Endogenous safety-based power terminal program control flow integrity protection method and system

Abstract

The invention provides a program control flow integrity protection method and system based on an endogenous safety power terminal, and relates to the technical field of network communication and information safety. The method comprises the following steps: monitoring each control transfer instruction in real time by utilizing a binary instrumentation technology in a process of executing a target binary program by the power terminal to obtain a dynamic execution sequence; calculating an instantaneous deviation of each control transfer based on a pre-constructed control flow graph model and a dynamic execution sequence; an accumulated deviation state variable is obtained by accumulating the instantaneous deviation, and an endogenous protection mechanism of the target binary program is triggered based on the accumulated deviation state variable so as to perform control flow integrity protection; the control flow graph model is a graph model with context information constructed based on static analysis of the target binary program. According to the method, the problem that the power terminal CFI cannot realize accurate detection and self-adaptive protection on attacks while keeping relatively low overhead is solved.

Description

Technical Field

[0001] This invention relates to the fields of network communication and information security technology, specifically to a method and system for protecting the integrity of power terminal program control flow based on intrinsic security. Background Technology

[0002] Control-Flow Integrity (CFI) is a key technology for defending against code reuse attacks and control flow hijacking attacks. Existing CFI solutions are mainly divided into two categories: static and dynamic. Static CFI determines the control flow graph at compile time, but it cannot detect or respond to runtime exceptions; dynamic CFI verifies the control flow in real time through an external monitor, but it suffers from high performance overhead and insufficient intrinsic protection capabilities due to the separation of the execution environment.

[0003] In the open network environment of the power system, such as new energy monitoring terminals and Internet of Things devices, the programs inside the devices are faced with complex runtime attacks. Traditional CFI methods, due to their static nature or external dependencies, are difficult to achieve accurate detection and adaptive protection against attacks while maintaining low overhead. Summary of the Invention

[0004] To overcome the problem that the aforementioned power terminal control flow integrity protection method and system cannot achieve accurate detection and adaptive protection against attacks while maintaining low overhead, this invention provides a method and system for protecting the integrity of power terminal program control flow based on intrinsic security.

[0005] On one hand, the present invention provides a method for protecting the integrity of power terminal control flow based on intrinsically secure power terminal procedures, comprising: During the execution of the target binary program at the power terminal, binary instrumentation technology is used to monitor each control transfer instruction in real time to obtain a dynamic execution sequence. Based on the pre-constructed control flow graph model and the dynamic execution sequence, the instantaneous deviation of each control transfer during the execution of the target binary program is calculated; The cumulative deviation state variable is obtained by accumulating the instantaneous deviation. Based on the cumulative deviation state variable, the intrinsic protection mechanism of the target binary program is triggered to protect the control flow integrity. The control flow graph model is a graph model with contextual information constructed based on static analysis of the target binary program.

[0006] Optionally, binary instrumentation technology can be used to monitor each control transfer instruction in real time to obtain a dynamic execution sequence, including: By using binary instrumentation technology, sensing probes are inserted before and after each control transfer instruction to obtain the source address and target address of each control transfer, thus forming the dynamic execution sequence.

[0007] Optionally, the process of constructing the control flow graph model includes: Disassemble the functions in the target binary program into a set of basic blocks; By statically analyzing the control transfer instructions at the end of each basic block in the basic block set, legal control transfer relationships are determined, and a set of directed edges connecting each basic block is generated based on the legal control transfer relationships. By statically analyzing the function call instructions and return instructions of the target binary program, a function call relationship graph is constructed, and a context mapping function is established based on the function call relationship graph; The control flow graph model is generated based on the basic block set, the directed edge set, and the context mapping function; The context mapping function is used to annotate the call context information for control transfer edges involving function calls, so as to distinguish control transfers from different call paths but with the same target address.

[0008] Optionally, the calculation of the instantaneous deviation of each control transfer during the execution of the target binary program, based on a pre-built control flow graph model and dynamic execution sequence, includes: For each control transfer, the frequency of occurrence of the control transfer under each call context is statistically calculated from the baseline model as the expected probability of the control transfer; Based on a sliding window of a preset size, the frequency of the control transfer occurring within the current sliding window is counted as the observation probability of the control transfer. The instantaneous deviation of the control transfer is determined based on the difference between the expected probability and the observed probability; The benchmark model is constructed using the historical normal operating behavior trajectory of the target binary program.

[0009] Optionally, the process of constructing the benchmark model is as follows: Collect the historical normal operating behavior trajectory of the target binary program under various normal loads; The frequency of each control transfer under each call context in the historical normal operation behavior trajectory is statistically analyzed to form the baseline model.

[0010] Optionally, obtaining the cumulative deviation state variable by accumulating the instantaneous deviation includes: The instantaneous deviation is accumulated using an exponential decay mechanism to obtain the cumulative deviation state variable.

[0011] Optionally, the cumulative deviation state variable is calculated according to the following formula:

[0012] in, This represents the cumulative deviation state variable at the current time t. This represents the cumulative deviation state variable at time t-1. It is an exponential decay factor used to adjust the memory strength of historical states; Let be the instantaneous deviation of the target binary program during the i-th control transfer.

[0013] Optionally, triggering the intrinsic protection mechanism of the target binary program based on the accumulated deviation state variable includes: If the accumulated deviation state variable is greater than the protection threshold, the intrinsic protection mechanism of the target binary program is triggered; The protection threshold is determined based on the false alarm rate of the historical cumulative deviation state variable of the target binary program under different candidate thresholds, which is statistically analyzed on the historical normal operation trajectory.

[0014] Optionally, the intrinsic protection mechanism of the target binary program includes at least one of the following: Pause the execution of the currently suspicious thread, record the attack context information, and reset the program execution flow.

[0015] On the other hand, the present invention also provides a system for protecting the integrity of power terminal control flow based on intrinsically secure power terminal procedures, comprising: The dynamic monitoring module is used to monitor each control transfer instruction in real time during the execution of the target binary program at the power terminal, using binary instrumentation technology to obtain the dynamic execution sequence. The deviation evaluation module is used to calculate the instantaneous deviation of each control transfer during the execution of the target binary program based on the pre-built control flow graph model and the dynamic execution sequence; and to obtain the cumulative deviation state variable by accumulating the instantaneous deviation. The protection module is used to trigger the intrinsic protection mechanism of the target binary program based on the accumulated deviation state variable in order to protect the control flow integrity. The control flow graph model is a graph model with contextual information constructed based on static analysis of the target binary program.

[0016] Optionally, the dynamic monitoring module is specifically used for: By using binary instrumentation technology, sensing probes are inserted before and after each control transfer instruction to obtain the source address and target address of each control transfer, thus forming the dynamic execution sequence.

[0017] Optionally, it further includes: a static analysis module, the static analysis module being used for: Disassemble the functions in the target binary program into a set of basic blocks; By statically analyzing the control transfer instructions at the end of each basic block in the basic block set, legal control transfer relationships are determined, and a set of directed edges connecting each basic block is generated based on the legal control transfer relationships. By statically analyzing the function call instructions and return instructions of the target binary program, a function call relationship graph is constructed, and a context mapping function is established based on the function call relationship graph; The control flow graph model is generated based on the basic block set, the directed edge set, and the context mapping function; The context mapping function is used to annotate the call context information for control transfer edges involving function calls, so as to distinguish control transfers from different call paths but with the same target address.

[0018] Optionally, the deviation evaluation module includes: an instantaneous deviation quantization submodule, the instantaneous deviation quantization submodule being used for... For each control transfer, the frequency of occurrence of the control transfer under each call context is statistically calculated from the baseline model as the expected probability of the control transfer; Based on a sliding window of a preset size, the frequency of the control transfer occurring within the current sliding window is counted as the observation probability of the control transfer. The instantaneous deviation of the control transfer is determined based on the difference between the expected probability and the observed probability; The benchmark model is constructed using the historical normal operating behavior trajectory of the target binary program.

[0019] Optionally, the deviation assessment module further includes: a benchmark model construction submodule, which is used for: Collect the historical normal operating behavior trajectory of the target binary program under various normal loads; The frequency of each control transfer under each call context in the historical normal operation behavior trajectory is statistically analyzed to form the baseline model.

[0020] Optionally, the deviation evaluation module includes: The deviation accumulation submodule is used to accumulate the instantaneous deviation using an exponential decay mechanism to obtain the accumulated deviation state variable.

[0021] Optionally, the cumulative deviation state variable is calculated according to the following formula:

[0022] in, This represents the cumulative deviation state variable at the current time t. This represents the cumulative deviation state variable at time t-1. It is an exponential decay factor used to adjust the memory strength of historical states; Let be the instantaneous deviation of the target binary program during the i-th control transfer.

[0023] Optionally, the protection module is specifically used for: If the accumulated deviation state variable is greater than the protection threshold, the intrinsic protection mechanism of the target binary program is triggered; The protection threshold is determined based on the false alarm rate of the historical cumulative deviation state variable of the target binary program under different candidate thresholds, which is statistically analyzed on the historical normal operation trajectory.

[0024] Optionally, the intrinsic protection mechanism of the target binary program includes at least one of the following: Pause the execution of the currently suspicious thread, record the attack context information, and reset the program execution flow.

[0025] On the other hand, the present invention also provides a communication device, comprising: at least one processor and a memory; the memory and the processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the method described in any of the foregoing is implemented.

[0026] On the other hand, the present invention also provides a readable storage medium having an executable program stored thereon, wherein when the executable program is executed, it implements the method described in any one of the above.

[0027] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention provides a method and system for protecting the integrity of control flow in an intrinsically secure power terminal program. It utilizes binary instrumentation technology to monitor each control transfer instruction in real time, achieving real-time intrinsic monitoring of the control flow. By calculating the instantaneous deviation of each control transfer during program execution based on a pre-constructed control flow graph model with context information and a dynamic execution sequence, and by introducing call context information into control flow verification, the system can effectively distinguish control flow transfers with the same jump target under different call paths. This fine-grained path identification capability significantly improves the accuracy of identifying complex attacks, thereby effectively reducing false alarm and false negative rates while ensuring a high detection rate.

[0028] This invention accumulates instantaneous deviations to obtain a cumulative deviation state variable, which can simulate the memory and forgetting mechanisms of biological nervous systems. This effectively absorbs brief, normal fluctuations during program execution. Simultaneously, through state memory, discrete instantaneous abnormal signals are smoothed into continuous threat situation indicators, enhancing the system's robustness against persistent, low-rate attacks. This achieves intelligent and adaptive security protection. Furthermore, this cumulative deviation mechanism reduces the need for rigorous verification of each control transfer, significantly reducing the computational and memory overhead of dynamic detection.

[0029] This invention integrates the perception, evaluation, decision-making, and response processes into the program execution environment, forming an autonomous security closed loop that does not rely on external monitoring components. This allows the protection capability to originate from the self-perception and regulation of the program's internal behavior, fundamentally improving the autonomy, concealment, and reliability of the protection. Attached Figure Description

[0030] Figure 1 This is a flowchart illustrating a method for protecting the integrity of power terminal program control flow based on intrinsically secure power supply according to the present invention. Figure 2 This is a schematic diagram of the overall architecture of a power terminal program control flow integrity protection method according to an example of the present invention. Figure 3 This is a schematic diagram of the architecture of an example of an intrinsically secure power terminal program control flow integrity protection system according to the present invention; Figure 4 This is a block diagram of an electronic device according to the present invention. Detailed Implementation

[0031] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0032] Example 1 This invention provides a method for protecting the integrity of power terminal control flow based on intrinsically secure power terminal procedures, as illustrated in the schematic diagram below. Figure 1 As shown, the method includes: Step S110: During the execution of the target binary program at the power terminal, binary instrumentation technology is used to monitor each control transfer instruction in real time to obtain a dynamic execution sequence. Step S120: Based on the pre-constructed control flow graph model and the dynamic execution sequence, calculate the instantaneous deviation of each control transfer during the execution of the target binary program; obtain the cumulative deviation state variable by accumulating the instantaneous deviation; Step S130: Trigger the intrinsic protection mechanism of the target binary program based on the accumulated deviation state variable to perform control flow integrity protection; The control flow graph model is a graph model with contextual information constructed based on static analysis of the target binary program.

[0033] In this example implementation, the target binary program is a program running on a power terminal device (such as a new energy terminal or a power IoT terminal). A control flow graph model with context information can be pre-constructed by performing static analysis on the target binary program. The context information is a complete snapshot of the program's state during execution, including information such as the program counter (current execution position), register data, call stack, and variable values. The context information is used to determine the next execution path and resource access methods of the program. During the execution of the target binary program on the power terminal, each control transfer instruction is monitored in real time using binary instrumentation technology. This process records the source and target addresses of jumps, thereby forming a dynamic execution sequence that accurately depicts the actual behavior trajectory of the program. Next, a pre-constructed control flow graph model is invoked. This model is a graph model with context information built based on the static analysis of the target binary program. It is not a simple list of jump relationships, but rather pre-defined through static analysis which control transfers are legal and conform to the expected behavior pattern in each possible context. By comparing the real-time acquired dynamic execution sequence with this refined static model, the power terminal can calculate the instantaneous deviation of each control transfer during program execution. This deviation is a quantified value reflecting the degree of anomaly in this jump. To distinguish between occasional fluctuations and persistent attacks, the system does not react immediately to each instantaneous deviation. Instead, it accumulates these instantaneous deviations to obtain a cumulative deviation state variable. This cumulative deviation state variable is used as a metric for program security posture, with its value reflecting the persistence and severity of the abnormal behavior pattern. Ultimately, the intrinsic protection mechanism of the target binary program is triggered based on the cumulative deviation state variable. When the state variable exceeds a critical value, the pre-set intrinsic protection mechanism within the program is autonomously activated, thereby protecting control flow integrity. The entire process, from internal perception and assessment to internal decision-making and response, is tightly coupled within the program's own execution environment, forming an intrinsic security closed loop independent of external components. This method solves the problems of static CFI's inability to respond to runtime anomalies and dynamic CFI's high overhead and non-intrinsic protection due to external monitoring, achieving a unity of protection autonomy, detection accuracy, response adaptability, and operational efficiency. This invention transforms protection capabilities into runtime attributes of the program itself, eliminating performance bottlenecks, attack interfaces, and response delays caused by external monitoring, making protection more direct, reliable, and covert. By introducing a context-sensitive model, the system can effectively identify the same jump target under different code paths (e.g., distinguishing the behavior of returning to the same address from different call points), which greatly enhances the ability to identify complex code reuse attacks (such as ROP / JOP) and significantly reduces false positives.By using accumulated state variables for decision-making, the system can learn the normal behavior fluctuation patterns of the program, filter out transient and harmless anomalies, and remain sensitive to and ultimately respond to weak but persistent malicious deviations. This achieves intelligent threat detection, lightweight anomaly detection, reduced operating overhead, and meets the security requirements and stringent performance requirements of the complex operating environment of power terminals.

[0034] In some implementations, the process of constructing the control flow graph model includes: Disassemble the functions in the target binary program into a set of basic blocks; By statically analyzing the control transfer instructions at the end of each basic block in the basic block set, legal control transfer relationships are determined, and a set of directed edges connecting each basic block is generated based on the legal control transfer relationships. By statically analyzing the function call instructions and return instructions of the target binary program, a function call relationship graph is constructed, and a context mapping function is established based on the function call relationship graph; The control flow graph model is generated based on the basic block set, the directed edge set, and the context mapping function; The context mapping function is used to annotate the call context information for control transfer edges involving function calls, so as to distinguish control transfers from different call paths but with the same target address.

[0035] In this example implementation, static analysis is performed on the target binary program before program execution, and the functions in the target binary program are disassembled into a set of basic blocks. , This represents the nth basic block. Each function is converted into a set of basic blocks, each a single-entry, single-exit sequence of instructions. Next, by statically analyzing the control transfer instructions at the end of each basic block in the set, legal control transfer relationships are determined. This includes analyzing the targets of direct jumps and inferring the range of possible legal targets for indirect jumps (such as jumps via registers or memory) through data flow analysis. Based on these determined legal relationships, a set of directed edges connecting the basic blocks is generated. , Each directed edge represents a permitted control flow transition. To introduce context sensitivity and improve model accuracy, a function call graph is constructed by statically analyzing the function call and return instructions of the target binary program. Based on this, a context mapping function is established. The context mapping function is used to annotate the call context information of control transition edges involving function calls, distinguishing control transitions from different call paths with the same target address. For example, for function return edges, the context mapping function records their corresponding specific call site, thus distinguishing returns from different callers as different logical paths. Finally, the control flow graph model is generated based on the basic block set, the directed edge set, and the context mapping function. The generated control flow graph model can be represented as: (1) in, Represents the control flow graph model. Represents the set of basic blocks. This represents the set of directed edges between basic blocks. This is a context mapping function used to distinguish the same call target under different call sequences. The control flow graph model is a refined, context-sensitive, and valid control flow graph, providing a high-precision benchmark for runtime deviation calculations. This example introduces context sensitivity by recording caller-callee relationships and return edges under specific call contexts.

[0036] In some implementations, binary instrumentation technology is used to monitor each control transfer instruction in real time to obtain a dynamic execution sequence, including: By using binary instrumentation technology, sensing probes are inserted before and after each control transfer instruction to obtain the source address and target address of each control transfer, forming a dynamic execution sequence.

[0037] In this example implementation, binary instrumentation is used to monitor the execution of each control transfer instruction during program runtime. Specifically, sensing probes are inserted before and after each control transfer instruction (such as `call`, `ret`, `jmp`). These sensing probes are small pieces of injected monitoring code that are activated when the program execution flow passes through them. Their main function is to obtain the source and destination addresses of each control transfer. For example, the probes record the address of the jump instruction (source address). (where i is the control transfer index) and the address to which the program will jump (the target address). As the program continues to run, these are generated in chronological order. The data pairs are then concatenated to form a dynamic execution sequence, which serves as the foundational data source for all subsequent analyses. The dynamic execution sequence is as follows: (2) in, For dynamic execution sequences, This indicates the i-th control transfer. Let i be the source address of the i-th control transfer. The target address for the i-th control transfer.

[0038] When a control transfer is detected When this occurs, the control transfer is marked as a potential anomaly, and deviation analysis is initiated. This example deeply integrates monitoring capabilities within the program, eliminating the communication and context switching overhead of traditional external monitors, achieving low-overhead, high-fidelity runtime behavior capture.

[0039] In some implementations, the calculation of the instantaneous deviation of each control transfer during the execution of the target binary program, based on a pre-built control flow graph model and the dynamic execution sequence under the current context information, includes: For each control transfer, the frequency of occurrence of the control transfer under specific contextual information is statistically determined from the baseline model as the expected probability of the control transfer; Based on a sliding window of a preset size, the frequency of the control transfer occurring within the current sliding window under the current context information is counted as the observation probability of the control transfer; The instantaneous deviation of the control transfer is determined based on the difference between the expected probability and the observed probability; The baseline model is constructed using the historical normal operating behavior trajectory of the target binary program; the specific context information is the same as the current context information.

[0040] In this example implementation, the system performs a quantitative evaluation for each monitored control transfer. This can be based on the static control flow graph. With dynamic monitoring sequence A neuron-like endogenous perception model is designed to quantitatively evaluate control flow deviation. First, the frequency of control transfers under specific contextual information is statistically analyzed from a baseline model as the expected probability of the control transfer. Specifically, for a control transfer in a specific context... Observed control transfer The model is associated with an expected probability statistically derived from a baseline model: (3) in, This indicates statistics obtained from the baseline model in a specific context. Below, control transfer The expected probability of occurrence. This can be calculated by collecting a large amount of normal program operation trajectories during the offline phase and statistically analyzing the frequency of control transfers in various contexts.

[0041] During program execution, through a size of Using a sliding window, the observation probability of the same control transition is estimated online: (4) in, Indicates control transfer The probability of observation, Indicates control transfer In recent The number of times it appears in the next transition. This is the size of the sliding window.

[0042] Calculate the instantaneous deviation of this control transfer based on the expected probability and the observed probability. The calculation formula is: (5) in, This represents the instantaneous deviation of the i-th control transfer. The L2 norm distance operator measures the difference between two probability distributions. It measures the overall difference between the expected and observed probability distributions and is more sensitive to persistent, cumulative biases.

[0043] In some implementations, the process of constructing the baseline model is as follows: Collect the historical normal operating behavior trajectory of the target binary program under various normal loads; The frequency of each control transfer under each call context in the historical normal operation behavior trajectory is statistically analyzed to form the baseline model.

[0044] In this example implementation, to obtain reliable expected probabilities, sufficient benign data collection and statistics are required during the offline phase. This process collects the historical normal operating behavior trajectories of the target binary program under various normal loads. This means designing multiple test cases covering common legitimate operations of the program, repeatedly executing the program in a harmless environment, and recording all control transfer sequences and their contexts to form multiple sets of historical trajectories. Then, the frequency of each control transfer under each calling context in the historical normal operating behavior trajectories is statistically analyzed. That is, for each context in which it occurs, the number of times each control transfer occurs in that context is counted, and its frequency among all transfers in that context is calculated. By performing this statistical analysis on all collected trajectory data, the baseline model is finally formed. This model is essentially a probabilistic portrait of the program's normal behavior, providing data support for the expected probability query in the online phase, ensuring that the baseline for deviation calculation is objective and derived from the program's own normal behavior.

[0045] In some implementations, obtaining the cumulative deviation state variable by accumulating the instantaneous deviation includes: The instantaneous deviation is accumulated using an exponential decay mechanism to obtain the cumulative deviation state variable.

[0046] In this example implementation, the power terminal can smooth and aggregate a series of discrete instantaneous deviations to obtain a state variable that reflects the continuous safety status. For example, the system can maintain a cumulative deviation state variable that reflects the overall safety status of the program, and achieve adaptive sensing through an exponential decay mechanism. This mechanism effectively filters out short-term fluctuations while amplifying the trend of persistent anomalies by giving higher weight to recent deviations and allowing the impact of historical deviations to decay exponentially.

[0047] For example, the cumulative deviation state variable is calculated according to the following formula:

[0048] in, This represents the cumulative deviation state variable at the current time t. This represents the cumulative deviation state variable at time t-1. It is an exponential decay factor used to adjust the memory strength of historical states; The value ranges from 0.6 to 0.95 and is used to adjust the system's memory length for historical deviations and its response speed to fresh deviations. Let be the instantaneous deviation of the target binary program during the i-th control transfer.

[0049] In some implementations, the intrinsic protection mechanism of the target binary program is triggered based on the accumulated deviation state variable, including: If the accumulated deviation state variable is greater than the protection threshold, the intrinsic protection mechanism of the target binary program is triggered; The protection threshold is determined based on the false alarm rate of the historical cumulative deviation state variable of the target binary program under different candidate thresholds, which is statistically analyzed on the historical normal operation trajectory.

[0050] In this example implementation, the continuously calculated cumulative deviation state variable is compared with a preset protection threshold δ. If the cumulative deviation state variable is greater than the protection threshold, a persistent anomaly in the program control flow is determined, automatically triggering the intrinsic protection mechanism of the target binary program. The protection threshold is determined based on the false alarm rate of the historical cumulative deviation state variable at different candidate thresholds, statistically analyzed from the target binary program's historical normal operating trajectory. That is, during the offline calibration phase, by analyzing the value distribution of the historical cumulative deviation state variable generated from the historical normal operating trajectory and testing the false alarm rate at different candidate thresholds, a threshold that ensures the false alarm rate falls within an acceptable range (e.g., approximately 3%) is ultimately selected as the protection δ, thereby achieving data-driven, personalized, and precise decision-making.

[0051] In some implementations, the intrinsic protection mechanism of the target binary program includes at least one of the following: Pause the execution of the currently suspicious thread, record the attack context information, and reset the program execution flow.

[0052] In this example implementation, after the intrinsic protection mechanism is triggered, predefined response actions are executed within the program. These response actions include, but are not limited to, pausing the execution of the currently suspicious thread, recording the attack context, or resetting the program execution flow, thereby forming a complete intrinsic security closed loop that is aware of the protection. For example, execution can be paused by sending a SIGSTOP signal to the abnormal thread; simultaneously, detailed information such as the call stack and register states at the trigger moment is recorded in the log; and the program execution flow can also be reset to a secure checkpoint. These actions are all executed in a closed loop within the program, achieving rapid and autonomous threat containment and forensics.

[0053] This invention first proposes a security state perception method based on the intrinsic behavior of a program. First, it constructs a predictive control flow graph through static analysis to characterize the program's legitimate execution paths. Second, it uses dynamic binary instrumentation technology to monitor the control transfer sequence during program execution in real time to obtain the actual execution path. Third, it designs a neuron-like intrinsic perception model to quantify the probability deviation between the predictive and actual paths, and introduces state variables with memory decay effects to accumulate this deviation, forming a continuous assessment of the program's security posture. Finally, when the accumulated deviation exceeds a preset threshold, the system automatically triggers a built-in protective feedback mechanism to suppress and handle abnormal execution flows in real time. By constructing the above-mentioned autonomous closed loop of "perception-assessment-feedback," the program possesses the intrinsic security capability to internally perceive anomalies, make autonomous decisions, and implement protective measures.

[0054] Experimental verification This embodiment implements the method of the present invention on a standard Linux x86_64 platform. For example... Figure 2 As shown, the static analysis module (an LLVM-based toolchain) performs static analysis on the target binary program (source code), converting it into an LLVM intermediate representation using binary ligating (Lifting) technology, and then constructing a context-sensitive control flow graph. The dynamic monitoring module utilizes the Intel Pin binary instrumentation framework, inserting probe code before and after execution paths, i.e., control transfer instructions (such as call, ret, jmp), to collect runtime control flow sequences and obtain the real-time flow. Figure 2 In this context, bar represents the target function being monitored, call__perf_start indicates starting performance statistics, call__foo indicates calling the foo function, and call__perf_end indicates ending performance statistics.

[0055] In the offline modeling phase, 10 representative user-space programs (including text processing tools grep and sed, compression tools gzip and bzip2, and encryption tools md5sum and sha1sum, with program sizes ranging from 15kB to 1.2MB) were selected as the test set. Various normal workloads were applied to each target program, and each program was executed 200 times to collect benign running trajectories. The frequency of occurrence of each context-dependent control transfer was statistically analyzed, and the expected probability was calculated to form a baseline model.

[0056] During the online operation phase, the feedback module performs deviation assessment and anomaly detection based on the results of state awareness and path awareness. Specifically, it calculates the observation probability in real time. And update the instantaneous deviation accordingly. and cumulative deviation state variables In this embodiment, the size of the sliding window is set through pre-experimental calibration. Attenuation factor Protection threshold It was set to achieve an average false positive rate of approximately 3.1% on the test set. When Exceed When this occurs, the protection logic is triggered, which suspends the thread deemed abnormal by sending a SIGSTOP signal to the target process and generates a detailed security event log for analysis.

[0057] To assess the protection capability, this example artificially injected control flow hijacking attacks, such as ROP chains and indirect jump manipulation, into the test program. Anomaly detection was performed on different types of programs using this method, and the results are shown in Table 1.

[0058] Table 1. Detection Accuracy and Operating Costs

[0059] In Table 1, the detection rate (DR) represents the proportion of illegal control flow transfers successfully detected; the false positive rate (FPR) is the proportion of normal control flow transfers incorrectly identified as abnormal; and the runtime overhead (OH) is the relative increase in execution time compared to uninstrumented operation. As can be seen from Table 1, this method effectively resists such attacks, achieving an average detection rate of 97.2% while controlling the average runtime overhead to 12.4%.

[0060] To verify the effect of introducing context-sensitive information in this application, this embodiment constructs a context-insensitive CFI model as a baseline within the same instrumentation framework. This baseline model uses the exact same static control flow graph and probe insertion points as the proposed method, but its verification mechanism relies solely on direct matching using fixed rules, lacking the context awareness and state decay-based adaptive capabilities proposed in this method. Comparative experimental results show that, compared to the proposed method, the average detection accuracy of this context-insensitive CFI baseline model is 8.6% lower, while its runtime overhead is 12% higher, demonstrating the effectiveness and efficiency of the endogenous awareness and closed-loop feedback mechanism introduced in this invention.

[0061] Traditional dynamic Control Flow Information Verification (CFI) verifies control flow in real time through external monitors, but suffers from high performance overhead and insufficient intrinsic protection due to separation of the execution environment. In open network environments, such as new energy monitoring terminals and power IoT devices, programs face complex runtime attacks. Traditional CFI methods, due to their static nature or external dependencies, struggle to achieve accurate detection and adaptive protection against context-sensitive attacks while maintaining low overhead. Therefore, there is an urgent need for a closed-loop control flow protection mechanism that can achieve self-awareness, self-decision-making, and self-protection within an intrinsic security framework.

[0062] This invention proposes a binary program integrity protection method based on the closed-loop intrinsic security concept. This method constructs a closed-loop protection circuit within the program, encompassing perception, evaluation, and feedback, to achieve real-time quantification, state accumulation, and adaptive response to control flow deviations. This improves the detection accuracy and protection efficiency against unknown and control flow attacks without relying on external components. It addresses the problems of context insensitivity, poor adaptability, and reliance on external monitoring inherent in existing control flow protection technologies.

[0063] This invention is a binary program control flow integrity protection method that integrates static analysis, dynamic perception, and proactive feedback. Compared with existing control flow protection technologies, this invention first constructs an autonomous protection loop covering perception, evaluation, and feedback within the program by combining static analysis and dynamic instrumentation; then, it designs a neuron-like endogenous perception model to quantify and accumulate runtime control flow deviations; finally, through an adaptive state feedback mechanism, it automatically triggers built-in protection when persistent deviations are detected. Because security capabilities are endogenized as runtime attributes of the program itself, this method exhibits significant advantages in protection autonomy, detection accuracy, adaptability, and execution efficiency. Regarding endogenous closed-loop protection: this mechanism allows protection capabilities to originate from the self-perception and regulation of the program's internal behavior, conforming to the principle of endogenous security, fundamentally improving the autonomy, concealment, and reliability of protection. Regarding context awareness: by meticulously introducing and recording call context information in control flow verification, the system can effectively distinguish seemingly identical control flow transfers under different call paths. This fine-grained path discrimination capability significantly improves the accuracy of identifying complex attacks (such as ROP / JOP), thereby effectively reducing false positives and false negatives while maintaining a high detection rate. Regarding adaptive intelligent response: by introducing a cumulative deviation state variable with an exponential decay factor, the system can simulate the memory and forgetting mechanisms of the biological nervous system, effectively absorbing brief normal fluctuations during program execution, while maintaining high sensitivity to small but persistent malicious deviations. This design enables the protection system to accurately judge and quickly respond to attacks, demonstrating the intelligent and adaptive characteristics of the protection. A lightweight probabilistic deviation model is used instead of expensive path matching or symbolic constraint solving; the exponential decay cumulative deviation mechanism reduces the need for rigorous verification of each control transfer; and the computational and memory overhead of dynamic detection is significantly reduced, achieving a good balance between security protection strength and system execution efficiency in resource-constrained open environments.

[0064] Example 2 Based on the same inventive concept, such as Figure 3 As shown, the present invention also provides a power terminal control flow integrity protection system 300 based on intrinsically secure power terminal procedures, comprising: The dynamic monitoring module 310 is used to monitor each control transfer instruction in real time during the execution of the target binary program in the power terminal, and obtain the dynamic execution sequence by using binary staking technology. The deviation evaluation module 320 is used to calculate the instantaneous deviation of each control transfer during the execution of the target binary program based on the pre-built control flow graph model and the dynamic execution sequence; and to obtain the cumulative deviation state variable by accumulating the instantaneous deviation. The protection module 330 is used to trigger the intrinsic protection mechanism of the target binary program based on the accumulated deviation state variable in order to protect the control flow integrity. The control flow graph model is a graph model with contextual information constructed based on static analysis of the target binary program.

[0065] In one possible implementation, the dynamic monitoring module is specifically used for: By using binary instrumentation technology, sensing probes are inserted before and after each control transfer instruction to obtain the source address and target address of each control transfer, thus forming the dynamic execution sequence.

[0066] In one possible implementation, it further includes: a static analysis module, the static analysis module being used for: Disassemble the functions in the target binary program into a set of basic blocks; By statically analyzing the control transfer instructions at the end of each basic block in the basic block set, legal control transfer relationships are determined, and a set of directed edges connecting each basic block is generated based on the legal control transfer relationships. By statically analyzing the function call instructions and return instructions of the target binary program, a function call relationship graph is constructed, and a context mapping function is established based on the function call relationship graph; The control flow graph model is generated based on the basic block set, the directed edge set, and the context mapping function; The context mapping function is used to annotate the call context information for control transfer edges involving function calls, so as to distinguish control transfers from different call paths but with the same target address.

[0067] In one possible implementation, the deviation assessment module includes: an instantaneous deviation quantization submodule, the instantaneous deviation quantization submodule being used for... For each control transfer, the frequency of occurrence of the control transfer under each call context is statistically calculated from the baseline model as the expected probability of the control transfer; Based on a sliding window of a preset size, the frequency of the control transfer occurring within the current sliding window is counted as the observation probability of the control transfer. The instantaneous deviation of the control transfer is determined based on the difference between the expected probability and the observed probability; The benchmark model is constructed using the historical normal operating behavior trajectory of the target binary program.

[0068] In one possible implementation, the deviation assessment module further includes a benchmark model construction submodule, which is used for: Collect the historical normal operating behavior trajectory of the target binary program under various normal loads; The frequency of each control transfer under each call context in the historical normal operation behavior trajectory is statistically analyzed to form the baseline model.

[0069] In one possible implementation, the deviation assessment module includes: The deviation accumulation submodule is used to accumulate the instantaneous deviation using an exponential decay mechanism to obtain the accumulated deviation state variable.

[0070] In one possible implementation, the cumulative deviation state variable is calculated according to the following formula:

[0071] in, This represents the cumulative deviation state variable at the current time t. This represents the cumulative deviation state variable at time t-1. It is an exponential decay factor used to adjust the memory strength of historical states; Let be the instantaneous deviation of the target binary program during the i-th control transfer.

[0072] In one possible implementation, the protection module is specifically used for: If the accumulated deviation state variable is greater than the protection threshold, the intrinsic protection mechanism of the target binary program is triggered; The protection threshold is determined based on the false alarm rate of the historical cumulative deviation state variable of the target binary program under different candidate thresholds, which is statistically analyzed on the historical normal operation trajectory.

[0073] In one possible implementation, the intrinsic protection mechanism of the target binary program includes at least one of the following: Pause the execution of the currently suspicious thread, record the attack context information, and reset the program execution flow.

[0074] Example 3 like Figure 4As shown, the present invention also provides a communication device, which may be a computer device, a microcontroller device, a smart mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, processor, and transceiver component are connected via a bus; the memory can be used to store executable programs, and an exemplary executable program may include instructions; the processor is used to execute the instructions stored in the memory. The memory can also be used to store data, which can be accessed and / or modified when instructions are executed.

[0075] The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, and is suitable for implementing one or more instructions. Specifically, it is suitable for loading and executing one or more instructions in the storage medium to realize the corresponding method flow or corresponding function, so as to realize the steps of the method for protecting the integrity of the program control flow of an endogenous safe power terminal in the above embodiments.

[0076] Example 4 Based on the same inventive concept, this invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory). An electronic device readable storage medium is a memory device within an electronic device used to store programs and data. It is understood that the storage medium here can include both the built-in storage medium within the electronic device and extended storage media supported by the electronic device. The storage medium provides storage space, which stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more executable programs (including program code). It should be noted that the storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. Loading and executing one or more instructions stored in the storage medium by the processor can implement the steps of the method for protecting the integrity of the program control flow of an intrinsically secure power terminal as described in the above embodiments.

[0077] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0078] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0079] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0080] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit its scope of protection. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that after reading the present invention, they can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the scope of protection of the claims pending approval.

Claims

1. A method for protecting the integrity of power terminal control flow based on intrinsically secure power terminal procedures, characterized in that, include: During the execution of the target binary program at the power terminal, binary instrumentation technology is used to monitor each control transfer instruction in real time to obtain a dynamic execution sequence. Based on the pre-constructed control flow graph model and the dynamic execution sequence, the instantaneous deviation of each control transfer during the execution of the target binary program is calculated; the cumulative deviation state variable is obtained by accumulating the instantaneous deviation. The intrinsic protection mechanism of the target binary program is triggered based on the accumulated deviation state variable to protect the control flow integrity. The control flow graph model is a graph model with contextual information constructed based on static analysis of the target binary program.

2. The method according to claim 1, characterized in that, Using binary instrumentation technology, each control transfer instruction is monitored in real time to obtain a dynamic execution sequence, including: By using binary instrumentation technology, sensing probes are inserted before and after each control transfer instruction to obtain the source address and target address of each control transfer, thus forming the dynamic execution sequence.

3. The method according to claim 1, characterized in that, The process of constructing the control flow graph model includes: Disassemble the functions in the target binary program into a set of basic blocks; By statically analyzing the control transfer instructions at the end of each basic block in the basic block set, legal control transfer relationships are determined, and a set of directed edges connecting each basic block is generated based on the legal control transfer relationships. By statically analyzing the function call instructions and return instructions of the target binary program, a function call relationship graph is constructed, and a context mapping function is established based on the function call relationship graph; The control flow graph model is generated based on the basic block set, the directed edge set, and the context mapping function; The context mapping function is used to annotate the call context information for control transfer edges involving function calls, so as to distinguish control transfers from different call paths but with the same target address.

4. The method according to claim 3, characterized in that, The instantaneous deviation of each control transfer during the execution of the target binary program, based on a pre-built control flow graph model and dynamic execution sequence, is calculated, including: For each control transfer, the frequency of occurrence of the control transfer under each call context is statistically calculated from the baseline model as the expected probability of the control transfer; Based on a sliding window of a preset size, the frequency of the control transfer occurring within the current sliding window is counted as the observation probability of the control transfer. The instantaneous deviation of the control transfer is determined based on the difference between the expected probability and the observed probability; The benchmark model is constructed using the historical normal operating behavior trajectory of the target binary program.

5. The method according to claim 4, characterized in that, The process of constructing the benchmark model is as follows: Collect the historical normal operating behavior trajectory of the target binary program under various normal loads; The frequency of each control transfer under each call context in the historical normal operation behavior trajectory is statistically analyzed to form the baseline model.

6. The method according to claim 1, characterized in that, The process of obtaining the cumulative deviation state variable by accumulating the instantaneous deviation includes: The instantaneous deviation is accumulated using an exponential decay mechanism to obtain the cumulative deviation state variable.

7. The method according to claim 6, characterized in that, The cumulative deviation state variable is calculated according to the following formula: in, This represents the cumulative deviation state variable at the current time t. This represents the cumulative deviation state variable at time t-1. It is an exponential decay factor used to adjust the memory strength of historical states; Let be the instantaneous deviation of the target binary program during the i-th control transfer.

8. The method according to claim 1, characterized in that, The intrinsic protection mechanism of the target binary program is triggered based on the accumulated deviation state variable, including: If the accumulated deviation state variable is greater than the protection threshold, the intrinsic protection mechanism of the target binary program is triggered; The protection threshold is determined based on the false alarm rate of the historical cumulative deviation state variable of the target binary program under different candidate thresholds, which is statistically analyzed on the historical normal operation trajectory.

9. The method according to claim 8, characterized in that, The intrinsic protection mechanism of the target binary program includes at least one of the following: Pause the execution of the currently suspicious thread, record the attack context information, and reset the program execution flow.

10. A flow integrity protection system based on intrinsically secure power terminal program control, characterized in that, include: The dynamic monitoring module is used to monitor each control transfer instruction in real time during the execution of the target binary program at the power terminal, using binary instrumentation technology to obtain the dynamic execution sequence. The deviation evaluation module is used to calculate the instantaneous deviation of each control transfer during the execution of the target binary program based on the pre-built control flow graph model and the dynamic execution sequence; and to obtain the cumulative deviation state variable by accumulating the instantaneous deviation. The protection module is used to trigger the intrinsic protection mechanism of the target binary program based on the accumulated deviation state variable in order to protect the control flow integrity. The control flow graph model is a graph model with contextual information constructed based on static analysis of the target binary program.

11. The system according to claim 10, characterized in that, The dynamic monitoring module is specifically used for: By using binary instrumentation technology, sensing probes are inserted before and after each control transfer instruction to obtain the source address and target address of each control transfer, thus forming the dynamic execution sequence.

12. The system according to claim 10, characterized in that, Also includes: The static analysis module is used for: Disassemble the functions in the target binary program into a set of basic blocks; By statically analyzing the control transfer instructions at the end of each basic block in the basic block set, legal control transfer relationships are determined, and a set of directed edges connecting each basic block is generated based on the legal control transfer relationships. By statically analyzing the function call instructions and return instructions of the target binary program, a function call relationship graph is constructed, and a context mapping function is established based on the function call relationship graph; The control flow graph model is generated based on the basic block set, the directed edge set, and the context mapping function; The context mapping function is used to annotate the call context information for control transfer edges involving function calls, so as to distinguish control transfers from different call paths but with the same target address.

13. The system according to claim 12, characterized in that, The deviation assessment module includes: an instantaneous deviation quantification submodule, which is used for... For each control transfer, the frequency of occurrence of the control transfer under each call context is statistically calculated from the baseline model as the expected probability of the control transfer; Based on a sliding window of a preset size, the frequency of the control transfer occurring within the current sliding window is counted as the observation probability of the control transfer. The instantaneous deviation of the control transfer is determined based on the difference between the expected probability and the observed probability; The benchmark model is constructed using the historical normal operating behavior trajectory of the target binary program.

14. The system according to claim 13, characterized in that, The deviation assessment module further includes a benchmark model construction submodule, which is used for: Collect the historical normal operating behavior trajectory of the target binary program under various normal loads; The frequency of each control transfer under each call context in the historical normal operation behavior trajectory is statistically analyzed to form the baseline model.

15. The system according to claim 10, characterized in that, The deviation assessment module includes: The deviation accumulation submodule is used to accumulate the instantaneous deviation using an exponential decay mechanism to obtain the accumulated deviation state variable.

16. The system according to claim 15, characterized in that, The cumulative deviation state variable is calculated according to the following formula: in, This represents the cumulative deviation state variable at the current time t. This represents the cumulative deviation state variable at time t-1. It is an exponential decay factor used to adjust the memory strength of historical states; Let be the instantaneous deviation of the target binary program during the i-th control transfer.

17. The system according to claim 10, characterized in that, The protection module is specifically used for: If the accumulated deviation state variable is greater than the protection threshold, the intrinsic protection mechanism of the target binary program is triggered; The protection threshold is determined based on the false alarm rate of the historical cumulative deviation state variable of the target binary program under different candidate thresholds, which is statistically analyzed on the historical normal operation trajectory.

18. The system according to claim 17, characterized in that, The intrinsic protection mechanism of the target binary program includes at least one of the following: Pause the execution of the currently suspicious thread, record the attack context information, and reset the program execution flow.

19. An electronic device, characterized in that, include: At least one processor and memory; The memory and processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the method as described in any one of claims 1 to 9 is implemented.

20. A readable storage medium, characterized in that, It contains an executable program, which, when executed, implements the method as described in any one of claims 1 to 9.

Images