digital infrastructure, the method comprising: segmenting WASM modules and dynamic code modules, dividing the code into static segments, performance-critical segments, and dynamically loaded segments, and generating differentiated protection strategies; building a two-layer control flow protection system, combining shadow stack technology with runtime verification to ensure the security of function calls and returns; utilizing hardware accelerated verification technology to perform verification in parallel with the main application through a dedicated core to reduce verification overhead; achieving dynamic code isolation and permission control to prevent dynamically loaded code from performing out-of-bounds operations and unauthorized access; building an adaptive security control system to dynamically adjust the verification strategy according to the security sensitivity and execution frequency of the code block. The present invention provides comprehensive security protection with extremely low performance overhead, and is particularly suitable for critical digital infrastructures that have strict requirements on both performance and security.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, and more specifically, to a method and system for real-time threat monitoring and defense of digital infrastructure. Background Art

[0002] With the widespread application of WASM (Web Assembly) modules and dynamic code loading technology in critical digital infrastructure such as cloud computing, edge computing, IoT gateways, financial transaction systems, and industrial control networks, security risks continue to emerge. Web Assembly is a virtual instruction set architecture (virtual ISA). The overall architecture includes core ISA definition, binary encoding, program semantics definition and execution, and application programming interfaces (Web Assembly APIs) for different embedded environments (such as the Web).

[0003] Existing security protection technologies have the following technical problems:

[0004] WASM's hybrid execution mode (coexistence of interpreted execution and JIT compilation) and dynamic module loading make traditional protection measures unable to fully cover all execution scenarios;

[0005] Existing stack protection technology and Address Space Layout Randomization (ASLR) can be bypassed by specific attack methods;

[0006] Static code analysis methods have a high false positive rate when dealing with dynamically loaded code, while purely dynamic monitoring methods incur significant performance overhead;

[0007] For critical digital infrastructure with high real-time requirements, the runtime delay introduced by existing control flow protection mechanisms is unacceptable;

[0008] Lack of real-time and efficient verification capabilities for dynamically loaded code.

[0009] Therefore, a new technical solution is needed that can ensure high security while maintaining low performance overhead and is suitable for critical digital infrastructure environments with strict real-time requirements. Summary of the Invention

[0010] The present invention provides a method and system for real-time threat monitoring and defense of digital infrastructure, which solves the technical problem of the contradiction between security and performance when processing dynamically loaded code in related technologies.

[0011] The present invention provides a method for real-time threat monitoring and defense of digital infrastructure, comprising the following steps:

[0012] Segment the WASM module and dynamic code module, dividing the code into static segments, performance-critical segments, and dynamically loaded segments, and generate differentiated protection strategies;

[0013] Build a two-layer control flow protection system that combines shadow stack technology with runtime verification to ensure the security of function calls and returns;

[0014] Leverage hardware-accelerated verification technology to reduce verification overhead by executing verification in parallel with the main application through a dedicated core;

[0015] Implement dynamic code isolation and permission control to prevent dynamically loaded code from performing out-of-bounds operations and unauthorized access;

[0016] Build an adaptive security control system to dynamically adjust the verification strategy based on the security sensitivity and execution frequency of the code block.

[0017] Furthermore, segmenting the code includes:

[0018] Divide the code module into static segments, performance-critical segments, and dynamically loaded segments;

[0019] Generate a control flow graph for the static segment and define the set of legal control transfer paths;

[0020] Analyze function call signatures and build a function call signature verification model;

[0021] Generate differentiated protection strategies for different code segments based on their type and security importance.

[0022] Furthermore, building a two-layer control flow protection system includes:

[0023] Maintain an independent shadow stack system at the interpreter level to store function return address information;

[0024] Implement runtime verification logic for direct and indirect control flow transfers;

[0025] Perform function return address verification and compare the return address on the current stack with the expected return address stored in the shadow stack;

[0026] Build exception handling and recovery systems to handle control flow violations.

[0027] Furthermore, hardware-accelerated verification technologies include:

[0028] Identify and apply the hardware security features available on the platform and build a hardware-assisted verification system;

[0029] Implement a pre-calculated hash verification model to calculate hash values ​​for legal control flow paths, and only compare hash values ​​to verify the legitimacy of control flow at runtime;

[0030] Build a parallel verification execution architecture to execute verification through independent processor cores, reducing the impact on the main application performance;

[0031] Optimize verification instruction scheduling and use processor instruction-level parallelism and predictive verification to reduce overhead.

[0032] Furthermore, dynamic code isolation and permission control are implemented as follows:

[0033] Create an isolated execution environment for dynamically loaded code modules and limit the memory range they can access;

[0034] Build a dynamic code loading verification system to verify modules before loading and convert them during loading;

[0035] Implement fine-grained resource access control, build a resource access policy model, and limit the resource access rights of modules;

[0036] Build a real-time behavior monitoring system, define a behavior pattern library, and identify operations that deviate from normal behavior patterns.

[0037] Furthermore, building an adaptive safety control system includes:

[0038] Build a code block risk assessment model to calculate the criticality, vulnerability, and accessibility indicators of code blocks;

[0039] Implement execution statistics and hotspot analysis, record code block execution frequency, and identify performance critical paths;

[0040] Build an adaptive verification frequency control system to dynamically adjust verification density based on risk score and execution frequency;

[0041] Implement dynamic security policy adjustment and automatically switch different security policies according to the system threat level.

[0042] Furthermore, the pre-computed hash verification model adopts an incremental hash calculation method to update the path hash value in real time when the control flow transfer occurs, avoiding the overhead of storing the complete execution path.

[0043] Furthermore, the code block risk scoring function uses the hierarchical analysis method to determine the weight coefficient, and evaluates the criticality, vulnerability and accessibility indicators of the code block from multiple dimensions of resource access, code quality and exposure level.

[0044] Furthermore, the method is applicable to the computing environments of WASM modules, edge computing, and IoT gateways. Through differentiated protection strategies and adaptive security control, it ensures security while controlling performance overhead.

[0045] The present invention further provides a digital infrastructure real-time threat monitoring and defense system, which is used to perform the steps of the aforementioned digital infrastructure real-time threat monitoring and defense method, including:

[0046] Code segmentation module: used to divide the code into static segments, performance-critical segments, and dynamically loaded segments, and generate differentiated protection strategies;

[0047] Control flow protection module: used to combine shadow stack technology with runtime verification to ensure the security of function calls and returns;

[0048] Hardware-accelerated verification module: used to perform verification in parallel with the main application through a dedicated core, reducing verification overhead;

[0049] Dynamic code isolation module: used to prevent dynamically loaded code from performing out-of-bounds operations and unauthorized access;

[0050] Adaptive security control module: used to dynamically adjust the verification strategy based on the security sensitivity and execution frequency of the code block.

[0051] The beneficial effects of the present invention are:

[0052] Mathematically Proven Security: Through a segmented control flow verification algorithm and a two-layer control flow protection system, this approach provides mathematically provable security, preventing all attacks that violate the predefined control flow specifications. In practical application testing, the success rate of control flow hijacking attacks was reduced to near zero, maintaining effective protection even against targeted advanced persistent threat (APT) attacks.

[0053] Extremely low performance overhead: Through hardware-accelerated verification, a pre-computed hash verification model, a parallel verification execution architecture, and an adaptive security control system, this approach keeps verification overhead below 5%, significantly lower than the 10-30% performance loss of traditional methods. This makes this approach particularly suitable for critical digital infrastructure with strict real-time requirements, such as financial trading systems, industrial control networks, and edge computing nodes.

[0054] Comprehensive dynamic code protection: Through dynamic code isolation and permission control systems, this method solves the security blind spots of existing technologies when processing WASM modules and dynamically loaded code, realizes comprehensive and real-time verification of dynamic code, and fills an important gap in the security protection of digital infrastructure.

[0055] Static-dynamic collaborative verification: This method cleverly combines static code analysis with dynamic runtime verification, avoiding the high false positive rate of pure static analysis while overcoming the high overhead of pure dynamic monitoring, achieving more comprehensive and efficient security protection.

[0056] Adaptive security protection: Through an adaptive security and performance balancing algorithm, this method can dynamically adjust the verification strategy based on the security sensitivity, execution frequency, and system threat level of the code block, while maintaining high-intensity security protection while minimizing the impact on system performance, achieving an optimal balance between security and performance.

[0057] Broad Applicability: This approach is specifically optimized for computing environments (such as WASM modules, edge computing, and IoT gateways), providing specialized security solutions for these areas and addressing the shortcomings of traditional defense methods in these scenarios. Practice has demonstrated that this approach can seamlessly adapt to digital infrastructures of varying scales and types, from single edge devices to complex distributed systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 is an overall flow chart of an embodiment of the present invention;

[0059] Figure 2 This is a flow chart of the sub-steps of step 1 "implementing code segment control flow verification" of the present invention;

[0060] Figure 3 This is a flow chart of the sub-steps of step 2 of the present invention, "implementing a dual-layer control flow protection system";

[0061] Figure 4 This is a flow chart of the sub-steps of step 3 "Applying hardware accelerated verification and performance optimization" of the present invention;

[0062] Figure 5 This is a flow chart of the sub-steps of step 4 of the present invention, "implementing dynamic code isolation and permission control system";

[0063] Figure 6 This is a flow chart of the sub-steps of step 5 "achieving adaptive security and performance balance" of the present invention. DETAILED DESCRIPTION

[0064] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed solely to enable those skilled in the art to better understand and implement the subject matter described herein, and that the functions and arrangements of the elements discussed may be varied without departing from the scope of this specification. Various examples may omit, substitute, or add various processes or components as needed. In addition, features described with respect to some examples may also be combined in other examples.

[0065] like Figures 1-6 As shown, a method for real-time threat monitoring and defense of digital infrastructure includes the following steps:

[0066] Step 1: Implement code segmentation control flow verification: This step uses the segmentation control flow verification algorithm to classify WASM (WebAssembly) modules and dynamically loaded code, generating differentiated protection strategies and control flow verification models.

[0067] In one embodiment of the present invention, the following steps are specifically included:

[0068] Step 1.1, segment the code based on execution characteristics:

[0069] Divide code modules into three categories:

[0070] Static segment: a code segment that does not change after loading, suitable for comprehensive control flow protection;

[0071] Performance-critical sections: Code sections that are executed frequently and affect system performance, requiring a balance between security and performance.

[0072] Dynamically loaded segment: The code segment dynamically loaded at runtime needs to be verified for legitimacy in real time.

[0073] For each code segment, a formal description model is constructed to record its entry point, exit point and internal control flow transfer characteristics.

[0074] Step 1.2, generate the static segment control flow graph and legal path set:

[0075] For static code segments, we use formal language to accurately specify them, analyze their control flow structure, and output a static control flow graph (CFG), which is defined as follows:

[0076] ;

[0077] in, represents a basic block set, represents the set of control flow edges, and represent the entry and exit nodes respectively, Represents a static control flow graph.

[0078] Based on CFG, define the set of legal control transfer paths :

[0079] ;

[0080] in It represents a valid path from the program entry point to the exit point. A valid path is an execution sequence that complies with the program control flow semantics.

[0081] Step 1.3: Analyze function call signatures and build a verification model: Analyze all function definitions and call points in the code and extract function signature information, including parameter types, return value types, and calling conventions.

[0082] Build a function call signature verification model:

[0083] ;

[0084] in Represents a function pointer, pointing to a function that can be called indirectly, Represents a function signature, including a list of parameter types and a return value type. Indicates that it is a function signature verification set;

[0085] This model is used to verify the legitimacy of indirect function calls and ensure that the signature of the target function is consistent with the expected signature of the call site.

[0086] Step 1.4, generate differentiated protection strategies: Generate differentiated protection strategies for different code segments based on the code segment type and security importance:

[0087] Static section: applies full control flow verification to verify all control flow transfer instructions;

[0088] Performance-critical sections: Apply selective control flow verification to verify only critical control flow transfer instructions;

[0089] Dynamically loaded segment: Apply real-time verification, perform integrity checks at load time, and apply dynamic verification at runtime.

[0090] Output protection policy set , including the protection level, verification frequency, and verification method for each code segment.

[0091] Step 2: Implement a two-layer control flow protection system: This step combines shadow stack technology with a runtime verification system to create a two-layer control flow protection system to ensure the security of function calls and returns.

[0092] In one embodiment of the present invention, the following steps are specifically included:

[0093] Step 2.1, build the shadow stack system:

[0094] At the WASM interpreter or JIT compilation level, an independent shadow stack system is implemented to store function return address information:

[0095] ;

[0096] in, Indicates the return address, each calling context Contains call site information, signature of the called function, and encrypted checksum. Represents the shadow stack system, which is used to store and manage the return information of function calls.

[0097] Shadow stack operations include:

[0098] When the function is called: the return address and context Push onto the shadow stack;

[0099] When the function returns: pop the return address from the shadow stack and compare it with the actual return address.

[0100] Step 2.2, implement runtime verification logic:

[0101] Implement runtime verification logic for all control flow transfer instructions:

[0102] For direct control flow transfer (such as direct function call, fixed jump):

[0103] ;

[0104] in Indicates the target address of control flow transfer, Represents the set of legal target addresses determined by static analysis, represents a direct control flow transfer verification function, Indicates that it belongs to the relational operator;

[0105] For indirect control flow transfer (such as function pointer call, indirect jump): ;

[0106] in, is the set of legal target addresses, Is the function type corresponding to the address, is the function type expected by the call site, represents the verification function for indirect control flow transfer, Indicates the target address of an indirect jump, Represents the logical AND operator, indicating that both conditions must be met;

[0107] Step 2.3, function return address verification:

[0108] Before the function return instruction is executed, the return address is verified:

[0109] ;

[0110] in, is the return address on the current stack, is the expected return address stored in the shadow stack, Indicates the return address verification function, Indicates a comparison operation where the addresses are exactly equal;

[0111] Trigger security exception handling when verification fails.

[0112] Step 2.4, build an exception handling and recovery system: Build an exception handling system that, when a control flow violation is detected, records the violation type, location, and related context information.

[0113] Based on the configured policy, execute the corresponding security response, including terminating execution, returning an error code, or redirecting to a security processing routine;

[0114] For recoverable violations, build state rollback and execution path correction systems.

[0115] Output security exception handling rule set , define the corresponding processing strategies for different violation types.

[0116] Step 3: Apply hardware-accelerated verification and performance optimization: This step leverages modern processor hardware security features and parallel verification technology to perform hardware acceleration and performance optimization on control flow protection.

[0117] In one embodiment of the present invention, the following steps are specifically included:

[0118] Step 3.1, Apply Processor Hardware Security Features: Identify and apply the platform's available hardware security features and build a hardware-assisted verification system:

[0119] For Intel processors: Use Intel Processor Trace (PT) technology to collect control flow execution traces and output compressed execution path information;

[0120] For ARM processors: Use Core Sight debugging and tracing technology to obtain the branch instruction flow during program execution;

[0121] For platforms that support hardware memory protection: Configure a memory protection unit (MPU) or memory management unit (MMU) to implement hard isolation between code and data areas.

[0122] Step 3.2, build a pre-calculated hash verification model: To improve verification efficiency, implement a pre-calculated hash verification model:

[0123] The set of legal control flow paths obtained by static analysis , calculate the hash value of each path:

[0124] ;

[0125] in, Represents a path hash function that maps the execution path to a fixed-length hash value. Represents a complete control flow execution path, Indicates a hash calculation function, such as SHA-256, Indicates that hash calculations are performed on all legal paths;

[0126] Store all legal path hashes in a quick lookup structure:

[0127] ;

[0128] in Represents the set of hash values ​​of all legal paths for fast verification;

[0129] Collect execution path information at runtime and calculate the current path hash value , the verification formula is:

[0130] ;

[0131] in Represents the hash value of the current execution path, represents the hash verification function;

[0132] This verification method based on hash value comparison reduces the time complexity of path verification from Reduce to .

[0133] The specific implementation of the pre-computed hash verification model uses an incremental hash calculation method. Whenever a control flow transfer occurs, the current path hash value is updated using the following formula:

[0134] ;

[0135] in, is the target address of the control flow transfer, and Represents bit left shift and bit right shift operations respectively, Represents the exclusive OR operation;

[0136] This incremental hashing method avoids the overhead of storing the complete execution path and significantly reduces memory usage.

[0137] In financial trading systems, this model is applied to the critical transaction processing paths of high-frequency trading engines. With tens of thousands of trade requests processed per second, traditional verification methods incur significant latency. The precomputed hash verification model preloads hash values ​​for commonly used transaction processing flows into the processor's L1 cache, achieving sub-microsecond verification speeds. This ensures the real-time performance of the trading system while effectively preventing control flow hijacking attacks targeting the trading engine.

[0138] Step 3.3: Implement a parallel verification execution architecture: Build a parallel verification execution architecture to reduce the impact of verification on the main application performance:

[0139] The main thread executes the application code and records the control flow events into the shared memory buffer;

[0140] The verification thread runs in parallel, reading control flow events from the buffer for verification;

[0141] For multi-core processors, the verification threads are assigned to independent processor cores for execution;

[0142] Implement a lightweight synchronization mechanism between the main verification thread and the application thread to ensure that verification does not block the main program execution.

[0143] Step 3.4, optimize verification instruction scheduling: analyze application hotspot paths and optimize verification instruction scheduling strategies:

[0144] For code paths with high execution frequency, predictive verification is used to preload verification data before branch instructions are executed;

[0145] Interleave verification instructions with application instructions to exploit the processor's instruction-level parallelism.

[0146] Use SIMD instructions to accelerate key verification operations and implement batch verification;

[0147] Implement instruction-level pipelining of verification operations to reduce blocking delays of verification instructions.

[0148] Output hardware acceleration verification configuration and optimization strategy sets , significantly reducing verification overhead.

[0149] Step 4: Implement dynamic code isolation and permission control system: This step builds a dynamic code isolation system and a fine-grained permission control system to prevent dynamically loaded code from performing out-of-bounds operations and unauthorized access;

[0150] In one embodiment of the present invention, the following steps are specifically included:

[0151] Step 4.1, establish a dynamic code isolation area: create an isolated execution environment for dynamically loaded code modules:

[0152] Build a memory sandbox to limit the memory range accessible to dynamic code:

[0153] Allocate a separate memory segment for each dynamic module;

[0154] Implement memory boundary checking to prevent cross-segment access;

[0155] Implement validation checks at inter-module communication points.

[0156] Implement code segment permission control system and define memory protection strategy:

[0157] ;

[0158] in, Indicates the memory area, Indicates the corresponding access rights (read / write / execute), Represents a set of memory protection policies, defining access control rules for all memory areas.

[0159] Step 4.2: Build a dynamic code loading verification system: When the system dynamically loads code modules, implement multi-level verification:

[0160] Verify before loading:

[0161] Check module signature and integrity;

[0162] Analyze module import / export tables to ensure compliance with expected interfaces.

[0163] Transformation on load:

[0164] Perform on-the-fly conversion of dynamic module code and insert control flow verification instructions;

[0165] Rewrite memory access instructions and add bounds checking logic;

[0166] Implement separation of code segment and data segment.

[0167] Defining dynamic module validation rulesets , specifies the verification requirements for different types of dynamic modules.

[0168] Step 4.3, implement fine-grained resource access control: Implement fine-grained resource access control for dynamically loaded code modules:

[0169] Build a resource access policy model:

[0170] ;

[0171] in, A unique identifier representing a dynamically loaded module. Indicates the set of resources that the module is allowed to access, including system APIs, file systems, network interfaces, etc. Represents a collection of access control policies that define resource access permissions for all modules.

[0172] Implement permission checks at key resource access points:

[0173] ;

[0174] in, is the currently executing module, is the resource being requested, It is a module The set of resources that are authorized to be accessed, Represents a resource access verification function.

[0175] Step 4.4, build a real-time behavior monitoring system: implement a real-time monitoring system for dynamic code behavior:

[0176] Defining a behavioral pattern library , describes the normal execution mode;

[0177] Collect module behavior characteristics in real time, including: system call frequency and sequence; memory access pattern; control flow transfer characteristics.

[0178] Apply anomaly detection algorithms to identify deviations from normal behavior patterns:

[0179] ;

[0180] in, is the currently observed behavior, The degree to which the function's computational behavior deviates from normal patterns, represents anomaly detection function, Represents a library of normal behavior patterns, Indicates the abnormality judgment threshold.

[0181] Output dynamic code isolation configuration and permission control strategies , effectively preventing attacks from malicious dynamic code.

[0182] Step 5: Achieve adaptive security and performance balance: This step builds an adaptive security control system to achieve fine-grained security-performance balance adjustment based on the security sensitivity and execution frequency of code blocks;

[0183] In one embodiment of the present invention, the following steps are specifically included:

[0184] Step 5.1, build a code block risk assessment model: perform security risk assessment on the code blocks in the system and establish a risk scoring model:

[0185] Define the code block risk scoring function:

[0186] ;

[0187] in: Represents a code block The criticality of the Represents a code block its vulnerability, related to its complexity and potential vulnerabilities; Represents a code block accessibility, which is related to its external exposure; 、 、 are the weight coefficients of criticality, vulnerability and accessibility, Indicates the comprehensive risk score of a code block.

[0188] Calculate risk scores for all code blocks and generate risk distribution maps .

[0189] The specific implementation of the risk assessment model uses the analytic hierarchy process (AHP) to determine the weight coefficient, and the weight of each factor is determined by constructing a judgment matrix: ;

[0190] At the same time, the calculation of each indicator adopts the following method:

[0191] ;

[0192] in For code blocks The collection of resources accessed, Represents a resource The importance of Indicates the weight corresponding to the access type (read / write / execute);

[0193]

[0194] in represents the code complexity index, Represents historical vulnerability indicators, Represents code quality indicators;

[0195] Comprehensively consider code complexity, historical vulnerabilities, and code quality;

[0196] ;

[0197] in Indicates the code exposure level, Indicates the authentication strength coefficient;

[0198] Combine code exposure level and authentication strength.

[0199] In industrial control system scenarios, this model is used to assess the risks of different functional modules in SCADA systems. For example, critical control modules that directly control physical devices are assigned the highest risk scores, while auxiliary functional modules such as logging are assigned lower risk scores. This differentiated risk assessment allows the system to focus limited security resources on protecting the most critical components, such as allocating 90% of verification resources to protect the 20% of high-risk code blocks that make up the total code volume, thereby improving overall security protection efficiency.

[0200] Step 5.2: Implement execution statistics and hotspot analysis: Monitor system runtime behavior and implement execution statistics and hotspot analysis:

[0201] Record the execution frequency of code blocks and build an execution heat map:

[0202] ;

[0203] in, Is a code block The number of executions, is the total number of instructions executed by the system, Indicates how often a code block is executed.

[0204] Analyze execution path characteristics and identify performance critical paths.

[0205] Build a performance-security relationship model to evaluate the impact of verification operations on performance.

[0206] Step 5.3, build an adaptive verification frequency control system: Based on risk score and execution frequency, implement adaptive verification frequency control:

[0207] Define the verification frequency function:

[0208] ;

[0209] in, is the basic verification rate, is the code block risk score, is the execution frequency of the code block, Indicates the validation frequency of a code block.

[0210] Increase the verification density for high-risk, low-frequency code blocks, and reduce the verification density for low-risk, high-frequency code blocks. Optimize the formula:

[0211] ;

[0212] in, and are the minimum and maximum verification rates, Represents a code block The final optimized verification frequency.

[0213] Step 5.4: Implement dynamic security policy adjustment: Dynamically adjust security policy based on system operation status and threat level:

[0214] Define the system threat level assessment function:

[0215] ;

[0216] in, is the number of abnormal events, is an attack characteristic indicator, is the resource utilization rate, Indicates the system threat level.

[0217] Dynamically adjust verification policies based on threat levels:

[0218] Low threat state: reduce verification intensity and optimize performance;

[0219] Medium threat status: balance security and performance;

[0220] High threat status: Increase verification strength and prioritize security.

[0221] Build an automatic security policy switching system to smoothly transition between different threat levels.

[0222] Output adaptive safety control configuration , achieving a dynamic balance between system security and performance.

[0223] Based on the above monitoring and defense method and system, the following is a real application example of this embodiment;

[0224] Application scenarios;

[0225] This implementation has been verified in the following three typical scenarios:

[0226] Financial trading system: A high-frequency trading platform deployed at a stock exchange uses WASM module technology to implement a cross-platform trading algorithm execution environment, processing over 100 million trading requests daily. The system requires millisecond-level response times and protection against control flow hijacking attacks targeting the trading engine.

[0227] Industrial control network: An edge computing gateway used in a power dispatching system processes real-time data from thousands of sensors and runs dynamically loaded analysis modules. The system must ensure the security of control instructions to prevent malicious modules from interfering with industrial production processes.

[0228] IoT Device Management Platform: Deployed within the Smart City IoT Management Platform, this platform uses dynamic code loading technology for device adaptation and protocol conversion, and must simultaneously manage tens of thousands of heterogeneous IoT devices. The system faces complex security threats at the device access layer, requiring real-time verification of the behavior of dynamically loaded modules.

[0229] Implement process instances;

[0230] The following uses a financial transaction system as an example to describe the specific implementation process of this embodiment in detail:

[0231] Code segmentation and risk assessment;

[0232] The WASM modules in the trading system were segmented and risk assessed. The results are shown in Table 1:

[0233] Table 1, Financial transaction system code module segmentation and risk score;

[0234]

[0235] Realize double-layer control flow protection;

[0236] A shadow stack system was built for the order processing core and trading algorithm engine modules. Verification results show that it effectively prevents return-oriented programming (ROP) attacks. A typical protection example is shown in Table 2:

[0237] Table 2. Shadow stack verification record of the order processing core module (partial)

[0238]

[0239] Hardware accelerated verification implementation;

[0240] The trading system uses Intel Xeon processors and utilizes Intel PT technology to implement control flow verification. Table 3 shows a comparison of verification performance:

[0241] Table 3, Performance comparison of different verification methods;

[0242]

[0243] Dynamic code isolation implementation;

[0244] Dynamic code isolation is implemented for the trading algorithm engine. Table 4 shows the resource access strategy:

[0245] Table 4, Resource access control policy of the trading algorithm engine;

[0246]

[0247] Adaptive safety control effect;

[0248] After the system ran for a week, the adaptive security control automatically adjusted the verification strategy based on the execution statistics. Table 5 shows the comparison before and after the adjustment:

[0249] Table 5, Performance comparison before and after adaptive safety control adjustment;

[0250]

[0251] Technical effect verification;

[0252] The deployment of this implementation in the above application scenarios has verified two key technical effects: security assurance and extremely low performance overhead.

[0253] Security verification;

[0254] To verify the security protection effect of this method, we conducted a security penetration test on the deployment system, simulating different types of control flow hijacking attacks. The test results are shown in Table 6:

[0255] Table 6, defense effect test of different attack types;

[0256]

[0257] Comparison of performance overhead and defense effectiveness;

[0258] The performance of this method in different application scenarios and its comparison with traditional methods are shown in Table 7:

[0259] Table 7, a comprehensive comparison of the performance overhead and defense effect of different defense methods;

[0260]

[0261] The above test results verify that this method can provide comprehensive security protection with extremely low performance overhead (average 3.8%) while maintaining the system's real-time responsiveness. It is particularly suitable for critical digital infrastructure with strict requirements on both performance and security.

[0262] The above describes the embodiments of the present invention, but the present invention is not limited to the above specific implementation methods. The above specific implementation methods are merely illustrative and not restrictive. Ordinary technicians in this field can also make many forms under the guidance of the present invention, all of which are protected by the present invention.

Claims

1. A method for real-time threat monitoring and defense of digital infrastructure, characterized in that: The following steps are involved: Segment the WASM module and dynamic code module, dividing the code into static segments, performance-critical segments, and dynamically loaded segments, and generate differentiated protection strategies; Segmenting the code involves: Divide the code module into static segments, performance-critical segments, and dynamically loaded segments; Generate a control flow graph for the static segment and define the set of legal control transfer paths; Analyze function call signatures and build a function call signature verification model; Generate differentiated protection strategies for different code segments based on their type and security importance; Static section: applies full control flow verification to verify all control flow transfer instructions; Performance-critical sections: Apply selective control flow verification to verify only critical control flow transfer instructions; Dynamic loading segment: Apply real-time verification, perform integrity checks at load time, and apply dynamic verification at runtime; Build a two-layer control flow protection system that combines shadow stack technology with runtime verification to ensure the security of function calls and returns; Leverage hardware-accelerated verification technology to reduce verification overhead by executing verification in parallel with the main application through a dedicated core; Utilizing hardware-accelerated verification techniques includes: Identify and apply the hardware security features available on the platform and build a hardware-assisted verification system; Implement a pre-calculated hash verification model to calculate hash values ​​for legal control flow paths, and only compare hash values ​​to verify the legitimacy of control flow at runtime; Build a parallel verification execution architecture to execute verification through independent processor cores, reducing the impact on the main application performance; Optimize verification instruction scheduling and use processor instruction-level parallelism and predictive verification to reduce overhead; Implement dynamic code isolation and permission control to prevent dynamically loaded code from performing out-of-bounds operations and unauthorized access; Build an adaptive security control system to dynamically adjust the verification strategy based on the security sensitivity and execution frequency of the code block.

2. A method for real-time threat monitoring and defense of digital infrastructure according to claim 1, characterized in that: Building a two-layer control flow protection system includes: Maintain an independent shadow stack system at the interpreter level to store function return address information; Implement runtime verification logic for direct and indirect control flow transfers; Perform function return address verification and compare the return address on the current stack with the expected return address stored in the shadow stack; Build exception handling and recovery systems to handle control flow violations.

3. A digital infrastructure real-time threat monitoring and defense method according to claim 2, characterized in that: Implementing dynamic code isolation and permission control includes: Create an isolated execution environment for dynamically loaded code modules and limit the memory range they can access; Build a dynamic code loading verification system to verify modules before loading and convert them during loading; Implement fine-grained resource access control, build a resource access policy model, and limit the resource access rights of modules; Build a real-time behavior monitoring system, define a behavior pattern library, and identify operations that deviate from normal behavior patterns.

4. A digital infrastructure real-time threat monitoring and defense method according to claim 3, characterized in that: Building an adaptive safety control system includes: Build a code block risk assessment model to calculate the criticality, vulnerability, and accessibility indicators of code blocks; Implement execution statistics and hotspot analysis, record code block execution frequency, and identify performance critical paths; Build an adaptive verification frequency control system to dynamically adjust verification density based on risk score and execution frequency; Implement dynamic security policy adjustment and automatically switch different security policies according to the system threat level.

5. A method for real-time threat monitoring and defense of digital infrastructure according to claim 4, characterized in that: The pre-computed hash verification model adopts an incremental hash calculation method to update the path hash value in real time when the control flow transfer occurs, avoiding the overhead of storing the complete execution path.

6. A digital infrastructure real-time threat monitoring and defense method according to claim 5, characterized in that: The code block risk scoring function uses the hierarchical analysis method to determine the weight coefficient, and evaluates the criticality, vulnerability and accessibility indicators of the code block from multiple dimensions of resource access, code quality and exposure level.

7. A method for real-time threat monitoring and defense of digital infrastructure according to claim 6, characterized in that: The method is applicable to the computing environments of WASM modules, edge computing, and IoT gateways. It ensures security while controlling performance overhead through differentiated protection strategies and adaptive security control.

8. A digital infrastructure real-time threat monitoring and defense system, characterized by: The method for executing the steps of a method for real-time threat monitoring and defense of digital infrastructure as claimed in any one of claims 1 to 7 comprises: Code segmentation module: used to divide the code into static segments, performance-critical segments, and dynamically loaded segments, and generate differentiated protection strategies; Control flow protection module: used to combine shadow stack technology with runtime verification to ensure the security of function calls and returns; Hardware-accelerated verification module: used to perform verification in parallel with the main application through a dedicated core, reducing verification overhead; Dynamic code isolation module: used to prevent dynamically loaded code from performing out-of-bounds operations and unauthorized access; Adaptive security control module: used to dynamically adjust the verification strategy based on the security sensitivity and execution frequency of the code block.

Images