A data security detection method based on memory instruction execution sequence

Abstract

This invention discloses a data security detection method based on memory instruction execution sequences, specifically relating to the field of data security detection technology. It constructs a multi-level cumulative distribution function model by collecting the execution time of memory instruction sequences; records execution samples and calculates dynamic fluctuation coefficients during runtime using a sliding window mechanism; generates a risk score by combining the matching results of multiple cumulative distribution function models with the fluctuation coefficients; identifies abnormal trends through a time integration mechanism; and, after determining potential abnormal behavior, collaboratively adjusts the boundary model of the cumulative distribution function model to achieve adaptive model evolution. This method can effectively identify slowly evolving or boundary-drift attacks, improving detection accuracy and system robustness, and is applicable to various resource-constrained embedded devices or security-critical systems.

Description

Technical Field

[0001] This invention relates to the field of data security detection technology, and specifically to a data security detection method based on memory instruction execution sequence. Background Technology

[0002] A memory instruction execution sequence refers to the set of instructions involving memory operations that a processor executes in a specific order within a computer system. These instructions typically include operations such as load and store. The order of the sequence affects the program's execution result, especially in multithreaded or concurrent environments. Properly designing the memory instruction execution sequence helps ensure data consistency and system stability.

[0003] Existing sliding window CDF deviation detection methods may be susceptible to "stealth evasion" attacks in embedded systems. Attackers can bypass deviation detection based on 1-overlap by constructing small, low-frequency timing perturbations near the legal execution time boundaries, causing the runtime distribution to highly overlap with the training CDF. This "boundary drift" behavior, because it does not significantly deviate from the statistical model, often fails to be detected in time by short window detection, leading to silent failures in critical security scenarios, leakage of control signals or sensitive information, and posing a serious security risk. Summary of the Invention

[0004] The purpose of this invention is to provide a data security detection method based on memory instruction execution sequence to address the shortcomings of the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a data security detection method based on memory instruction execution sequence, comprising: Obtain the execution time of each control flow segment or memory instruction sequence in the embedded system, and construct multiple cumulative distribution functions (CDFs). During system operation, the real-time execution time of the target memory instruction sequence is collected and filled into the sliding window in chronological order; Calculate the dynamic fluctuation coefficient for the execution time series in the current sliding window; The execution time distribution of the current sliding window is matched with multiple CDF models, and the risk score of the current window is calculated by combining the dynamic volatility coefficient. The time integral value (TDSI) of the dynamic fluctuation coefficient is calculated. If the TDSI exceeds a preset threshold, it is determined that there is potential abnormal behavior. For potential anomalous behavior, the CDF boundary model is adjusted in conjunction with risk scores and TDSI.

[0006] Preferably, the CDF includes a core model, a boundary model, and an extrapolation model.

[0007] Preferably, the real-time execution time of the target memory instruction sequence is collected and filled into the sliding window in chronological order, specifically including: The start and end times of the execution of each target memory instruction sequence segment are recorded in real time, and the actual execution time is calculated. Preprocess the collected actual execution time data; The preprocessed execution time data is filled into a fixed-length sliding window in chronological order. The sliding window is dynamically updated using a first-in-first-out mechanism and configured with a weight decay function so that new samples in the window have high weights.

[0008] Preferably, the calculation of the dynamic fluctuation coefficient for the execution time series in the current sliding window specifically includes: Calculate the standardized deviation between each execution time sample and the mean of the model during training within the sliding window; A boundary-sensitive weighting function is introduced for each standardized deviation value, which is calculated based on the density gradient of the sample distribution within the boundary model region; The dynamic fluctuation coefficient is calculated by combining the deviation values ​​of all samples with the boundary weights.

[0009] Preferably, the step of matching the execution time distribution of the current sliding window with multiple CDF models and calculating the risk score of the current window in conjunction with the dynamic volatility coefficient specifically includes: The execution time sample set in the sliding window is fitted and matched with multiple cumulative distribution function models generated during the training phase, and the proportion of window samples falling into the corresponding interval of each model is calculated respectively. Based on the sample matching ratio, different levels of risk weights are assigned to each CDF model to construct a multi-level set of response factors. The risk score for the current window is calculated by jointly evaluating the multi-level response factor set with the dynamic volatility coefficient μ(t) corresponding to the current window.

[0010] Preferably, the obtained risk score R(t) is compared with a gradient standard threshold, which includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold. The risk score R(t) is compared with the first standard threshold and the second standard threshold respectively. If R(t) < first standard threshold: the behavior is judged as safe; if the first standard threshold ≤ R(t) < second standard threshold: the behavior is judged as suspicious and logged; if R(t) ≥ second standard threshold: the behavior is judged as risky and a security interruption or alarm is triggered.

[0011] Preferably, the calculation of the time integral value TDSI of the dynamic fluctuation coefficient specifically includes: continuously recording the dynamic fluctuation coefficient μ(t) corresponding to the sliding window during system operation, and performing a sliding integral on μ(t) over a period of time according to a set time step Δt to calculate the time integral value TDSI(t), which is in the form of: Where T is the duration of the integration time window; k is the time point.

[0012] Preferably, a dynamic threshold θTDSI is set, and the fluctuation gradient of μ(t) during the integration process is combined to determine whether the potential anomaly triggering condition is met: TDSI(t)≥θTDSI or μ(t) shows an upward trend in M ​​consecutive time steps and the fluctuation slope exceeds the set threshold η; if either condition is met, the current behavior is judged as a potential anomaly.

[0013] Preferably, the method of co-adjusting the CDF boundary model based on risk score and TDSI for potential abnormal behavior specifically includes: after detecting potential abnormal behavior, determining the sustainability and deviation trend of the abnormal behavior based on the level of the current risk score and the severity of the corresponding time integral value; adjusting the confidence interval range of the original boundary model according to the determination result, including shrinking or expanding the boundary model; and applying the adjusted boundary model to the matching and classification process of subsequent execution time samples.

[0014] The technical effects and advantages provided by the present invention in the above technical solution are as follows: 1. This invention introduces a dynamic fluctuation coefficient and a time integration mechanism to perform multi-dimensional and temporal deviation detection of memory instruction execution behavior, overcoming the limitations of traditional models based on static thresholds and fixed distributions. Through sliding window monitoring, risk score calculation, trend integral analysis, and adaptive adjustment of the boundary model, the system can promptly identify slowly evolving, boundary drifting, and low-intensity attack behaviors, effectively reducing false positive and false negative rates and significantly improving detection sensitivity and robustness.

[0015] 2. This invention constructs a closed-loop security response mechanism of "detection-evaluation-feedback-adjustment," enabling the distributed model to possess online self-learning and scenario adaptation capabilities, making it particularly suitable for embedded system environments with limited resources and dynamically changing behavior patterns. This method ensures detection accuracy while also considering operational efficiency and scalability, demonstrating significant engineering practical value. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0017] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] For examples, please refer to Figure 1 As shown in this embodiment, a data security detection method based on memory instruction execution sequence includes: Obtain the execution time of each control flow segment or memory instruction sequence in the embedded system, and construct multiple cumulative distribution functions (CDFs). During system operation, the real-time execution time of the target memory instruction sequence is collected and filled into the sliding window in chronological order; Calculate the dynamic fluctuation coefficient for the execution time series in the current sliding window; The execution time distribution of the current sliding window is matched with multiple CDF models, and the risk score of the current window is calculated by combining the dynamic volatility coefficient. The time integral value (TDSI) of the dynamic fluctuation coefficient is calculated. If the TDSI exceeds a preset threshold, it is determined that there is potential abnormal behavior. For potential anomalous behavior, the CDF boundary model is adjusted in conjunction with risk scores and TDSI.

[0020] In a data security detection method based on memory instruction execution sequences according to the present invention, the execution characteristics of control flow segments or memory instruction execution sequences in the target embedded system are first collected and modeled. This step includes the following: First, the running trajectory of the target embedded system during the training phase is acquired, and the execution time information of several typical control flow segments or memory instruction execution sequences (hereinafter referred to as "instruction sequence segments") is extracted. The execution time can be recorded through high-precision hardware timers, performance monitoring units (PMUs), or processor tracing ports within the embedded system to ensure the time accuracy and sequence integrity of the data. The execution time should cover various task paths and calling contexts under normal system operation to ensure the generalization ability of the model.

[0021] Based on the aforementioned execution time sample set, a multi-level cumulative distribution function (CDF) model is constructed using statistical analysis methods to reflect the execution time distribution characteristics under different confidence levels. This invention proposes three types of distribution models, including: The core model (CDF_core) is used to represent the high-confidence time distribution range of instruction sequence segments under normal execution conditions. It typically covers about 90% of the concentrated distribution area in the training samples and represents the most common execution duration feature.

[0022] Boundary Model (CDF_edge): Extends the boundary of the core model to cover 95% of the time distribution in the training samples, allowing a certain degree of boundary drift and fluctuation behavior, forming a tolerance range for normal behavior.

[0023] Extrapolation model (CDF_risk): Further extends the boundary model, usually covering 99% of the sample data during the training period or using extrapolation estimation to reflect the possibility of extreme boundary behavior, but it is not used as an absolutely reliable region, only as a reference for subsequent dynamic risk scoring.

[0024] The aforementioned CDF models can be implemented using nonparametric or semiparametric methods such as kernel density estimation (KDE), empirical distribution function (ECDF), or Gaussian fitting. They can also be simplified by considering the resource conditions of different embedded platforms. The hierarchical division and confidence interval settings among multiple models can be customized according to the real-time response, security level, and fault tolerance requirements of the target system.

[0025] For example, to construct the core model (CDF_core), boundary model (CDF_edge), and extrapolation model (CDF_risk), the kernel density estimation method is used to perform nonparametric modeling on the collected memory instruction execution time samples.

[0026] Specifically, the instruction execution time sample set obtained during the training phase is set as {x1, x2, ..., xn}, where each xi represents the execution time of the corresponding instruction sequence segment in one run, and n is the total number of samples. A Gaussian kernel function is selected. As a kernel function, the bandwidth parameter h can be adaptively determined using the Silverman rule or cross-validation method, and u is the mean.

[0027] kernel density function The expression is: After obtaining the density function, we further integrate f^(x) using numerical integration to construct the corresponding cumulative distribution function: Based on the CDF curve: extract the distribution function. The range falling within the 90% interval is used to define CDF_core; the range truncates to 95% to construct CDF_edge; and the range truncates to 99% or is estimated based on the fitted tail trend to form CDF_risk.

[0028] In this invention, the system needs to continuously acquire the real-time execution time of the memory instruction sequence during the running phase and manage it in a structured manner to support subsequent deviation detection and risk assessment.

[0029] Specifically, the data acquisition and population steps during system operation include the following: In the processor architecture of embedded systems, existing hardware auxiliary modules, such as processor tracing modules, performance monitoring units (PMUs), or high-resolution timers, can be used to accurately capture the execution time of target memory instruction sequence segments.

[0030] First, the system identifies the start and end positions of key control flow segments or instruction sequence segments during runtime based on pre-configured key control flow segment or instruction sequence segment identifiers. When the processor execution flow hits the entry point of the instruction segment, the system immediately starts the time recording process and records a timestamp when exiting the segment.

[0031] The difference between the two timestamps constitutes the actual execution time of the execution. This process does not require instrumentation or interruption of the main program logic, and has a very low impact on the real-time performance of the embedded system. It is suitable for deployment in high-security scenarios where interrupt controllers, DMA engines, or main control processes are restricted.

[0032] In actual operation, factors such as external interruptions, thread switching, resource preemption, and cache invalidation may cause non-behavioral fluctuations in execution time. These fluctuations do not reflect the program's inherent behavioral characteristics, and directly incorporating them into the model will introduce bias or even misjudgment.

[0033] To avoid this problem, this invention introduces an abnormal offset detection mechanism, which preprocesses the collected execution time data, as follows: The system constructs the expected execution time range for each instruction sequence segment based on historical training samples, including the expected mean, standard deviation, minimum and maximum values. Newly collected samples during operation If the following conditions are met: If a value is found to be outlier, it is considered an abnormal sample and removed. Here, μ is the mean, σ is the standard deviation, and k is an empirical setting (e.g., k=2.5). Optionally, scheduler flags (such as context switching flags, system call insertion flags, etc.) can be introduced to mark the context association of the execution cycle, further eliminating disturbed samples.

[0034] Through the above mechanism, the retained execution time samples can more accurately reflect the inherent behavioral characteristics of the program, improving the accuracy and robustness of subsequent model judgments.

[0035] After removing outlier samples, the system fills a fixed-length sliding window with compliant execution duration data to support real-time modeling and analysis of short-term behavioral characteristics. This window structure has the following characteristics: The sliding window inserts the latest collected execution time data in chronological order, and old data is eliminated one by one after the window capacity reaches its limit, ensuring that the window always reflects the program behavior status in the most recent period.

[0036] The window is organized using a first-in-first-out (FIFO) structure. The current window size is N. Each time new data is added, the earliest inserted data is automatically removed, realizing a continuous and dynamic sample update process without the need for manual index maintenance.

[0037] To enhance the influence of "new samples" within the window while avoiding inertia in the model's judgment caused by "old samples," this invention introduces a position-weight-based decay mechanism. Each data sample xi in the window is assigned a weight wi corresponding to its position i within the window, which can be calculated in an exponential decay form: Where α∈(0,1) is the weight decay factor, and N is the window capacity. This strategy ensures that the most recently sampled data (i.e., i=N) has the highest weight, guaranteeing that the detection model responds quickly to behavioral trends.

[0038] In this invention, in order to achieve real-time dynamic analysis of execution behavior and further improve the detection capability of attack types such as hidden anomalies, perturbation attacks, and boundary drift, the system introduces a method for calculating the dynamic fluctuation coefficient μ(t) based on the sliding window mechanism.

[0039] This volatility coefficient is used to comprehensively measure the overall deviation of the behavior executed in the current sliding window from the statistical model during training. It places particular emphasis on the sensitivity to "boundary region samples" to improve the detection algorithm's ability to respond to bypassing behaviors. Its calculation process mainly includes the following three steps: standardization deviation calculation, boundary-sensitive weight modeling, and weighted comprehensive evaluation.

[0040] In the current sliding window, each sample represents the execution time of a specific memory instruction sequence in the actual runtime environment, denoted as xi, where i∈[1,N] and N is the window capacity.

[0041] To achieve comparability between different samples and to accommodate potential fluctuations in system behavior under different load conditions, the standardized deviation of each sample relative to the training model is first calculated.

[0042] Considering that attackers often do not directly break through the limits of the training model, but rather slowly infiltrate to the edge of the model to bypass the detection mechanism, this invention further introduces a boundary-sensitive weight function B(xi) to improve the model's response strength to "critical zone samples".

[0043] The design philosophy of the boundary-sensitive weight function is as follows: The cumulative distribution function (CDF) model built during the training period is divided into a core region (CDF_core), a boundary region (CDF_edge), and an extrapolation region (CDF_risk). Determine the distribution location of the current sample xi. If it is located in the center of the core region, its weight is low; if it is near the edge of the boundary region, its weight is significantly increased. The weighting function can be in the form of an exponential, linear gradient, or density gradient-based adaptive function, for example: Where: P(xi) is the CDF cumulative probability value corresponding to the sample; γ is the weight amplification factor, used to adjust the boundary sensitivity; the weight increases nonlinearly as the sample approaches the training boundary.

[0044] This mechanism allows samples located at the edge of the distribution within the sliding window to have a greater influence in subsequent calculations, thereby improving the system's ability to detect gradual attack patterns (such as slow injection and slow overflow).

[0045] Combining the above deviation values ​​and boundary-sensitive weights, a weighted average is calculated for all execution time samples within the sliding window to obtain the dynamic fluctuation coefficient μ(t) corresponding to the current time point, which is defined as follows: In the formula μ(t) represents the standardized deviation of the i-th sample; the larger the value of μ(t), the more samples deviating from the training model exist within the current sliding window, and the closer these samples are to the model boundary. Compared to simple mean or standard deviation, this metric provides a more discriminative continuous dynamic response in behavior detection.

[0046] In this invention, the system continuously monitors the execution time changes of the target instruction sequence through a sliding window mechanism. After acquiring the execution time sample set within the current window and calculating its dynamic fluctuation coefficient μ(t), to further accurately determine whether the current behavior has an abnormal trend, this invention proposes a risk scoring calculation method that combines multi-level CDF model distribution matching with dynamic parameter fusion. This method achieves continuous quantitative expression of complex abnormal behavior through hierarchical perception of sample distribution characteristics, probability proportion analysis, and dynamic factor adjustment.

[0047] To enhance the system's ability to identify perturbation-type, boundary-type, or incremental attacks, this invention constructs a multi-level cumulative distribution function (CDF) model during the training phase, including: The core model CDF_core covers 90% of the main dense distribution region in the training samples; Boundary model CDF_edge: Covers 95% of samples, mainly capturing boundary floating behavior; The extrapolation model CDF_risk covers 99% of the samples or uses tail estimation to predict extreme cases.

[0048] During system operation, the system fits and matches the execution time sample set {x1,x2,...,xn} in the sliding window with the above models to determine the distribution interval of each sample. The specific determination logic is as follows: If xi∈CDFcore, then the sample is considered completely normal; If xi∈CDFedge / CDFcorex, then the sample is located in the model boundary region; If xi∈CDFrisk / CDFedge, then the sample is in a high-risk area; If xi∉CDFrisk, it is considered an out-of-bounds abnormal sample, which can be handled separately or a high-level risk response can be triggered directly.

[0049] The system counts the number of samples in each category and calculates its proportion, defined as follows: ;in: , , These represent the number of samples falling into each CDF model region; N is the total number of samples in the sliding window.

[0050] This distribution proportion constitutes the distribution feature vector of the current behavioral state, reflecting the dynamic distribution pattern of the current system behavior among the three regions of "normal - boundary - risk".

[0051] Considering that the impact of samples from different regions on system security varies fundamentally, this invention introduces a multi-level response factor weighting mechanism to construct the distribution risk expression structure of the current sliding window.

[0052] Assign risk weights to each type of region sample: The core area sample weight wcore=0, and does not contribute to the risk score; The sample weight w1 in the boundary region is used to represent the mild to moderate risk generated by the critical state. The extrapolation sample weight w2 is used to represent high-risk behaviors that significantly deviate from the training distribution, and usually satisfies w2>w1.

[0053] The response factor can be expressed as: In practical deployment, the weight values ​​can be flexibly adjusted according to the system type. For example, in a security-sensitive embedded system, w1=0.6 and w2=1.0 can be set; while in an industrial fault-tolerant system, the sensitivity can be appropriately reduced. In this way, the system can form a distributed response structure with gradient risk perception capabilities, supporting multi-level security policy invocation (such as low-risk prompts, medium-risk recording, and high-risk blocking).

[0054] To introduce time dynamics into the aforementioned distributed response factor, this invention nonlinearly fuses the calculated dynamic volatility coefficient μ(t) with the response factor Fdist to construct a risk scoring function R(t), defined as follows: ; The risk score R(t) is a core criterion for the system to determine whether it has entered an abnormal state. For example, the obtained risk score R(t) is compared with a gradient standard threshold, which includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold. The risk score R(t) is then compared with both the first and second standard thresholds. If R(t) < the first standard threshold: the behavior is judged as safe; If the first threshold ≤ R(t) < the second threshold: the behavior is judged as suspicious and logged; If R(t) ≥ the second standard threshold: the behavior is judged as risky, triggering a security interruption or alarm.

[0055] The first and second standard thresholds can be dynamically set based on the system application scenario and further weighted by TDSI (Torque Integral), and the first standard threshold is less than the second standard threshold.

[0056] In this invention, to enhance the system's ability to identify progressive, low-intensity, and time-delayed attack behaviors and further improve the continuous monitoring effect of dynamic abnormal trends, a time integration mechanism based on the dynamic fluctuation coefficient μ(t) is introduced. Combined with the fluctuation gradient change trend, potential abnormal behaviors are comprehensively judged.

[0057] During system operation, for each sliding window period (e.g., every 10ms) of the target memory instruction sequence, the system calculates the dynamic fluctuation coefficient μ(t) corresponding to the current window. This coefficient measures the overall deviation of the execution behavior within the current window relative to the training model. This value is time-continuous, reflecting the intensity of the deviation in behavioral trend over time.

[0058] All μ(t) values ​​will be stored sequentially according to the set sampling frequency (i.e., time step Δt) and used as input for subsequent integration and trend analysis modules.

[0059] To identify the "cumulative deviation" characteristic of anomalous behavior over time, this invention introduces the time integral value TDSI(t) to evaluate the cumulative shift of the fluctuation coefficient μ(t) within a fixed time window. Its mathematical expression is: Where T is the duration of the integration time window; k is a time point, and μ(k) is the fluctuation coefficient corresponding to the k-th time point; Δt is the sampling time interval between each time point, which can be in milliseconds (ms) or seconds (s); the integration form can be weighted summation or moving weighted average to adapt to the resource constraints of different system platforms. TDSI(t) represents the total amount or intensity accumulation of the system behavior deviating from the training model over the past T time period. Compared to μ(t) at a single moment, TDSI better reflects the trend risk characteristics of behavior, and is especially suitable for detecting persistent, slowly penetrating attack behaviors.

[0060] To achieve real-time judgment, the system presets a dynamic time integration threshold θTDSI to measure the critical level of the risk score. This threshold can be dynamically set according to the following parameters: System operating modes (safe mode, debug mode, normal mode); TDSI distribution under historical normal conditions; maximum drift tolerance of instruction sequences during the training phase.

[0061] Meanwhile, to prevent sudden outliers from interfering with the integral judgment, the system further introduces a gradient monitoring mechanism for the fluctuation coefficient. If, over the past M consecutive time steps (e.g., M=5), μ(t) exhibits a monotonically increasing trend, and its average slope satisfies: Where η is the set fluctuation slope threshold, reflecting the "steepness" of μ(t) growth.

[0062] This detection mechanism is used to detect rapid cumulative growth of μ(t). Even if TDSI has not exceeded the critical value, the system can provide early warning through abnormal gradient detection, further enhancing the sensitivity of the system.

[0063] The system uses the combined fluctuation gradients of TDSI(t) and μ(t) as the anomaly triggering condition. The specific judgment logic is as follows: If TDSI(t)≥θ: it is judged as an integral anomaly, indicating that the current system behavior has been deviating from the training model for a period of time, and the cumulative risk has exceeded the safety tolerance. Alternatively, if μ(t) shows an upward trend over M consecutive time steps and the slope of the fluctuation exceeds the threshold η, it is judged as an abnormal trend, indicating that the system behavior is rapidly deviating and has a high-risk evolution trend.

[0064] If any of the above conditions are met, the current execution behavior will be judged as a potential abnormal behavior.

[0065] In this invention, in order to effectively deal with potential abnormal behaviors that may occur during system operation and improve the model’s adaptability to polymorphic attacks, slow-change attacks and boundary drift attacks, the system not only performs risk scoring and time integration judgment, but also designs an adaptive mechanism based on risk trend dynamic adjustment of the cumulative distribution function (CDF) boundary model.

[0066] When the risk score calculated by the system detection module based on runtime data reaches a preset threshold, or the sliding time integral value continues to increase and exceeds the warning line, the system determines the current behavior as a potential anomaly. Based on this, to avoid overreacting to occasional disturbances or short-term errors, this invention proposes a joint risk trend judgment mechanism, which comprehensively judges based on the following two dimensions: Risk rating level: Based on the relative position of the risk rating in the historical distribution, the system divides it into three levels: low, medium and high. High risk level means that the behavior deviates significantly from the training model within the current window.

[0067] Severity of Time Integral Value: The system compares the current time integral value with the integral distribution under normal operating conditions to determine whether a long-term, persistent deviation trend has formed. If the integral value remains high for a long period, it indicates that the system has entered a persistent abnormal state.

[0068] By jointly considering the "immediate deviation magnitude" and "cumulative deviation trend" of the current behavior, the system can more accurately determine the sustainability and structural risk level of the current potential abnormal behavior, avoid over-responding to noise or edge values, and also capture the gradually evolving attack path in a timely manner.

[0069] Once the system confirms the existence of a structurally abnormal trend, it enters the model adaptation phase. The boundary adjustment strategy of the CDF model, based on the results of the joint risk assessment, performs the following operations: Boundary Expansion (Enhanced Tolerance): If the system detects multiple low to medium risk scores, but the time integral value remains on the edge of the warning range, it indicates a slight deviation in behavior that has not evolved into an aggressive trend. In this case, the system appropriately expands the confidence interval of the boundary model. For example, a boundary model that originally covered 95% of the samples can be expanded to cover approximately 97% of the samples to accommodate new normal fluctuations and reduce the probability of false alarms.

[0070] Boundary contraction (sensitivity enhancement): If the risk score repeatedly reaches a high level, and the time integral value rises sharply, or even stabilizes in the high-risk area, the system will consider that the trained model can no longer adequately constrain the current behavioral characteristics. In this case, the system compresses the confidence interval of the boundary model, appropriately tightening the judgment range, allowing subsequent detection modules to more quickly identify new deviation behaviors. This operation is often used to defend against boundary bypass attacks.

[0071] Keep the boundaries unchanged: If the current abnormal trend is not yet clear, the system will temporarily keep the boundary model unchanged and enter the observation state. Decisions will be made after more window samples have been accumulated, so as to avoid model oscillations caused by frequent adjustments.

[0072] The above adjustments are not only applied to the boundary model (CDF_edge), but can also be applied to the extrapolation model (CDF_risk) as appropriate, to ensure that the entire distribution model has good coverage and discrimination capabilities for new behavioral features.

[0073] After updating the boundary model, the system applies the new CDF model to the matching process of subsequent execution time samples and recalculates its distribution in each model region. This process does not require a complete replacement of the old model, but rather employs a smooth transition mechanism, allowing the new and old models to work together within a set window period to gradually complete the model evolution.

[0074] Under the new distribution model, the system can achieve the following effects: This prevents normal fluctuations from being misidentified as risks. This allows attacks to be classified as "boundary samples" or "risk samples" at an earlier point in time. Improve the adaptability and response speed of the detection system to long-term evolving attacks.

[0075] In addition, to prevent the model from shrinking or expanding excessively and affecting the detection stability, the system can set a lower limit for the boundary adjustment frequency to ensure that there is a certain cooling time between each boundary adjustment and maintain the model convergence.

[0076] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A data security detection method based on memory instruction execution sequence, characterized in that: include: Obtain the execution time of each control flow segment or memory instruction sequence in the embedded system, and construct multiple cumulative distribution functions (CDFs). During system operation, the real-time execution time of the target memory instruction sequence is collected and filled into the sliding window in chronological order; Calculate the dynamic fluctuation coefficient for the execution time series in the current sliding window; The execution time distribution of the current sliding window is matched with multiple CDF models, and the risk score of the current window is calculated by combining the dynamic volatility coefficient. The time integral value (TDSI) of the dynamic fluctuation coefficient is calculated. If the TDSI exceeds a preset threshold, it is determined that there is potential abnormal behavior. For potential anomalous behavior, the CDF boundary model is adjusted in conjunction with risk scores and TDSI.

2. The data security detection method based on memory instruction execution sequence according to claim 1, characterized in that: The CDF includes a core model, a boundary model, and an extrapolation model.

3. The data security detection method based on memory instruction execution sequence according to claim 1, characterized in that: The process of acquiring the real-time execution time of the target memory instruction sequence and filling it into the sliding window in chronological order includes: The start and end times of the execution of each target memory instruction sequence segment are recorded in real time, and the actual execution time is calculated. Preprocess the collected actual execution time data; The preprocessed execution time data is filled into a fixed-length sliding window in chronological order. The sliding window is dynamically updated using a first-in-first-out mechanism and configured with a weight decay function so that new samples in the window have high weights.

4. The data security detection method based on memory instruction execution sequence according to claim 3, characterized in that: The calculation of the dynamic fluctuation coefficient for the execution time series in the current sliding window specifically includes: Calculate the standardized deviation between each execution time sample and the mean of the model during training within the sliding window; A boundary-sensitive weighting function is introduced for each standardized deviation value, which is calculated based on the density gradient of the sample distribution within the boundary model region; The dynamic fluctuation coefficient is calculated by combining the deviation values ​​of all samples with the boundary weights.

5. The data security detection method based on memory instruction execution sequence according to claim 1, characterized in that: The process of matching the execution time distribution of the current sliding window with multiple CDF models and calculating the risk score of the current window using dynamic volatility coefficients specifically includes: The execution time sample set in the sliding window is fitted and matched with multiple cumulative distribution function models generated during the training phase, and the proportion of window samples falling into the corresponding interval of each model is calculated respectively. Based on the sample matching ratio, different levels of risk weights are assigned to each CDF model to construct a multi-level response factor set. The risk score for the current window is calculated by jointly evaluating the multi-level response factor set with the dynamic volatility coefficient μ(t) corresponding to the current window.

6. The data security detection method based on memory instruction execution sequence according to claim 5, characterized in that: The obtained risk score R(t) is compared with the gradient standard threshold, which includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold. The risk score R(t) is compared with the first standard threshold and the second standard threshold respectively. If R(t) < first standard threshold: the behavior is judged as safe; if the first standard threshold ≤ R(t) < second standard threshold: the behavior is judged as suspicious and logged; if R(t) ≥ second standard threshold: the behavior is judged as risky and a security interruption or alarm is triggered.

7. The data security detection method based on memory instruction execution sequence according to claim 1, characterized in that: The calculation of the time integral value (TDSI) of the dynamic fluctuation coefficient specifically includes: continuously recording the dynamic fluctuation coefficient μ(t) corresponding to the sliding window during system operation, and performing a sliding integral on μ(t) over a period of time according to a set time step Δt to calculate the time integral value TDSI(t), which is in the form of: Where T is the duration of the integration time window; k is the time point.

8. The data security detection method based on memory instruction execution sequence according to claim 7, characterized in that: Set a dynamic threshold θTDSI, and combine it with the fluctuation gradient of μ(t) during the integration process to determine whether the potential anomaly triggering condition is met: TDSI(t)≥θTDSI or μ(t) shows an upward trend in M ​​consecutive time steps and the fluctuation slope exceeds the set threshold η; if either condition is met, the current behavior is judged as a potential anomaly.

9. A data security detection method based on memory instruction execution sequence according to claim 8, characterized in that: The aforementioned adjustment of the CDF boundary model based on risk score and TDSI for potential abnormal behavior specifically includes: after detecting potential abnormal behavior, determining the sustainability and deviation trend of the abnormal behavior based on the level of the current risk score and the severity of the corresponding time integral value; adjusting the confidence interval range of the original boundary model according to the determination result, including shrinking or expanding the boundary model; and applying the adjusted boundary model to the matching and classification process of subsequent execution time samples.

Images