A nor flash access anomaly detection method and system based on an LSTM self-encoder

Abstract

The application provides a Nor Flash access anomaly detection method and system based on an LSTM self-encoder. The method comprises the following steps: capturing the access operation behavior of a Flash, and defining an event; obtaining an event stream sequence; applying a time window to sample the event stream sequence, grouping the events in the time window into a sample, and extracting a feature vector of the sample; constructing an LSTM-based self-encoder model; training the self-encoder model; collecting a feature vector of a real-time sample, inputting the feature vector into the trained self-encoder model, and obtaining a real-time output of the self-encoder model; calculating the mean square error of the feature vector of the real-time sample and the real-time output; and if the mean square error is greater than a threshold value, determining that an abnormal access behavior occurs in the current sequence. The scheme provided by the application can effectively improve the detection accuracy and real-time performance of the Flash access anomaly in an embedded system.

Description

Technical Field

[0001] This invention belongs to the field of illegal access detection technology for memory, and particularly relates to a method and system for detecting abnormal access to Nor Flash based on an LSTM autoencoder. Background Technology

[0002] In embedded systems, Nor Flash is a widely used non-volatile memory, commonly used for firmware storage and code execution. With increasing system security requirements, detecting unauthorized access to memory has become a key issue. Traditional methods often rely on rule matching or access counting, which struggle to handle complex behavioral patterns.

[0003] Currently, the mainstream technologies for security detection of Nor Flash memory in embedded systems mainly rely on access control lists (ACLs) or rule-based anomaly detection. While these methods are effective for static protection, they struggle to handle dynamic and complex unauthorized access behaviors. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention proposes a technical solution for detecting Nor Flash access anomalies based on an LSTM autoencoder.

[0005] The first aspect of this invention discloses a method for detecting Nor Flash access anomalies based on an LSTM autoencoder, the method comprising:

[0006] Step S1: Capture Flash access operation behavior and define events; obtain the event stream sequence, that is, the continuously generated flash access event records;

[0007] Step S2: Apply a time window to sample the event stream sequence, combine the events within the time window into a sample, and extract the feature vector of the sample;

[0008] Step S3: Construct an LSTM-based autoencoder model; train the autoencoder model using the training set composed of the feature vectors and the loss function composed of the mean square error of the feature vectors and the output of the autoencoder model.

[0009] Step S4: Collect the feature vector of the real-time sample and input it into the trained autoencoder model to obtain the real-time output of the autoencoder model; calculate the mean square error of the feature vector of the real-time sample and the real-time output; if the mean square error is greater than the threshold, it is determined that the current sequence has abnormal access behavior.

[0010] According to the method of the first aspect of the present invention, in step S2, the feature vector of the sample includes: operation type feature, access source feature, address span feature, operation length feature, timestamp feature, and distribution entropy feature of access address.

[0011] According to the method of the first aspect of the present invention, in step S2, the operation type feature is:

[0012] There are only three operation type features: READ, WRITE, and ERASE. These operation types are finite discrete enumeration values, which are converted into feature vectors using one-hot encoding.

[0013] The one-hot encoding for READ is 1,0,0;

[0014] The one-hot encoding of WRITE is 0,1,0;

[0015] The one-hot encoding of ERASE is 0,0,1;

[0016] The formula can be expressed as:

[0017] f op =OneHot(op)∈{0,1} 3

[0018] Among them, f op Indicates the operation type characteristic; OneHot() represents a one-hot encoding function; op represents the operation type:

[0019] The access source characteristics are:

[0020] f src =OneHot(src)∈{0,1} M

[0021] Among them, f src The src attribute represents the access source characteristics; M represents the access source; and M represents the number of src categories.

[0022] According to the method of the first aspect of the present invention, in step S2, the address span feature is:

[0023]

[0024] Among them, f addr Indicates address span characteristics; addr min and addr max This indicates the address range of the FLASH memory; addr indicates the address.

[0025] According to the method of the first aspect of the present invention, in step S2, the operation length feature is:

[0026]

[0027] Among them, f len The len character represents the operation length characteristic; len represents the operation length. max This is the maximum allowed operation length.

[0028] According to the method of the first aspect of the present invention, in step S2, the timestamp feature includes:

[0029]

[0030] Among them, f T The timestamp feature is represented; ΔT represents the time difference between adjacent operations; ΔT max This represents the maximum time interval within the observation window, obtained by subtracting the minimum timestamp from the maximum timestamp.

[0031] According to the method of the first aspect of the present invention, in step S2, the distribution entropy characteristic of the access address is:

[0032]

[0033] Where H represents the distribution entropy characteristic of the access address; m represents the m address segments divided into the address space; p i This represents the probability of accessing the i-th address segment.

[0034] A second aspect of this invention discloses a Nor Flash access anomaly detection system based on an LSTM autoencoder, the system comprising:

[0035] The first processing module is configured to capture Flash access operation behavior, define events, and obtain the event stream sequence, that is, the continuously generated flash access event records.

[0036] The second processing module is configured to sample the event stream sequence using a time window, combine the events within the time window into a sample, and extract the feature vector of the sample.

[0037] The third processing module is configured to construct an LSTM-based autoencoder model; and train the autoencoder model using a training set composed of the feature vectors and a loss function composed of the mean square error of the feature vectors and the output of the autoencoder model.

[0038] The fourth processing module is configured to: collect the feature vectors of real-time samples and input them into the trained autoencoder model to obtain the real-time output of the autoencoder model; calculate the mean square error of the feature vectors of the real-time samples and the real-time output; and determine that abnormal access behavior has occurred in the current sequence if the mean square error is greater than the threshold.

[0039] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the Nor Flash access anomaly detection method based on an LSTM autoencoder according to any one of the first aspects of this disclosure.

[0040] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a Nor Flash access anomaly detection method based on an LSTM autoencoder according to any one of the first aspects of this disclosure.

[0041] In summary, the proposed solution possesses self-learning and adaptive capabilities, effectively improving the detection accuracy and real-time performance of Flash access anomalies in embedded systems. It automatically captures access patterns without requiring manual setting of specific rules, exhibits strong generalization ability, and significantly reduces false positives and false negatives. Attached Figure Description

[0042] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0043] Figure 1 This is a flowchart of a Nor Flash access anomaly detection method based on an LSTM autoencoder according to an embodiment of the present invention;

[0044] Figure 2 This is a structural diagram of a Nor Flash access anomaly detection system based on an LSTM autoencoder according to an embodiment of the present invention;

[0045] Figure 3 This is a structural diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] The first aspect of this invention discloses a method for detecting Nor Flash access anomalies based on an LSTM autoencoder. Figure 1 This is a flowchart of a Nor Flash access anomaly detection method based on an LSTM autoencoder according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes:

[0048] Step S1: Capture Flash access operation behavior and define events; obtain the event stream sequence, that is, the continuously generated flash access event records;

[0049] Step S2: Apply a time window to sample the event stream sequence, combine the events within the time window into a sample, and extract the feature vector of the sample;

[0050] Step S3: Construct an LSTM-based autoencoder model; train the autoencoder model using the training set composed of the feature vectors and the loss function composed of the mean square error of the feature vectors and the output of the autoencoder model.

[0051] Step S4: Collect the feature vector of the real-time sample and input it into the trained autoencoder model to obtain the real-time output of the autoencoder model; calculate the mean square error of the feature vector of the real-time sample and the real-time output; if the mean square error is greater than the threshold, it is determined that the current sequence has abnormal access behavior.

[0052] In step S1, the access operation behavior of Flash is captured and the event is defined; the event stream sequence is obtained, that is, the continuously generated flash access event records.

[0053] Specifically, capture Flash access behavior and define events:

[0054] E t =(o p t, addr t len t src t T t );

[0055] ·op t ∈{read,write,erase};

[0056] ·addr t : The starting address to be accessed;

[0057] ·len t : Access length;

[0058] ·src t : Access source (task ID or peripheral source);

[0059] ·T t : The timestamp of the event.

[0060] Obtain the event stream sequence, i.e., the continuously generated flash access event records: S = {E1, E2, ..., E...} t The sequence is arranged in chronological order, with each event being a detailed record of a flash access operation.

[0061] In step S2, a time window is applied to sample the event stream sequence, the events within the time window are grouped into a sample, and the feature vector of the sample is extracted.

[0062] In some embodiments, in step S2, the feature vector of the sample includes: operation type feature, access source feature, address span feature, operation length feature, timestamp feature, and distribution entropy feature of access address.

[0063] The operation type characteristic is:

[0064] There are only three operation type features: READ, WRITE, and ERASE. These operation types are finite discrete enumeration values, which are converted into feature vectors using one-hot encoding.

[0065] The one-hot encoding for READ is 1,0,0;

[0066] The one-hot encoding of WRITE is 0,1,0;

[0067] The one-hot encoding of ERASE is 0,0,1;

[0068] The formula can be expressed as:

[0069] f op =OneHot(op)∈{0,1} 3

[0070] Among them, f op Indicates the operation type characteristic; OneHot() represents a one-hot encoding function; op represents the operation type:

[0071] The access source characteristics are:

[0072] f src =OneHot(src)∈{0,1} M

[0073] Among them, f src The src attribute represents the access source characteristics; M represents the access source; and M represents the number of src categories.

[0074] The original address value is often a large integer. If it is directly input, it will make the gradient descent unstable. Therefore, the address is normalized here. The min-max normalization method is used to make it fall into the [0,1] interval.

[0075] The address span characteristic is:

[0076]

[0077] Among them, f addr Indicates address span characteristics; addr min and addr max This indicates the address range of the FLASH memory; addr indicates the address.

[0078] Since the operation length len can be either small or large, and the difference between small and large operations can be significant, we use logarithmic normalization for the operation length to ensure the model's sensitivity to changes in the operation length trend.

[0079] The operation length characteristic is:

[0080]

[0081] Among them, f len The len character represents the operation length characteristic; len represents the operation length. max This is the maximum allowed operation length.

[0082] To reflect the temporal distribution characteristics of the behavior, instead of using absolute timestamps, the time difference ΔT between adjacent operations is used:

[0083] ΔT=T current -T previous

[0084] Among them, T current Indicates the absolute timestamp of the current operation; T previous This represents the absolute timestamp of the last operation.

[0085] The timestamp features include:

[0086]

[0087] Among them, fT The timestamp feature is represented; ΔT represents the time difference between adjacent operations; ΔT max This represents the maximum time interval within the observation window, obtained by subtracting the minimum timestamp from the maximum timestamp.

[0088] The entropy of the access address distribution is added as an additional feature to the feature vector to measure the dispersion of memory access addresses. Normal access behavior is often concentrated in certain address segments (such as peripheral registers). Once a large-scale, skipping access occurs (such as an attacker scanning a memory segment), the entropy value of the address distribution will increase. Therefore, the magnitude of the entropy value can be used to determine whether there is anomaly in the access behavior.

[0089] The distribution entropy characteristic of the access address is:

[0090]

[0091] Where H represents the distribution entropy characteristic of the access address; m represents the m address segments divided into the address space; p i This represents the probability of accessing the i-th address segment.

[0092] In step S3, an LSTM-based autoencoder model is constructed; the autoencoder model is trained using a training set composed of the feature vectors and a loss function composed of the mean square error of the feature vectors and the output of the autoencoder model.

[0093] Specifically, an autoencoder consists of two parts: an encoder and a decoder. The encoder is used to compress a high-dimensional input vector into a low-dimensional latent representation; the decoder is used to reconstruct the original feature vector from the low-dimensional latent representation.

[0094] To identify potential abnormal behavior patterns when accessing Flash memory, this invention introduces an autoencoder model of a Long Short-Term Memory (LSTM) network to model and learn Flash access feature vectors, thereby enabling the detection of abnormal access behavior.

[0095] LSTM encoder: Learns the time dependencies of the input sequence and compresses them into a fixed-length hidden vector h. t ;

[0096] h t =LSTM encode (F t h t-1 )

[0097] Using the hidden state at the last time step as the context vector z, we get a compressed representation of the entire orientation behavior:

[0098] z = h t

[0099] LSTM decoder: Using z as the initial input and initial hidden state, it attempts to gradually reconstruct the original input sequence.

[0100]

[0101] Output reconstructed vector If the input is normal, the reconstruction error will be very small.

[0102] The loss function is defined as:

[0103]

[0104] In step S4, the feature vector of the real-time sample is collected and input into the trained autoencoder model to obtain the real-time output of the autoencoder model; the mean square error of the feature vector of the real-time sample and the real-time output is calculated; if the mean square error is greater than the threshold, it is determined that the current sequence has abnormal access behavior.

[0105] Specifically, a certain number of normal behavior sequences are input into the trained model. The feature vectors of the real-time samples and the mean squared error of the real-time output are calculated, and the mean and standard deviation of these mean squared errors are statistically analyzed. The threshold δ is then set as: Threshold δ = Mean + k * Standard Deviation. Here, k is an empirical constant, typically taken as 2 to 3.

[0106] In summary, the proposed solution possesses self-learning and adaptive capabilities, effectively improving the detection accuracy and real-time performance of Flash access anomalies in embedded systems. It automatically captures access patterns without requiring manual setting of specific rules, exhibits strong generalization ability, and significantly reduces false positives and false negatives.

[0107] The second aspect of this invention discloses a Nor Flash access anomaly detection system based on an LSTM autoencoder. Figure 2 This is a structural diagram of a Nor Flash access anomaly detection system based on an LSTM autoencoder according to an embodiment of the present invention; as shown. Figure 2 As shown, the system 100 includes:

[0108] The first processing module 101 is configured to capture Flash access operation behavior, define events, and obtain the event stream sequence, i.e., the continuously generated flash access event records.

[0109] The second processing module 102 is configured to sample the event stream sequence using a time window, combine the events within the time window into a sample, and extract the feature vector of the sample.

[0110] The third processing module 103 is configured to construct an LSTM-based autoencoder model; and train the autoencoder model using a training set composed of the feature vectors and a loss function composed of the mean square error of the feature vectors and the output of the autoencoder model.

[0111] The fourth processing module 104 is configured to: collect the feature vector of the real-time sample and input it into the trained autoencoder model to obtain the real-time output of the autoencoder model; calculate the mean square error of the feature vector of the real-time sample and the real-time output; and if the mean square error is greater than the threshold, determine that the current sequence has abnormal access behavior.

[0112] According to the system of the second aspect of the present invention, the first processing module 101 is specifically configured to capture Flash access operation behavior and define events:

[0113] E t =(op t addr t len t src t T t );

[0114] ·op t ∈{read,write,erase};

[0115] ·addr t : The starting address to be accessed;

[0116] ·len t : Access length;

[0117] ·src t : Access source (task ID or peripheral source);

[0118] ·T t : The timestamp of the event.

[0119] Obtain the event stream sequence, i.e., the continuously generated flash access event records: S = {E1, E2, ..., E...} t The sequence is arranged in chronological order, with each event being a detailed record of a flash access operation.

[0120] According to the system of the second aspect of the present invention, the second processing module 102 is specifically configured such that the feature vector of the sample includes: operation type feature, access source feature, address span feature, operation length feature, timestamp feature and distribution entropy feature of access address.

[0121] The operation type characteristic is:

[0122] There are only three operation type features: READ, WRITE, and ERASE. These operation types are finite discrete enumeration values, which are converted into feature vectors using one-hot encoding.

[0123] The one-hot encoding for READ is 1,0,0;

[0124] The one-hot encoding of WRITE is 0,1,0;

[0125] The one-hot encoding of ERASE is 0,0,1;

[0126] The formula can be expressed as:

[0127] f op =OneHot(op)∈{0,1} 3

[0128] Among them, f op Indicates the operation type characteristic; OneHot() represents a one-hot encoding function; op represents the operation type:

[0129] The access source characteristics are:

[0130] f src =OneHot(src)∈{0,1} M

[0131] Among them, f src The src attribute represents the access source characteristics; M represents the access source; and M represents the number of src categories.

[0132] The original address value is often a large integer. If it is directly input, it will make the gradient descent unstable. Therefore, the address is normalized here. The min-max normalization method is used to make it fall into the [0,1] interval.

[0133] The address span characteristic is:

[0134]

[0135] Among them, f addr Indicates address span characteristics; addr min and addr max This indicates the address range of the FLASH memory; addr indicates the address.

[0136] Since the operation length len can be either small or large, and the difference between small and large operations can be significant, we use logarithmic normalization for the operation length to ensure the model's sensitivity to changes in the operation length trend.

[0137] The operation length characteristic is:

[0138]

[0139] Among them, f len The len character represents the operation length characteristic; len represents the operation length. max This is the maximum allowed operation length.

[0140] To reflect the temporal distribution characteristics of the behavior, instead of using absolute timestamps, the time difference ΔT between adjacent operations is used:

[0141] ΔT=T current -T previous

[0142] Among them, T current Indicates the absolute timestamp of the current operation; T previous This represents the absolute timestamp of the last operation.

[0143] The timestamp features include:

[0144]

[0145] Among them, f T The timestamp feature is represented; ΔT represents the time difference between adjacent operations; ΔT max This represents the maximum time interval within the observation window, obtained by subtracting the minimum timestamp from the maximum timestamp.

[0146] The entropy of the access address distribution is added as an additional feature to the feature vector to measure the dispersion of memory access addresses. Normal access behavior is often concentrated in certain address segments (such as peripheral registers). Once a large-scale, skipping access occurs (such as an attacker scanning a memory segment), the entropy value of the address distribution will increase. Therefore, the magnitude of the entropy value can be used to determine whether there is anomaly in the access behavior.

[0147] The distribution entropy characteristic of the access address is:

[0148]

[0149] Where H represents the distribution entropy characteristic of the access address; m represents the m address segments divided into the address space; p i This represents the probability of accessing the i-th address segment.

[0150] According to the system of the second aspect of the present invention, the third processing module 103 is specifically configured such that the autoencoder consists of two parts: an encoder and a decoder. The encoder is used to compress a high-dimensional input vector into a low-dimensional latent representation; the decoder is used to reconstruct the low-dimensional latent representation into the original feature vector.

[0151] To identify potential abnormal behavior patterns when accessing Flash memory, this invention introduces an autoencoder model of a Long Short-Term Memory (LSTM) network to model and learn Flash access feature vectors, thereby enabling the detection of abnormal access behavior.

[0152] LSTM encoder: Learns the time dependencies of the input sequence and compresses them into a fixed-length hidden vector h. t ;

[0153] h t =LSTM encode (F t h t-1 )

[0154] Using the hidden state at the last time step as the context vector z, we get a compressed representation of the entire orientation behavior:

[0155] z = h t

[0156] LSTM decoder: Using z as the initial input and initial hidden state, it attempts to gradually reconstruct the original input sequence.

[0157]

[0158] Output reconstructed vector If the input is normal, the reconstruction error will be very small.

[0159] The loss function is defined as:

[0160]

[0161] According to the system of the second aspect of the present invention, the fourth processing module 104 is specifically configured to, specifically, input a certain number of normal behavior sequences into the trained model, calculate the feature vectors of the real-time samples and the mean square error of the real-time output, and statistically analyze the mean and standard deviation of these mean square errors. The threshold δ is then set as: threshold δ = mean + k * standard deviation. Here, k is an empirical constant, typically taken as 2 to 3.

[0162] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the Nor Flash access anomaly detection method based on an LSTM autoencoder according to any one of the first aspects of this invention.

[0163] Figure 3 This is a structural diagram of an electronic device according to an embodiment of the present invention, such as... Figure 3As shown, the electronic device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, Near Field Communication (NFC), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0164] Those skilled in the art will understand that Figure 3 The structure shown is merely a structural diagram of the part related to the technical solution of this disclosure and does not constitute a limitation on the electronic device to which the solution of this application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0165] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a Nor Flash access anomaly detection method based on an LSTM autoencoder according to any one of the first aspects of this invention.

[0166] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A Nor Flash access anomaly detection method based on LSTM auto-encoder, characterized in that, The method comprises: Step S1, capturing the access operation behavior of the Flash, defining events; obtaining an event stream sequence, i.e. continuously generated flash access event records; Step S2, applying a time window to sample the event stream sequence, grouping events in the time window into a sample, and extracting a feature vector of the sample; Step S3, constructing an autoencoder model based on LSTM; training the autoencoder model by using a training set composed of the feature vector and a loss function composed of the mean square error between the feature vector and the output of the autoencoder model; Step S4, collecting a feature vector of a real-time sample, inputting the trained autoencoder model to obtain a real-time output of the autoencoder model; calculating the mean square error between the feature vector of the real-time sample and the real-time output; if the mean square error is greater than a threshold value, determining that the current sequence has abnormal access behavior. In the step S2, the feature vector of the sample comprises: operation type features, access source features, address span features, operation length features, timestamp features, and distribution entropy features of access addresses. In the step S2, the operation type features are: There are only three operation type features, which are READ, WRITE, and ERASE. The operation type is a limited discrete enumeration value, and One-Hot Encoding is used to convert it into a feature vector. The One-Hot Encoding of READ is 1, 0, 0. The One-Hot Encoding of WRITE is 0, 1, 0. The One-Hot Encoding of ERASE is 0, 0, 1. The formula is: wherein, represents an operation type feature; represents a one-hot encoding function; represents an operation type: The access source features are: wherein, represents the access source characteristic; represents the access source; represents the number of kinds of src. 2.The Nor Flash access anomaly detection method based on LSTM auto-encoder according to claim 1, wherein, In the step S2, the address span features are: wherein, represents an address span feature; and represents a FLASH address range; represents an address. 3.The Nor Flash access anomaly detection method based on LSTM auto-encoder of claim 1, wherein, In the step S2, the operation length features are: wherein, represents an operating length characteristic; represents an operating length; is the maximum operating length allowed.

4. The Nor Flash access anomaly detection method based on LSTM autoencoder according to claim 1, characterized in that, In the step S2, the timestamp features comprise: wherein, represents a time stamp feature; represents a time difference between adjacent operations; represents a maximum time interval within an observation window, obtained using the maximum time stamp minus the minimum time stamp.

5. The Nor Flash access anomaly detection method based on LSTM autoencoder according to claim 1, characterized in that, In the step S2, the distribution entropy features of access addresses are: wherein, denotes a distribution entropy feature of the access addresses; m denotes a partitioning of the address space into m address segments; p i denotes a probability of an access in the i-th address segment.

6. A Nor Flash access anomaly detection system based on LSTM autoencoder, the system employs the method of any one of claims 1-5, characterized in that, The system comprises: A first processing module configured to capture the access operation behavior of the Flash, define events, and obtain an event stream sequence, i.e. continuously generated flash access event records; A second processing module configured to apply a time window to sample the event stream sequence, group events in the time window into a sample, and extract a feature vector of the sample; A third processing module configured to construct an autoencoder model based on LSTM; train the autoencoder model by using a training set composed of the feature vector and a loss function composed of the mean square error between the feature vector and the output of the autoencoder model; A fourth processing module configured to collect a feature vector of a real-time sample, input the trained autoencoder model to obtain a real-time output of the autoencoder model; calculate the mean square error between the feature vector of the real-time sample and the real-time output; if the mean square error is greater than a threshold value, determine that the current sequence has abnormal access behavior.

7. An electronic device, comprising: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor executes the computer program to implement the steps of the Nor Flash access anomaly detection method based on the LSTM self-encoder in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the processor executes the computer program to implement the steps of the Nor Flash access anomaly detection method based on the LSTM self-encoder in any one of claims 1 to 5.

Images