A teensy virus identification and protection method for a mobile hard disk

Abstract

The application discloses a Teensy virus identification and protection method of a mobile hard disk, relates to the technical field of virus identification and protection, and breaks through the limitation of traditional single feature detection by combining hardware ripple characteristics with dynamic protocol response to effectively identify high-simulation attack equipment through composite equipment fingerprint construction. Meanwhile, a hidden Markov chain is used for real-time analysis of a protocol state transition probability model to accurately capture microsecond-level protocol switching abnormalities and solve the problem of missed detection caused by coarse time granularity of an existing scheme. In addition, a window context instruction association mechanism binds a system focus state to HID operation to block a hidden attack chain formed by a combination of legal instructions. A hierarchical fuse strategy integrates protocol endpoint control and physical layer isolation to realize attack blocking while ensuring the availability of storage functions, thereby avoiding the influence of normal use caused by full-port disabling in traditional schemes.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of virus identification and protection, and particularly relates to a Teensy virus identification and protection method for a mobile hard disk. BACKGROUND

[0002] With the increasing popularity of USB interface protocols, mobile hard disks gradually integrate composite functions such as keyboard and mouse simulation and network adapters. This multi-protocol support feature creates a new attack surface for Teensy viruses. Current mainstream protection schemes are mainly based on three types of technologies, including firmware digital signature verification, HID instruction blacklist filtering, and device behavior baseline modeling. Among them, the firmware online verification mechanism based on the TLS1.3 protocol can effectively intercept illegal firmware injection, the dynamic behavior analysis engine can learn the normal operation timing pattern through the LSTM model, and the real-time HID protocol filter can block known malicious keyboard instructions. These technologies form the basic framework of modern mobile hard disk security protection.

[0003] However, when facing cross-protocol timing confusion attacks, the existing firmware verification mechanism relies on static verification during device initialization and cannot perceive the instantaneous switching of runtime protocol types. At the same time, the time detection granularity of the behavior analysis model is usually at the 100ms level, making it difficult to capture rapid protocol jumps within 3-5ms. In addition, the HID filtering module uses a protocol type mutual exclusion design. When an attacker uses the protocol multiplexing feature of the USB interface (such as suddenly inserting an HID instruction frame during data transmission), the defense system will produce protocol state logic conflicts. More seriously, new attack tools can simulate the power characteristics and firmware fingerprints of legitimate devices, making traditional hardware feature recognition methods useless. Therefore, there is an urgent need for a Teensy virus identification and protection scheme for a mobile hard disk to solve such problems. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] The present application provides a Teensy virus identification and protection method for a mobile hard disk, which solves the problem that existing schemes rely on static verification and coarse-grained behavior analysis, making it difficult to deal with cross-protocol timing confusion attacks and lacking hardware-level blocking means, resulting in ineffective protection in high-risk scenarios.

[0006] To solve the above technical problems, the present application provides the following technical solutions:

[0007] The present application provides a Teensy virus identification and protection method for a mobile hard disk, which includes,

[0008] Step S1: When the device is connected, real-time collection of the composite device fingerprint of the mobile hard disk is performed, and the composite device fingerprint includes a hardware characteristic parameter set and a dynamic protocol characteristic parameter set.

[0009] Step S2, based on the bottom layer data stream of the USB protocol stack, a protocol state transition probability matrix is constructed, and the state transition sequence of the device between the storage protocol and the human-computer interface device protocol is tracked in real time;

[0010] Step S3, multi-granularity semantic analysis is performed on the HID instruction stream, and a window context related instruction combination mode is extracted;

[0011] Step S4, according to the state transition abnormality score of step S2 and the instruction mode risk score of step S3, the execution level of the protection strategy is dynamically adjusted;

[0012] Step S5, when the comprehensive risk value exceeds the preset threshold, a hierarchical fuse mechanism is triggered, including at least one of protocol endpoint disabling and physical connection isolation.

[0013] As a preferred scheme of the mobile hard disk virus recognition and protection method, in step S1, the dynamic acquisition of the hardware feature parameter set comprises:

[0014] In the device enumeration stage, the current fluctuation characteristics during device initialization are captured at a sampling rate of not less than 1MHz;

[0015] In the data transmission stage, an encrypted challenge instruction set is periodically sent, and a firmware check code response sequence returned by the device is collected;

[0016] The encrypted challenge instruction set includes time-interleaved 0xA5 and 0x5A verification code request instructions, wherein the odd sequence position instruction is additionally provided with a dynamic salt value salt, and the salt value is generated from the current ripple characteristic hash value in the device enumeration stage;

[0017] The collected current fluctuation signal is wavelet packet decomposed, and the energy proportion of the 3rd layer detail coefficient is extracted as a characteristic value.

[0018] As a preferred scheme of the mobile hard disk virus recognition and protection method, in step S1, the step of extracting the energy proportion characteristic of the 3rd layer detail coefficient from the collected discrete current fluctuation signal comprises:

[0019] The discrete current signal a[n] is three-layer wavelet packet decomposed to obtain the 3rd layer sub-band coefficient:

[0020]

[0021] Wherein, a[n] represents the discrete current fluctuation signal value of the sampling sequence number n, n is the sampling sequence number, M is the length of each sub-band coefficient sequence, represents the jth layer kth wavelet packet decomposition operator of the signal, b3,k [n] represents the coefficient sequence of the third layer kth sub-band after decomposition;

[0022] The third layer kth sub-band coefficient energy is calculated:

[0023]

[0024] Wherein, c 3,k The total energy of the third layer kth sub-band is represented;

[0025] The total energy of all sub-bands of the third layer is calculated:

[0026]

[0027] Wherein, d3 represents the sum of the energy of all sub-bands of the third layer;

[0028] The third layer high frequency detail sub-band energy proportion feature is extracted, and the sub-band number is 4 to 7:

[0029]

[0030] Wherein, e3 represents the third layer high frequency detail energy proportion feature value, The third layer high frequency detail sub-band energy sum, and the denominator d3 is the total energy of the third layer.

[0031] As a preferred scheme of the Teensy virus identification and protection method of the mobile hard disk, the encryption challenge instruction set comprises:

[0032] The preset 16-bit random number seed is used to generate dynamic check code request instructions; the random number seed is updated once every 24 hours according to the random source published by NIST;

[0033] The feature trigger instruction related to the device master chip model is dynamically generated according to the vendor protocol specification disclosed by USB-IF.

[0034] As a preferred scheme of the Teensy virus identification and protection method of the mobile hard disk, the specific implementation mode of the protocol state tracking in step S2 is:

[0035] Record the change timestamp of the device descriptor field in each USB microframe to form a protocol switching time sequence;

[0036] Based on the hidden Markov model, a normal device protocol state transition baseline is established, and the likelihood probability of the real-time state migration path is calculated;

[0037] The likelihood probability calculation adopts the forward algorithm, and the state transition rationality is evaluated through the observation sequence in the sliding window.

[0038] As a preferred embodiment of the Teensy virus identification and protection method for portable hard drives described in this invention, the state transition baseline construction of the hidden Markov model includes: collecting protocol switching time series of 1000+ normal devices, statistically analyzing the migration frequency between each protocol state, and marking migration paths with an occurrence probability of less than 0.01% as abnormal paths.

[0039] As a preferred embodiment of the Teensy virus identification and protection method for portable hard drives described in this invention, step S2, which evaluates the rationality of state transitions through the observation sequence within the sliding window, is as follows:

[0040] Define the hidden Markov model λ = (A, B, π) as follows:

[0041] The set of hidden states is {s1, s2, ..., s} N}, where N is the total number of states, and the protocol switching events recorded in the observation sequence at the USB microframe level are denoted as {O t O t+1 ,…,O t+L-1}, where L is the sliding window length, t is the starting microframe index of the current window, and A = [a ij ] represents the state transition probability matrix, a ij =P(s) j |s i ), B = [b j [O] represents the observation probability matrix, b j (O k )=P(O k |s j ), π = [π i ] represents the initial state distribution, π i =P(s) i At time t);

[0042] The forward probability is calculated recursively within this window using a forward algorithm:

[0043] α1(i)=π i b i (O t ),

[0044] Where α1(i) represents the first step of the sliding window, when u=1 the window is in the hidden state s. i Forward probability, π i This indicates that the state is s at the initial time u = 1. i The probability, b i (·) represents state s i The observation probability function under O t This represents the observation value at the beginning of the window's microframe t, where i is the index of the hidden state.

[0045]

[0046] where, α u (j) represents the forward probability of the u-th step in the sliding window being in hidden state s j , u is the step index in the window, j is the hidden state index, α u-1 (i) represents the forward probability of the u-1-th step being in s i , a ij represents the state transition probability from s i to s j , b j (·) represents the observation probability function in state s j , O t+u-1 represents the observation value of the u-th step, t represents the starting frame index of the sliding window, i is the hidden state index, and N is the total number of hidden states.

[0047]

[0048] where, P(O t:t+L-1 |λ) represents the joint likelihood probability of the observation sequence from O t to O t+L-1 under the model λ, α L (i) represents the forward probability of being in state s i when reaching the last step u=L of the window, L represents the length of the sliding window, i is the hidden state index, and λ represents the parameter set of the hidden Markov model.

[0049] As a preferred scheme of the mobile hard disk Teensy virus identification and protection method, the multi-granularity semantic analysis in step S3 comprises:

[0050] The process identifier of the current focus window is obtained in real time through a system API;

[0051] A matching degree evaluation model of instruction operation and window context is established, and when a dangerous instruction in a window inactive state is detected, the risk score level is improved;

[0052] The matching degree evaluation model executes the following logic:

[0053] When it is detected that the HID instruction contains a system key operation character, it is verified whether the process signature of the current focus window belongs to a trusted white list, and the window activation duration exceeds 200 ms.

[0054] As a preferred scheme of the mobile hard disk Teensy virus identification and protection method, the dynamic adjustment of the protection strategy in step S4 comprises:

[0055] When the protocol state migration anomaly degree exceeds the first threshold value, an instruction level virtual sandbox execution environment is enabled;

[0056] When the instruction mode risk score exceeds the second threshold value, a physical layer power supply ripple feature review mechanism is activated;

[0057] The anomaly degree calculation method is that the likelihood probability of the current protocol migration path and the KL divergence value of the baseline are superimposed with the weighted sum of the abnormal path occurrence frequency in the time window;

[0058] The KL divergence value calculation adopts a relative entropy formula, and the time window length is dynamically adjusted according to the device type, and the adjustment strategy is an exponential decay function.

[0059] As a preferred scheme of the Teensy virus identification and protection method of the mobile hard disk, in step S4, the KL divergence value is calculated by using a relative entropy formula, and the process of dynamically adjusting the time window length according to the device type includes:

[0060] The KL divergence is calculated, and

[0061]

[0062] Wherein, P ij represents the observation transition probability from the hidden state s i to s j in the current sliding window, Q ij represents the transition probability from the state s i to s j in the baseline hidden Markov model, i and j are hidden state indexes, the total number is N, and ln(·) is a natural logarithm operation;

[0063] For different device types d, the initial window length L0, the minimum window length L min and the decay coefficient γ d are given, and the window length decreases in an exponential form with the monitoring process:

[0064] L(t) = L min +(L0-L min )exp(-γdt),

[0065] Wherein, L(t) represents the window length at time scale t, L0 represents the initial window length of the device type d, L min represents the minimum window length allowed after long-term monitoring, γ d represents the decay coefficient corresponding to the device type d, and t represents the monitoring step number since enumeration or last reset;

[0066] In order to facilitate configuration, the decay coefficient γ dHalf-life parameter tau according to device characteristics d is expressed as:

[0067]

[0068] wherein tau d is the window length half-life of a type d device in time scale, i.e. the time scale required for the window length to drop to half of the initial value.

[0069] The present application has the beneficial effects that: the present application constructs a composite device fingerprint, combines hardware ripple characteristics and dynamic protocol response, effectively identifies high simulation attack devices, and breaks through the limitations of traditional single feature detection; at the same time, the protocol state transition probability model adopts hidden Markov chain real-time analysis, accurately captures microsecond protocol switching abnormalities, and solves the missed detection problem caused by the coarse time granularity of the existing scheme; in addition, the window context instruction association mechanism binds the system focus state and HID operation, blocks the hidden attack chain formed by the combination of legal instructions; the hierarchical fuse strategy integrates protocol endpoint control and physical layer isolation, ensures the availability of storage function while realizing attack blocking, and avoids the influence of normal use caused by full port disablement in traditional scheme; the introduced dynamic adjustment mechanism adaptively switches the detection intensity through risk scoring, and takes into account the low power consumption demand and high-risk scene protection. BRIEF DESCRIPTION OF DRAWINGS

[0070] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0071] Figure 1 The flowchart of the Teensy virus identification and protection method for the mobile hard disk in embodiment 1. DETAILED DESCRIPTION

[0072] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings of the specification.

[0073] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein, and those skilled in the art can make similar generalizations without departing from the connotation of the present application, therefore the present application is not limited to the specific embodiments disclosed below.

[0074] Second, the "one embodiment" or "an embodiment" referred to herein means a specific feature, structure, characteristic, or combination of features and / or characteristics described herein that can be included in at least one implementation of the present application. The various appearances of "in one embodiment" or "an embodiment" in the specification are not necessarily all referring to the same embodiment.

[0075] Embodiment 1, Reference Figure 1 The embodiment provides a Teensy virus identification and protection method of a mobile hard disk, and comprises the following steps:

[0076] Step S1, when the device is accessed, a composite device fingerprint of the mobile hard disk is collected in real time, and the composite device fingerprint comprises a hardware feature parameter set and a dynamic protocol feature parameter set;

[0077] The dynamic collection of the hardware feature parameter set in step S1 comprises:

[0078] In the device enumeration stage, the current fluctuation characteristics at the initialization of the device are captured at a sampling rate of not less than 1 MHz;

[0079] In the data transmission stage, an encrypted challenge instruction set is periodically sent, and a firmware check code response sequence returned by the device is collected;

[0080] The encrypted challenge instruction set comprises time-interleaved 0xA5 and 0x5A verification code request instructions, wherein the odd sequence position instruction is additionally provided with a dynamic salt value salt, and the salt value is generated from the current ripple characteristic hash value in the device enumeration stage;

[0081] The collected current fluctuation signal is subjected to wavelet packet decomposition, and the energy proportion of the third layer detail coefficient is extracted as a feature value;

[0082] In step S1, the step of extracting the energy proportion feature of the third layer detail coefficient from the collected discrete current fluctuation signal comprises:

[0083] The discrete current signal a[n] is subjected to three-layer wavelet packet decomposition, and the third layer sub-band coefficient is obtained:

[0084]

[0085] Wherein, a[n] represents the discrete current fluctuation signal value of the sampling serial number n, n is the sampling serial number, M is the length of each sub-band coefficient sequence, represents the jth layer kth wavelet packet decomposition operator of the signal, b 3,k [n] represents the coefficient sequence of the third layer kth sub-band after decomposition;

[0086] The energy of the third layer kth sub-band coefficient is calculated:

[0087]

[0088] Among them, c 3,k This represents the total energy of the k-th subband in the 3rd layer;

[0089] Find the total energy of all subbands in the 3rd layer:

[0090]

[0091] Where d3 represents the sum of the energies of all subbands in the 3rd layer;

[0092] Extract the energy proportion characteristics of the high-frequency detail subbands in the third layer, subband numbers 4 to 7:

[0093]

[0094] Where e3 represents the characteristic value of the energy proportion of high-frequency details in the third layer. d3 represents the total energy of the high-frequency detail subbands in the third layer, and d3 is the total energy of the third layer.

[0095] Specifically, through a three-layer wavelet packet decomposition process, the current fluctuation signal is subdivided into eight sub-bands in the frequency domain, achieving precise quantification of the energy distribution of each frequency band. The high-frequency detail sub-band of the third layer mainly reflects transient power consumption changes. This feature is highly sensitive to capturing tiny pulse interference caused by Teensy malicious firmware. Compared with the overall energy, the high-frequency proportion can filter the influence of low-frequency noise and improve anti-interference capability. The computational load of this feature is moderate and can be embedded in the real-time detection process, balancing timeliness and recognition effect. In practical applications, a suitable wavelet basis, such as Daubechies or Coiflet, can be selected according to the hardware sampling accuracy and signal bandwidth to further optimize the spectral resolution and feature discrimination. At the same time, it can be combined with other physical features for fusion decision-making to improve the overall protection performance.

[0096] The cryptographic challenge instruction set includes:

[0097] A preset 16-bit random number seed is used to generate dynamic checksum request commands; the random number seed is updated every 24 hours based on the random source published by NIST.

[0098] Feature triggering instructions related to the device's main control chip model are dynamically generated based on the manufacturer's protocol specifications published by USB-IF.

[0099] Step S2: Based on the underlying data stream of the USB protocol stack, construct a protocol state transition probability matrix to track the state transition sequence of the device between the storage protocol and the human-machine interface device protocol in real time.

[0100] The specific implementation method of protocol state tracking in step S2 is as follows:

[0101] Record the timestamp of the change in the device descriptor field in each USB microframe to form a protocol switching time sequence;

[0102] A normal device protocol state transition baseline is established based on a hidden Markov model, and the likelihood probability of the real-time state transition path is calculated.

[0103] Likelihood probability calculation uses a forward algorithm to evaluate the rationality of state transitions through the observation sequence within a sliding window;

[0104] The state transition baseline construction of the Hidden Markov Model includes: collecting protocol switching time series of 1000+ normal devices, statistically analyzing the transition frequency between each protocol state, and marking transition paths with an occurrence probability of less than 0.01% as abnormal paths;

[0105] In step S2, the step of evaluating the rationality of the state transition using the observation sequence within the sliding window is as follows:

[0106] Define the hidden Markov model λ = (A, B, π) as follows:

[0107] The set of hidden states is {s1, s2, ..., s} N}, where N is the total number of states, and the protocol switching events recorded in the observation sequence at the USB microframe level are denoted as {O t O t+1 ,…,O t+L-1}, where L is the sliding window length, t is the starting microframe index of the current window, and A = [a ij ] represents the state transition probability matrix, a ij =P(s) j |s i ), B = [b j [O] represents the observation probability matrix, b j (O k )=P(O k |s j ), π = [π i ] represents the initial state distribution, π i =P(s) i At time t);

[0108] The forward probability is calculated recursively within this window using a forward algorithm:

[0109] α1(i)=π i b i (O t ),

[0110] Where α1(i) represents the first step of the sliding window, when u=1 the window is in the hidden state s. i Forward probability, π i This indicates that the state is s at the initial time u = 1.i The probability, b i (·) represents state s i The observation probability function under O t This represents the observation value at the beginning of the window's microframe t, where i is the index of the hidden state.

[0111]

[0112] Where, α u (j) indicates that the sliding window is in a hidden state at step u. j The forward probability, u is the step index within the window, j is the hidden state index, α u-1 (i) indicates that the state at step u-1 is s i Forward probability, a ij Indicates from s i to s j State transition probability, b j (·) represents state s j The observation probability function under O t+u-1 Let represent the observation at step u, t represent the starting frame index of the sliding window, i represent the index of the hidden state, and N represent the total number of hidden states;

[0113]

[0114] Among them, P(O) t:t+L-1 |λ) represents the observation sequence from O under model λ. t To O t+L-1 The joint likelihood probability, α L (i) indicates that the state is s when the window reaches the last step u = L. i The forward probability, L represents the sliding window length, i is the hidden state index, and λ represents the set of parameters of the hidden Markov model;

[0115] Specifically, using the aforementioned forward algorithm, the overall likelihood of the observed sequence can be calculated in real time within each sliding window. If the protocol state transition sequence matches the normal baseline model, the obtained P(O) is... t:t+L-1 The value of |λ) will remain at a high level; otherwise, the likelihood will decrease significantly, thus indicating potential anomalies. Since the algorithm uses cumulative forward probability recursion, it can capture multi-step state dependencies and has the ability to distinguish between short-term abnormal switching and occasional noise. The sliding window mechanism not only ensures the continuity of detection, but also balances response delay and detection accuracy through an appropriate window length L.

[0116] Step S3: Perform multi-granular semantic parsing on the HID instruction stream to extract instruction combination patterns related to the window context;

[0117] Step S3, multi-granular semantic parsing, includes:

[0118] The process identifier of the currently focused window can be obtained in real time via the system API;

[0119] Establish a matching evaluation model between command operations and window context; when a dangerous command is detected that the window is not inactive, the risk score level is increased.

[0120] The matching evaluation model executes the following logic:

[0121] When the HID instruction is detected to contain critical system operation characters (such as 'regedit', 'powershell'), verify whether the process signature of the currently focused window belongs to the trusted whitelist and whether the window has been active for more than 200ms.

[0122] Step S4: Based on the state transition anomaly score in Step S2 and the instruction pattern risk score in Step S3, dynamically adjust the execution level of the protection strategy.

[0123] Step S4, dynamically adjusting the protection strategy, includes:

[0124] When the anomaly of protocol state transition exceeds the first threshold, the instruction-level virtual sandbox execution environment is activated.

[0125] When the instruction mode risk score exceeds the second threshold, the physical layer power supply ripple characteristic verification mechanism is activated.

[0126] The anomaly rate is calculated as follows: the likelihood probability of the current protocol migration path and the KL divergence value of the baseline are superimposed with the weighted sum of the frequency of anomaly paths occurring within the time window;

[0127] KL divergence value is calculated using the relative entropy formula, and the time window length is dynamically adjusted according to the equipment type. The adjustment strategy is an exponential decay function.

[0128] In step S4, the process of calculating the KL divergence value using the relative entropy formula and dynamically adjusting the time window length according to the equipment type includes:

[0129] Calculate the KL divergence, let

[0130]

[0131] Among them, P ij This indicates that within the current sliding window, the state s is transitioning from hidden to open. i to s j The observed transition probability, Q ij In the baseline Hidden Markov Model, from state s i to s j The transition probabilities, i,j are the hidden state indices, the total number is N, and ln(·) is the natural logarithm operation;

[0132] For different device types d, assign them an initial window length L0 and a minimum window length L min and attenuation coefficient γ d The window length decreases exponentially as the monitoring progresses:

[0133] L(t)=L min +(L0-L min )exp(-γ d t),

[0134] Where L(t) represents the window length at time scale t, L0 represents the initial window length for device type d, and L min γ represents the minimum window length allowed after long-term monitoring. d The attenuation coefficient corresponding to device type d is represented by t, and the number of monitoring steps since the enumeration or the last reset is represented by t.

[0135] For ease of configuration, the attenuation coefficient γ d Based on the device characteristics, using the half-life parameter τ d Represented as:

[0136]

[0137] Where, τ d The window length half-life of a device of type d is expressed in time scale, which is the time scale required for the window length to decrease to half of its initial value.

[0138] Specifically, the scheme quantitatively assesses the deviation between the real-time protocol migration path and the baseline model using the relative entropy formula, which can intuitively reflect the intensity of abnormal switching. Combined with the exponential decay window length strategy, a larger window can be used in the early stage of detection to obtain sufficient observation information. As the monitoring progresses, the window is automatically shortened to improve the response speed to sudden anomalies. This mechanism provides flexible adaptability to different equipment types, ensuring detection sensitivity and timeliness while avoiding computational overhead and delay caused by excessively long windows.

[0139] Step S5: When the overall risk value exceeds a preset threshold, a tiered circuit breaker mechanism is triggered, including at least one of protocol endpoint disabling and physical connection isolation.

[0140] The execution logic of the step S5 tiered circuit breaker mechanism is as follows:

[0141] Level 1 circuit breaker: Closes the HID endpoint while maintaining storage protocol communication;

[0142] Level 2 fuse: Cuts off power to the D+ data line while maintaining VBUS power supply; the D+ line power-off operation is triggered only when there are 3 consecutive abnormal protocol states accompanied by high-frequency HID commands.

[0143] Level 3 fuse: Triggers the port reset signal of the USB controller, forcing the device to be re-enumerated.

[0144] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for identifying and protecting against the Teensy virus on a portable hard drive, characterized in that, include, Step S1: When the device is connected, the composite device fingerprint of the mobile hard drive is collected in real time. The composite device fingerprint includes a hardware feature parameter set and a dynamic protocol feature parameter set. Step S2: Based on the underlying data stream of the USB protocol stack, construct a protocol state transition probability matrix to track the state transition sequence of the device between the storage protocol and the human-machine interface device protocol in real time. Step S3: Perform multi-granular semantic parsing on the HID instruction stream to extract instruction combination patterns related to the window context; Step S4: Based on the state transition anomaly score in Step S2 and the instruction pattern risk score in Step S3, dynamically adjust the execution level of the protection strategy. Step S5: When the overall risk value exceeds a preset threshold, a tiered circuit breaker mechanism is triggered, including at least one of protocol endpoint disabling and physical connection isolation. The specific implementation method of protocol state tracking in step S2 is as follows: Record the timestamp of the change in the device descriptor field in each USB microframe to form a protocol switching time sequence; A normal device protocol state transition baseline is established based on a hidden Markov model, and the likelihood probability of the real-time state transition path is calculated. The likelihood probability calculation uses a forward algorithm to evaluate the rationality of state transitions through the observation sequence within a sliding window. The multi-granularity semantic parsing in step S3 includes: The process identifier of the currently focused window can be obtained in real time via the system API; Establish a matching evaluation model between command operations and window context; when a dangerous command is detected that the window is not inactive, the risk score level is increased. The matching degree evaluation model executes the following logic: When the HID instruction is detected to contain critical system operation characters, verify whether the process signature of the currently focused window belongs to the trusted whitelist and whether the window has been active for more than 200ms.

2. The method for identifying and protecting against the Teensy virus on a portable hard drive as described in claim 1, characterized in that, The dynamic acquisition of the hardware feature parameter set in step S1 includes: During the device enumeration phase, the current fluctuation characteristics during device initialization are captured at a sampling rate of not less than 1MHz; During the data transmission phase, a set of encryption challenge instructions is periodically sent to collect the firmware verification code response sequence returned by the device; The encrypted challenge instruction set includes time-interleaved 0xA5 and 0x5A verification code request instructions, wherein odd-order instructions are appended with a dynamic salt value, which is generated by the current ripple feature hash value during the device enumeration phase. The collected current fluctuation signal is decomposed by wavelet packet decomposition, and the energy proportion of the third-level detail coefficients is extracted as feature values.

3. The method for identifying and protecting against the Teensy virus on a portable hard drive as described in claim 2, characterized in that, Step S1, the step of extracting the energy proportion feature of the third-layer detail coefficients from the acquired discrete current fluctuation signal, includes: Discrete current signal Perform three-level wavelet packet decomposition to obtain the coefficients of each sub-band in the third level: ， in, Indicates the sampling sequence number is The discrete current fluctuation signal value, For sampling sequence number, The length of the coefficient sequence for each subband. Indicates the first step of the signal processing. Layer Wavelet packet decomposition operator, This indicates the 3rd layer after decomposition. The coefficient sequence of the sub-band; For the 3rd layer The energy of the horn is calculated using a coefficient: ， in, Indicates the 3rd layer The total energy of the sirens belt; Find the total energy of all subbands in the 3rd layer: ， in, This represents the sum of the energies of all subbands in the third layer; Extract the energy proportion characteristics of the high-frequency detail subbands in the third layer, subband numbers 4 to 7: ， in, This represents the characteristic value of the energy proportion of high-frequency details in the third layer. The denominator is the sum of the energies of the high-frequency detail subbands of the third layer. This represents the total energy of the third layer.

4. The method for identifying and protecting against the Teensy virus on a portable hard drive as described in claim 3, characterized in that, The cryptographic challenge instruction set includes: A preset 16-bit random number seed is used to generate dynamic checksum request commands; the random number seed is updated every 24 hours according to the random source published by NIST. The device's main control chip model-related feature triggering instructions are dynamically generated according to the manufacturer's protocol specifications published by USB-IF.

5. The method for identifying and protecting against the Teensy virus on a portable hard drive as described in claim 1, characterized in that, The state transition baseline construction of the hidden Markov model includes: collecting protocol switching time series of 1000+ normal devices, statistically analyzing the transition frequency between protocol states, and marking transition paths with an occurrence probability of less than 0.01% as abnormal paths.

6. The method for identifying and protecting against the Teensy virus on a portable hard drive as described in claim 5, characterized in that, In step S2, the step of evaluating the rationality of the state transition using the observation sequence within the sliding window is as follows: Hidden Markov Models Define: The set of hidden states is ,in The total number of states is denoted as , and the protocol switching events recorded in the observation sequence at the USB microframe level are denoted as . ,in The length of the sliding window. This is the starting microframe index of the current window. Represents the state transition probability matrix. , Represents the observation probability matrix. , Represents the initial state distribution. ; The forward probability is calculated recursively within this window using a forward algorithm: ， in, This indicates the first step of the sliding window. It is in a hidden state. The forward probability, Indicates the initial time. When in a state The probability, Representing state The observation probability function is as follows. Indicates the start microframe of the window The observed values, For hidden state index; ， in, Indicates the sliding window's first... Step is in hidden state The forward probability, For the step index within the window, For hidden state index, Indicates the first Step in The forward probability, Indicates from arrive The state transition probability, Representing state The observation probability function is as follows. Indicates the first Step observations, Indicates the starting frame index of the sliding window. For hidden state index, This represents the total number of hidden states. ， in, In the model Below, the observation sequence starts from arrive The joint likelihood probability, Indicates reaching the last step of the window. When in a state The forward probability, Indicates the length of the sliding window. For hidden state index, This represents the set of parameters for a hidden Markov model.

7. The method for identifying and protecting against the Teensy virus on a portable hard drive as described in claim 1, characterized in that, The dynamic adjustment of the protection strategy described in step S4 includes: When the anomaly of protocol state transition exceeds the first threshold, the instruction-level virtual sandbox execution environment is activated. When the instruction mode risk score exceeds the second threshold, the physical layer power supply ripple characteristic verification mechanism is activated. The anomaly calculation method is as follows: the likelihood probability of the current protocol migration path and the KL divergence value of the baseline are superimposed with the weighted sum of the frequency of occurrence of anomaly paths within the time window; The KL divergence value is calculated using the relative entropy formula, and the time window length is dynamically adjusted according to the equipment type, with the adjustment strategy being an exponential decay function.

8. The method for identifying and protecting against the Teensy virus on a portable hard drive as described in claim 7, characterized in that, In step S4, the process of calculating the KL divergence value using the relative entropy formula and dynamically adjusting the time window length according to the equipment type includes: Calculate the KL divergence, let ， in, This indicates that within the current sliding window, the window will transition from a hidden state. arrive The observed transition probability, In the baseline Hidden Markov Model, from state arrive The transition probability, For hidden state indices, the total number is , For natural logarithm operations; For different equipment types Assign it an initial window length Minimum window length and attenuation coefficient The window length decreases exponentially as the monitoring progresses: ， in, Indicates time scale The length of the window below, Indicates device type The initial window length, This indicates the minimum window length allowed after prolonged monitoring. Indicates device type The corresponding attenuation coefficient, This indicates the number of monitoring steps since the enumeration or the last reset; For ease of configuration, attenuation coefficient Based on device characteristics, using half-life parameters Represented as: ， in, Representation type The window length half-life of a device, expressed in time scales, is the time scale required for the window length to decrease to half of its initial value.

Images