A Real-Time Detection Method and System for Abnormal Behavior Based on Micro-Execution State Sequences

Abstract

This invention discloses a real-time detection method and system for abnormal behavior based on micro-execution state sequences, relating to the field of computer-related technologies. The method includes: offline analysis of the binary code of embedded firmware to generate a legitimate fingerprint database of micro-execution state sequences; non-intrusive sniffing of the CPU's instruction bus and real-time classification of executed instructions via a hardware monitoring unit; calculation of real-time fingerprints based on instruction type sequences; extraction of legitimate fingerprints from the legitimate fingerprint database; synchronization with a fingerprint comparator for comparison; and generation of fingerprint comparison results; and triggering an abnormal response unit based on the fingerprint comparison results. This invention solves the technical problems in existing technologies where low-overhead, fine-grained, and broad-spectrum defense capabilities for embedded firmware runtime behavior monitoring cannot be achieved in resource-constrained environments, resulting in poor real-time detection performance, sensitivity, and protection coverage. It achieves the technical effect of improving the real-time performance and sensitivity of embedded firmware runtime integrity detection, as well as the protection coverage and system energy efficiency.

Description

Technical Field

[0001] This invention relates to the field of computer-related technologies, specifically to a method and system for real-time detection of abnormal behavior based on micro-execution state sequences. Background Technology

[0002] With the rapid development of the Internet of Things (IoT) and edge computing, embedded systems have become a key component of modern information technology infrastructure, widely used in industrial automation, intelligent transportation, medical devices, smart homes, and wearable devices. Their security is directly related to the functional integrity, data confidentiality, and physical security of the system. However, embedded devices are typically deployed in physically uncontrollable environments and are limited by computing power, storage capacity, and power consumption budgets, making it difficult to deploy traditional software security mechanisms. Consequently, they have become high-value targets for cyberattacks. Currently, embedded firmware security protection technologies are mainly divided into static protection mechanisms and dynamic runtime monitoring mechanisms. Static protection mechanisms mainly include memory isolation technology and control flow integrity (CFI) technology. Hardware isolation, such as ARM TrustZone for Cortex-M, divides the "secure world" and the "unsecure world" to achieve resource access control and protect critical assets from external attacks, but it cannot defend against "in-domain attacks," that is, attackers launch attacks by exploiting vulnerabilities within the secure world, nor can it monitor the program's runtime behavior logic. Control flow integrity (CFI) technology, on the other hand, statically analyzes the program's control flow graph and verifies at runtime whether the indirect jump target is within the legal address range. Although it can effectively resist control flow hijacking attacks, its implementation relies on complex static analysis tools and a large amount of hardware storage resources, and it can only protect the control flow, unable to detect non-control flow attacks that tamper with the program logic without changing the control flow. Dynamic runtime monitoring technology monitors program execution behavior in real time at the hardware level to detect abnormal operations. It mainly relies on methods such as instruction counting, memory access patterns, or abnormal opcode detection. However, it generally has limitations. It can only monitor a few key events (such as system calls and memory out-of-bounds access) and is difficult to cover fine-grained instruction sequence anomalies. It requires storing a large amount of legal path information or state machine models, resulting in high hardware overhead. Rule-based or pattern-based detection is difficult to adapt to legal changes in program execution, leading to a high false alarm rate. The low coupling between the monitoring unit and the CPU results in high response latency.

[0003] Therefore, current technologies suffer from limitations in achieving low-overhead, fine-grained, and broad-spectrum defense capabilities for embedded firmware runtime behavior monitoring in resource-constrained environments, resulting in poor real-time detection, sensitivity, and protection coverage. Summary of the Invention

[0004] This application provides a real-time detection method and system for abnormal behavior based on micro-execution state sequences. This solves the technical problem in the prior art that it is impossible to achieve low-overhead, fine-grained and broad-spectrum defense capabilities for embedded firmware runtime behavior monitoring in resource-constrained environments, resulting in poor detection real-time performance and sensitivity, and poor protection coverage. It achieves the technical effect of improving the real-time performance and sensitivity of embedded firmware runtime integrity detection, the protection coverage, and the system energy efficiency ratio.

[0005] This application provides a real-time detection method for abnormal behavior based on micro-execution state sequences. The method includes: offline analysis of the binary code of embedded firmware to generate a valid fingerprint database of micro-execution state sequences, wherein the valid fingerprint database is stored in the non-volatile memory of the embedded firmware; when the embedded firmware is running, a hardware monitoring unit non-intrusively sniffs the CPU instruction bus and performs real-time classification of the executed instructions to obtain an instruction type sequence; a real-time fingerprint is calculated based on the instruction type sequence; valid fingerprints are extracted based on the valid fingerprint database; the real-time fingerprint and the valid fingerprints are synchronized to a fingerprint comparator for comparison to generate a fingerprint comparison result; and an abnormal response unit is triggered based on the fingerprint comparison result.

[0006] In a possible implementation, the binary code of the embedded firmware is analyzed offline to generate a legitimate fingerprint library of micro-execution state sequences. This legitimate fingerprint library is stored in the non-volatile memory of the embedded firmware. The method includes: acquiring the binary code file of the embedded firmware; performing static analysis on the binary code file to identify executable code regions; traversing the executable code regions to parse instructions and obtain a code instruction stream; simulating the classification of the code instruction stream using preset instruction type classification rules to generate a simulated instruction type sequence; performing fingerprint calculation according to the simulated instruction type sequence using a hardware monitoring unit to obtain a legitimate fingerprint set; matching the legitimate fingerprint set with the code instruction stream to determine multiple code block identification information, where the multiple code block identification information corresponds to the legitimate fingerprint set; associating and storing the legitimate fingerprint set with the multiple code block identification information to construct a legitimate fingerprint library; and burning the legitimate fingerprint library into the non-volatile memory of the embedded firmware.

[0007] In a possible implementation, the real-time abnormal behavior detection method based on micro-execution state sequence includes: the legitimate fingerprint database and the hardware monitoring unit working together, wherein the hardware monitoring unit queries the legitimate fingerprint database based on the execution address during runtime to perform real-time fingerprint comparison and abnormal detection.

[0008] In a possible implementation, when the embedded firmware is running, the CPU instruction bus is non-intrusively sniffed by a hardware monitoring unit, and the executed instructions are classified in real time to obtain an instruction type sequence. The method includes: when the embedded firmware is running, the instruction sniffing module of the hardware monitoring unit non-intrusively listens to the CPU instruction bus and captures instruction codes; based on the instruction codes, real-time decoding is performed to generate decoding results; the executed instructions are mapped to a finite set of instruction types according to the decoding results to determine the target instruction type; the target instruction types are sorted according to the execution timing to generate an instruction type stream; the execution state is analyzed based on the instruction type stream to generate a micro-execution state sequence, and the micro-execution state sequence is added to the instruction type sequence.

[0009] In a possible implementation, the execution state analysis based on the instruction type stream is used to generate a micro-execution state sequence. The method includes: storing the instruction type stream into an N-level shift register using an N-level shift register to determine M new instruction type codes; shifting the M new instruction type codes into the N-level shift register and shifting out the M instruction type codes to determine N type codes; and storing and arranging the N type codes in parallel to construct the micro-execution state sequence.

[0010] In a possible implementation, the method for calculating a real-time fingerprint based on the instruction type sequence includes: taking the N type codes of the N-level shift register as input and inputting them to a lightweight hash calculation circuit; introducing a CPU clock cycle, and performing a hash operation on the N type codes through the hash calculation circuit based on the CPU clock cycle to generate the real-time fingerprint.

[0011] In a possible implementation, a legitimate fingerprint is extracted based on the legitimate fingerprint database, and the real-time fingerprint is synchronized with the legitimate fingerprint to a fingerprint comparator for comparison to generate a fingerprint comparison result. The method includes: capturing the CPU's program counter value and using the program counter value as a query address; decoding the query address and indexing it based on the address decoding result to generate a target access address; traversing the legitimate fingerprint database based on the target access address to read and extract legitimate fingerprints; and performing a fingerprint logic synchronization comparison between the real-time fingerprint and the legitimate fingerprint input to the fingerprint comparator to generate a fingerprint comparison result.

[0012] In a possible implementation, the fingerprint logical synchronous comparison method further includes: calculating the Hamming distance value between the real-time fingerprint and the legitimate fingerprint through the fingerprint comparator; setting a Hamming distance threshold, and determining a mismatch and generating a mismatch signal if and only if the Hamming distance value is greater than the Hamming distance threshold; and adding the mismatch signal to the fingerprint comparison result.

[0013] In a possible implementation, the method of triggering an anomaly response unit based on the fingerprint comparison result includes: generating an anomaly trigger signal when the fingerprint comparison result contains a mismatch signal; latching the mismatch signal through the anomaly trigger signal, latching the CPU's program counter value, the real-time fingerprint, and the legitimate fingerprint, and setting a security policy; and executing a hardware-level security response to block the anomaly according to the security policy.

[0014] This application also provides a real-time abnormal behavior detection system based on micro-execution state sequences. The system includes: a legitimate fingerprint database generation module, used for offline analysis of the binary code of embedded firmware to generate a legitimate fingerprint database of micro-execution state sequences, the legitimate fingerprint database being stored in the non-volatile memory of the embedded firmware; an execution instruction classification module, used for non-intrusive sniffing of the CPU's instruction bus and real-time classification of execution instructions by a hardware monitoring unit when the embedded firmware is running, to obtain an instruction type sequence; a fingerprint comparison result generation module, used for calculating a real-time fingerprint based on the instruction type sequence, extracting legitimate fingerprints based on the legitimate fingerprint database, synchronizing the real-time fingerprints and the legitimate fingerprints to a fingerprint comparator for comparison, and generating a fingerprint comparison result; and an abnormal response unit triggering module, used for triggering an abnormal response unit based on the fingerprint comparison result.

[0015] This application proposes a real-time abnormal behavior detection method and system based on micro-execution state sequences. The method involves offline analysis of the binary code of embedded firmware to generate a legitimate fingerprint database of micro-execution state sequences. A hardware monitoring unit non-intrusively sniffs the CPU's instruction bus and performs real-time classification of executed instructions. Real-time fingerprints are calculated based on instruction type sequences, and legitimate fingerprints are extracted from the legitimate fingerprint database. These fingerprints are then synchronized to a fingerprint comparator for comparison, generating fingerprint comparison results. An abnormal response unit is triggered based on the fingerprint comparison results. This addresses the technical problem in existing technologies where low-overhead, fine-grained, and broad-spectrum defense capabilities for embedded firmware runtime behavior monitoring in resource-constrained environments are impossible, resulting in poor real-time detection performance, sensitivity, and protection coverage. The method improves the real-time performance and sensitivity of embedded firmware runtime integrity detection, as well as the protection coverage and system energy efficiency. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings of the embodiments of this disclosure will be briefly described below. Flowcharts are used in this application to illustrate the operations performed by the system according to the embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed precisely in sequence. Instead, various steps can be processed in reverse order or simultaneously as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from these processes.

[0017] Figure 1 This is a schematic diagram of the real-time detection method for abnormal behavior based on micro-execution state sequences provided in the embodiments of this application.

[0018] Figure 2 A schematic diagram of the structure of a real-time abnormal behavior detection system based on micro-execution state sequence provided in this application embodiment.

[0019] Explanation of reference numerals in the attached diagram: 10 for generating a legitimate fingerprint database, 20 for classifying execution instructions, 30 for generating fingerprint comparison results, and 40 for triggering an abnormal response unit. Detailed Implementation

[0020] To further illustrate the technical means and effects adopted by the present invention in order to achieve the intended purpose, the following detailed description is provided in conjunction with the accompanying drawings and preferred embodiments, based on the specific implementation methods, structures, features and effects of the present invention.

[0021] This application provides a method for real-time detection of abnormal behavior based on micro-execution state sequences, such as... Figure 1 As shown, the method includes: Step S100: Analyze the binary code of the embedded firmware offline to generate a valid fingerprint database of micro-execution state sequences. The valid fingerprint database is stored in the non-volatile memory of the embedded firmware.

[0022] Step S100 further includes: acquiring the binary code file of the embedded firmware; performing static analysis on the binary code file to identify executable code regions; traversing the executable code regions to parse instructions and obtain code instruction streams; performing simulated classification of the code instruction streams according to preset instruction type classification rules to generate simulated instruction type sequences; performing fingerprint calculations according to the simulated instruction type sequences through a hardware monitoring unit to obtain a set of legitimate fingerprints; matching the set of legitimate fingerprints with the code instruction streams to determine multiple code block identification information, wherein the multiple code block identification information corresponds to the set of legitimate fingerprints; associating and storing the set of legitimate fingerprints with the multiple code block identification information to construct a legitimate fingerprint library; and burning the legitimate fingerprint library into the non-volatile memory of the embedded firmware.

[0023] Preferably, an offline analysis tool is run on a computer to load the embedded firmware binary code file to be protected, such as a .bin or .elf file, and performs static analysis on it to analyze the file's format and structure, determine the part of the file that contains machine instructions, such as the .text segment or code segment, and then identify the executable code area and data configuration information; traverse the executable code area to parse instructions, and disassemble or decode the binary code according to the instruction set architecture of the target CPU, such as ARM Thumb, to simulate the code instruction flow; preset instruction type classification rules, for example, mapping instructions to a limited number of types such as ALU, MEM_LOAD, BRANCH, etc., and then simulate classifying the code instruction flow according to the instruction type classification rules, converting it into a sequence composed of type labels, and determining the instruction type simulation sequence.

[0024] Preferably, fingerprint calculation is performed by a hardware monitoring unit simulating the sequence of instructions. This hardware monitoring unit is a component that monitors the system hardware. It establishes an N-level "sliding window" (shift register model) and hash calculation algorithm (such as CRC32) identical to those in the hardware in memory. Specifically, the simulated sequence of instructions is input sequentially into the simulated sliding window. Each time the window slides, the hash calculation algorithm calculates the hash value of the N type values ​​within the current window. The calculated valid fingerprints constitute a valid fingerprint set. Then, the valid fingerprint set is matched against the code instruction stream. That is, when the simulated window slides to a certain position (e.g., corresponding to the 100th instruction in the original program) and a valid fingerprint is calculated, this valid fingerprint is bound to the position information to determine multiple code block identifiers. These code block identifiers may be precise instruction addresses, entry addresses of basic blocks, or starting addresses of fixed-size code blocks. These multiple code block identifiers correspond to the valid fingerprint set. For example, at address A, the fingerprint that should be generated during normal program execution is F. Then, the legitimate fingerprint set is associated with and stored with multiple code block identification information to build a legitimate fingerprint library. This allows the hardware to quickly find the corresponding legitimate fingerprint based on the current CPU address during runtime. The legitimate fingerprint library data file, along with the application firmware itself, is written to a specified location in the Flash memory of the target embedded device. During runtime, the hardware monitoring unit reads the data from this fixed location for comparison, thereby ensuring extremely low runtime overhead.

[0025] Furthermore, step S100 also includes the legitimate fingerprint database working in conjunction with the hardware monitoring unit, wherein the hardware monitoring unit queries the legitimate fingerprint database based on the execution address during runtime to perform real-time fingerprint comparison and anomaly detection.

[0026] Preferably, the fingerprint database is generated offline and burned into a specific, hardware-known address space in the device memory, such as starting from Flash address 0x08010000. The hardware monitoring unit determines the physical address for reading fingerprint database data by fixing the address mapping during chip design or by using a configurable base address register. During runtime, the hardware monitoring unit queries the legitimate fingerprint database based on the execution address to perform real-time fingerprint comparison and anomaly detection. The execution address is the CPU's program counter (PC) value, which points to the address in memory of the currently executing instruction. The corresponding legitimate fingerprint is determined based on this address, and the legitimate fingerprint is compared with the current MSS fingerprint calculated in real time by the unit to a digital comparator. If the two match or are within the Hamming distance tolerance range, the current instruction sequence is determined to be normal. If they do not match, an anomaly response is immediately triggered for anomaly detection.

[0027] Step S200: When the embedded firmware is running, the hardware monitoring unit non-intrusively sniffs the CPU's instruction bus and classifies the executed instructions in real time to obtain the instruction type sequence.

[0028] Step S200 further includes, during the runtime of the embedded firmware, non-intrusive monitoring of the CPU's instruction bus by the instruction sniffing module of the hardware monitoring unit to capture instruction codes; real-time decoding based on the instruction codes to generate decoding results; mapping the execution instructions to a finite set of instruction types according to the decoding results to determine the target instruction type; sorting the target instruction types according to the execution timing to generate an instruction type stream; performing execution state analysis based on the instruction type stream to generate a micro-execution state sequence; and adding the micro-execution state sequence to the instruction type sequence.

[0029] Preferably, the input of the hardware monitoring unit is physically connected to the instruction bus between the CPU core and the instruction cache (I-Cache) or memory controller. When the embedded firmware runs, the instruction sniffing module of the hardware monitoring unit performs non-intrusive monitoring of the CPU's instruction bus. Specifically, the instruction sniffing module only reads electrical signals, without affecting data transmission on the bus, and the CPU's instruction fetching and execution processes are completely unaffected. The additional capacitive load from monitoring is minimal and negligible. When the CPU reads an instruction from memory (e.g., 32-bit machine code 0xE1A02001), the binary data is transmitted on the instruction bus. The sniffing module of the control unit samples the bus in each clock cycle to capture the complete original instruction code; the decoder performs real-time decoding on the highest bits of the instruction opcode to generate the decoding result. In the ARMThumb-2 instruction set, the highest bits are sufficient to distinguish the major categories of instructions. For example, the decoder logic may be defined as follows: if Opcode[15:12]=0100, it is classified as an ALU data processing instruction; if Opcode[15:12]=1000, it is classified as a MEM_STORE storage instruction. Then, according to the decoding result, the execution instruction is mapped to a finite set of instruction types. Finally, the decoder determines and outputs the target instruction type.

[0030] Preferably, the registers in the hardware monitoring unit record the instruction type codes output in each clock cycle in chronological order, i.e., a first-in-first-out (FIFO) buffer or directly latched according to the clock tick, generating an instruction type stream. Then, the execution state of the instruction type stream is analyzed, i.e., the combination pattern of instruction types in the recent period is analyzed through shift registers. For example, assuming the window length is 8, there is an 8×3 bit shift register group in the hardware. In each clock cycle, the type code of the new instruction is shifted in from the rightmost position of the register, and at the same time, the oldest 3-bit code in the shift register is shifted out and discarded. At any time, the 8 3-bit codes latched side by side in the 8-level shift registers together constitute a micro-execution state sequence, reflecting the "behavioral segment" consisting of 8 instructions that the program has just passed. Finally, the micro-execution state sequence is added to the instruction type sequence.

[0031] Furthermore, step S200 also includes: storing the instruction type stream into an N-level shift register using an N-level shift register to determine M new instruction type codes; shifting the M new instruction type codes into the N-level shift register and shifting out the M instruction type codes to determine N type codes; and storing and arranging the N type codes in parallel to construct the micro-execution state sequence.

[0032] Preferably, N is a positive integer representing the number of shift register stages, i.e., the window size, which determines the number of historical information instructions contained in the micro-execution state sequence. M is a positive integer, referring to the number of instruction type codes added each clock cycle. In most simple implementations, M=1, indicating that the CPU executes one instruction per clock cycle. The monitoring unit captures and classifies a type code, uses an N-stage shift register, and stores the instruction type stream into the N-stage shift register. Each register unit stores one instruction type code, for example, 3 bits. This register may be cleared or filled with default values ​​at system startup. At the beginning of each clock cycle, the monitoring unit has completed the classification of the previous instruction and obtained the new instruction. The shift register uses type encoding to determine M new instruction type codes, which are then used as the data to be shifted into the register in the current cycle. At the rising edge of the clock, the entire register undergoes a synchronous shift. The first-level register stores the "new instruction type code," the second-level register stores the value originally in the first-level register, the third-level register stores the value originally in the second-level register, and so on, until the Nth-level register stores the value originally in the (N-1)th-level register. The value originally in the Nth-level register is overwritten and discarded after the shift, representing the oldest historical information in the shift window. After the shift operation, each of the N levels stably stores one type code. These N type codes represent all the latest historical information within the shifted window. The output ports of each level of the shift register are physically accessible simultaneously. Finally, the values ​​in the N registers are read simultaneously, and the N type codes are stored in parallel according to the register number order, constructing a fixed-format parallel data word to determine the micro-execution state sequence. For example, if N=8 and each type code is 3 bits, then the micro-execution state sequence is a 24-bit parallel signal.

[0033] Step S300: Calculate the real-time fingerprint based on the instruction type sequence, extract the legal fingerprint based on the legal fingerprint database, synchronize the real-time fingerprint and the legal fingerprint to the fingerprint comparator for comparison, and generate a fingerprint comparison result.

[0034] Step S300 further includes taking the N type codes of the N-level shift register as input to a lightweight hash calculation circuit; introducing a CPU clock cycle, and performing a hash operation on the N type codes through the hash calculation circuit based on the CPU clock cycle to generate the real-time fingerprint.

[0035] Preferably, the N parallel type codes in the N-stage shift register are input to a lightweight hash calculation circuit. This lightweight hash calculation circuit is a hardware circuit module designed for low power consumption, low latency, and small area; for example, a cyclic redundancy check circuit, CRC-32, whose hardware implementation is a 32-bit linear feedback shift register, offering small area and high speed. A custom mixing / compression function performs a series of XOR (exclusive OR), bit rotation, and modulo addition operations on the N type codes. This hash calculation circuit is used to compress long micro-execution state sequences into shorter, fixed-length fingerprints. The clock of the hash calculation circuit is synchronized with the main CPU clock, at a specific stage of each CPU clock cycle (e.g., when the shift register stably outputs the micro-execution state sequence). Afterwards, the parallel data of the micro-execution state sequence is fed into the hash calculation circuit to perform hash operations on N types of codes. If the hash function is simple enough, the calculation is completed within one clock cycle. The input micro-execution state sequence passes through a layer of combinational logic and can output a real-time fingerprint before the end of the current cycle. If the hash function is a multi-level CRC, it is designed as a 1-2 stage pipeline. Since the CPU instruction stream is continuous, the pipeline ensures that each clock cycle can swallow a new micro-execution state sequence and output a fingerprint of a previous micro-execution state sequence, achieving a throughput of 1. Finally, a fixed-width (e.g., 32-bit) binary value is generated, which is determined as the real-time fingerprint, greatly reducing the overhead of comparison and storage, and ensuring instruction-by-instruction, zero-latency detection of abnormal behavior.

[0036] Furthermore, step S300 also includes: capturing the CPU's program counter value and using the program counter value as a query address; decoding the query address and indexing it based on the address decoding result to generate a target access address; traversing the legal fingerprint database based on the target access address to read and extract legal fingerprints; and performing a fingerprint logic synchronization comparison between the real-time fingerprint and the legal fingerprint input fingerprint comparator to generate a fingerprint comparison result.

[0037] Preferably, the hardware monitoring unit captures the current value of the program counter (PC) from the CPU core in real time and uses the program counter value as the "index key" or "query key" to look up data in the legitimate fingerprint database. This is because when a program executes to a certain address (PC value), the normal instruction sequence fingerprint that should exist near that address is unique. Directly using the original PC value (such as a 32-bit address) to access the fingerprint database may be inefficient. The query address is decoded, for example, through page table / block mapping. Since the legitimate fingerprint database only covers the code area (such as the .text segment), the decoder masks the non-code area address bits in the PC value. The decoder first subtracts the base address 0x08000000 to obtain the offset, thus achieving "compression" or "block indexing" of the address. After decoding and mapping, the target access address for directly accessing the fingerprint database memory is obtained. For example, a 15-bit address line signal may eventually be generated to address a 32K fingerprint ROM. Next, a memory read operation is initiated. The monitoring unit places the generated target access address on the address bus of the fingerprint database memory. Specifically, after receiving the address, the on-chip ROM or SRAM places the data stored at the corresponding address on the data bus after one access cycle. The monitoring unit latches the value on the data bus under clock control, which is the legitimate fingerprint extracted from the fingerprint database.

[0038] Furthermore, step S300 also includes: calculating the Hamming distance value between the real-time fingerprint and the legitimate fingerprint using the fingerprint comparator; setting a Hamming distance threshold; determining a mismatch and generating a mismatch signal if and only if the Hamming distance value is greater than the Hamming distance threshold; and adding the mismatch signal to the fingerprint comparison result.

[0039] Preferably, the real-time fingerprint and the valid fingerprint are input into the fingerprint comparator for synchronous fingerprint logic comparison. The fingerprint comparator is a simple digital logic circuit, the core of which is a bit-by-bit comparator (XOR gate array). Specifically, synchronous comparison means ensuring that the real-time fingerprint and the valid fingerprint just read from memory are stable and valid on the same clock edge. The fingerprint comparator performs an XOR operation on each bit of the two fingerprints. If all bits are the same, the XOR result of each bit is 0, and the final output is "match"; if any bit is different, the output is "mismatch". The fingerprint comparator can also calculate the difference between the real-time fingerprint and the valid fingerprint. The Hamming distance value of a valid fingerprint refers to the total number of characters that differ in corresponding positions between two binary fingerprints. It is used to measure the difference between the two binary strings. Based on historical data, a Hamming distance threshold is preset during the design initialization and stored in a configuration register of the monitoring unit, such as 0, 1, or 2. If the difference in the number of bits between the two fingerprints exceeds the Hamming distance threshold, it is determined to be a mismatch, and a mismatch signal is generated. Finally, a simple logic signal is generated as the fingerprint comparison result. For example, comparison result = 1'b0: match (normal), comparison result = 1'b1: mismatch (anomaly detection!).

[0040] Step S400: Trigger an anomaly response unit based on the fingerprint comparison result.

[0041] Step S400 further includes generating an abnormal trigger signal when the fingerprint comparison result contains a mismatch signal; latching the mismatch signal through the abnormal trigger signal, latching the CPU's program counter value, the real-time fingerprint, and the legitimate fingerprint, and setting a security policy; and executing a hardware-level security response to block the abnormality according to the security policy.

[0042] Preferably, the anomaly response unit is triggered based on the fingerprint comparison result to perform state latching (evidence collection) and execution blocking. Specifically, if the fingerprint comparison result contains a mismatch signal, it means that the Hamming distance value is greater than the preset Hamming distance threshold, confirming that an anomaly has been detected, and then an anomaly trigger signal is generated, marking that the attack has been confirmed and the anomaly response process has officially begun. The anomaly trigger signal is a clock enable signal for a set of latches or registers. When the signal is valid, it latches the mismatch signal itself, the CPU's program counter value, the real-time fingerprint, and the legitimate fingerprint. The CPU's program counter (PC) value is used to accurately indicate the instruction being executed by the CPU when the anomaly is detected, directly pointing to the attacked code location or the entry point of the attack chain.

[0043] Preferably, security policies are configured through registers. These policies can be configured by secure boot code during system startup or pre-set and burned into the firmware by offline analysis tools based on its criticality level. Examples include triggering non-maskable interrupts in interrupt mode, raising the system reset signal in reset mode, and stopping the CPU clock or freezing the system bus in suspend mode. Finally, hardware-level security responses and exception blocking are executed according to the security policy. Specifically, triggering a non-maskable interrupt involves the monitoring unit raising the level connected to the CPU's NMI pin. After completing the current instruction, the CPU must immediately jump to the NMI interrupt vector for execution. This interrupt handler, located in protected memory, can perform secure cleanup, alarms, or secure shutdown. Raising the system reset signal involves the monitoring unit directly raising the reset pin of the entire chip, immediately forcing a reset of the entire CPU, peripherals, and the monitor itself, clearing all states and restarting from the boot code. Entering a secure debug / suspend state involves the monitoring unit forcing the system into debug mode through a chip debug interface (such as SWD), stopping the CPU core, and completely freezing the system, awaiting external debugger connection and analysis. All memory and register states are completely preserved, ensuring complete and reliable runtime security protection.

[0044] In the above text, refer to Figure 1 This paper describes in detail a real-time abnormal behavior detection method based on micro-execution state sequences according to embodiments of the present invention. Next, reference will be made to... Figure 2 This invention describes a real-time abnormal behavior detection system based on micro-execution state sequences according to an embodiment of the present invention.

[0045] The real-time abnormal behavior detection system based on micro-execution state sequences according to embodiments of the present invention addresses the technical problems in existing technologies where embedded firmware runtime behavior monitoring cannot achieve low-overhead, fine-grained, and broad-spectrum defense capabilities in resource-constrained environments, resulting in poor detection real-time performance, sensitivity, and protection coverage. The system achieves the technical effect of improving the real-time performance and sensitivity of embedded firmware runtime integrity detection, as well as the protection coverage and system energy efficiency. Figure 2 As shown, the real-time abnormal behavior detection system based on micro-execution state sequence includes: a legitimate fingerprint database generation module 10, an execution instruction classification module 20, a fingerprint comparison result generation module 30, and an abnormal response unit triggering module 40.

[0046] The legitimate fingerprint database generation module 10 is used to analyze the binary code of the embedded firmware offline and generate a legitimate fingerprint database of micro-execution state sequences. The legitimate fingerprint database is stored in the non-volatile memory of the embedded firmware. The execution instruction classification module 20 is used to non-intrusively sniff the CPU instruction bus and classify the execution instructions in real time through a hardware monitoring unit when the embedded firmware is running, so as to obtain an instruction type sequence. The fingerprint comparison result generation module 30 is used to calculate the real-time fingerprint based on the instruction type sequence, extract legitimate fingerprints based on the legitimate fingerprint database, synchronize the real-time fingerprints and the legitimate fingerprints to the fingerprint comparator for comparison, and generate a fingerprint comparison result. The anomaly response unit triggering module 40 is used to trigger an anomaly response unit based on the fingerprint comparison result.

[0047] The specific configuration of the legitimate fingerprint database generation module 10 will be described in detail below. The legitimate fingerprint database generation module 10 further includes: acquiring the binary code file of the embedded firmware; performing static analysis on the binary code file to identify executable code regions; traversing the executable code regions to parse instructions and obtain a code instruction stream; performing simulated classification of the code instruction stream using preset instruction type classification rules to generate a simulated instruction type sequence; performing fingerprint calculation according to the simulated instruction type sequence using a hardware monitoring unit to obtain a legitimate fingerprint set; matching the legitimate fingerprint set with the code instruction stream to determine multiple code block identification information, wherein the multiple code block identification information corresponds to the legitimate fingerprint set; associating and storing the legitimate fingerprint set with the multiple code block identification information to construct a legitimate fingerprint database; and burning the legitimate fingerprint database into the non-volatile memory of the embedded firmware.

[0048] The specific configuration of the legitimate fingerprint database generation module 10 will be described in detail below. The legitimate fingerprint database generation module 10 further includes: the legitimate fingerprint database working in conjunction with the hardware monitoring unit; the hardware monitoring unit, during runtime, queries the legitimate fingerprint database based on the execution address to perform real-time fingerprint comparison and anomaly detection.

[0049] The specific configuration of the instruction classification module 20 will be described in detail below. The instruction classification module 20 further includes: during the runtime of the embedded firmware, non-intrusive monitoring of the CPU's instruction bus is performed by the instruction sniffing module of the hardware monitoring unit to capture instruction codes; real-time decoding is performed based on the instruction codes to generate decoding results; the execution instructions are mapped to a finite set of instruction types according to the decoding results to determine the target instruction type; the target instruction types are sorted according to the execution timing to generate an instruction type stream; execution state analysis is performed based on the instruction type stream to generate a micro-execution state sequence; and the micro-execution state sequence is added to the instruction type sequence.

[0050] The specific configuration of the instruction classification module 20 will be described in detail below. The instruction classification module 20 further includes: storing the instruction type stream into an N-level shift register to determine M new instruction type codes; shifting the M new instruction type codes into the N-level shift register and shifting out the M instruction type codes to determine N type codes; and storing and arranging the N type codes in parallel to construct the micro-execution state sequence.

[0051] The specific configuration of the fingerprint comparison result generation module 30 will be described in detail below. The fingerprint comparison result generation module 30 further includes: taking the N type codes of the N-level shift register as input and inputting them to a lightweight hash calculation circuit; introducing a CPU clock cycle, and performing a hash operation on the N type codes through the hash calculation circuit based on the CPU clock cycle to generate the real-time fingerprint.

[0052] The specific configuration of the fingerprint comparison result generation module 30 will be described in detail below. The fingerprint comparison result generation module 30 further includes: capturing the CPU's program counter value and using the program counter value as a query address; decoding the query address and indexing it based on the address decoding result to generate a target access address; traversing the legitimate fingerprint database based on the target access address to read and extract legitimate fingerprints; and performing a fingerprint logic synchronous comparison between the real-time fingerprint and the legitimate fingerprint input fingerprint comparator to generate a fingerprint comparison result.

[0053] The specific configuration of the fingerprint comparison result generation module 30 will be described in detail below. The fingerprint comparison result generation module 30 further includes: calculating the Hamming distance value between the real-time fingerprint and the legitimate fingerprint through the fingerprint comparator; setting a Hamming distance threshold; determining a mismatch and generating a mismatch signal if and only if the Hamming distance value is greater than the Hamming distance threshold; and adding the mismatch signal to the fingerprint comparison result.

[0054] The specific configuration of the anomaly response unit trigger module 40 will be described in detail below. The anomaly response unit trigger module 40 further includes: generating an anomaly trigger signal when the fingerprint comparison result contains a mismatch signal; latching the mismatch signal through the anomaly trigger signal, latching the CPU's program counter value, the real-time fingerprint, and the legitimate fingerprint, and setting a security policy; and executing a hardware-level security response to block the anomaly according to the security policy.

[0055] The real-time abnormal behavior detection system based on micro-execution state sequence provided in this embodiment of the invention can execute the real-time abnormal behavior detection method based on micro-execution state sequence provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0056] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A real-time detection method for abnormal behavior based on micro-execution state sequences, characterized in that, The method includes: Offline analysis of the binary code of the embedded firmware generates a valid fingerprint database of micro-execution state sequences, which is stored in the non-volatile memory of the embedded firmware. When the embedded firmware is running, the hardware monitoring unit non-intrusively sniffs the CPU's instruction bus and classifies the executed instructions in real time to obtain the instruction type sequence. Real-time fingerprints are calculated based on the instruction type sequence, legal fingerprints are extracted from the legal fingerprint database, and the real-time fingerprints and legal fingerprints are synchronized to a fingerprint comparator for comparison to generate fingerprint comparison results. An anomaly response unit is triggered based on the fingerprint comparison result.

2. The real-time detection method for abnormal behavior based on micro-execution state sequences as described in claim 1, characterized in that, Offline analysis of the binary code of embedded firmware to generate a valid fingerprint database of micro-execution state sequences, wherein the valid fingerprint database is stored in the non-volatile memory of the embedded firmware, the method comprising: Obtain the binary code file of the embedded firmware, perform static analysis on the binary code file, and identify the executable code region; The executable code region is traversed to parse instructions and obtain the code instruction stream; The code instruction stream is simulated and classified according to a preset instruction type classification rule to generate a simulated sequence of instruction types. A valid fingerprint set is obtained by simulating a sequence of instructions according to the specified instruction type using a hardware monitoring unit. Based on the matching of the legitimate fingerprint set and the code instruction stream, multiple code block identification information is determined, and the multiple code block identification information has a corresponding relationship with the legitimate fingerprint set; The legitimate fingerprint set is associated with and stored with the multiple code block identification information to construct a legitimate fingerprint database; The legitimate fingerprint database is burned into the non-volatile memory of the embedded firmware.

3. The real-time detection method for abnormal behavior based on micro-execution state sequences as described in claim 2, characterized in that, The legitimate fingerprint database works in conjunction with the hardware monitoring unit. During runtime, the hardware monitoring unit queries the legitimate fingerprint database based on the execution address to perform real-time fingerprint comparison and anomaly detection.

4. The real-time detection method for abnormal behavior based on micro-execution state sequences as described in claim 1, characterized in that, When the embedded firmware is running, the hardware monitoring unit non-intrusively sniffs the CPU's instruction bus and classifies the executed instructions in real time to obtain the instruction type sequence. The methods include: During the running of the embedded firmware, the instruction sniffing module of the hardware monitoring unit non-intrusively monitors the CPU's instruction bus and captures instruction codes. Real-time decoding is performed based on the instruction code to generate decoding results. The execution instructions are then mapped to a finite set of instruction types according to the decoding results to determine the target instruction type. The target instruction types are sorted according to execution timing to generate an instruction type stream; Execution state analysis is performed based on the instruction type stream to generate a micro-execution state sequence, which is then added to the instruction type sequence.

5. The real-time detection method for abnormal behavior based on micro-execution state sequences as described in claim 4, characterized in that, The method for performing execution state analysis based on the instruction type stream to generate a micro-execution state sequence includes: The instruction type stream is stored in an N-level shift register to determine the encoding of M new instruction types; Based on the M newly added instruction type codes, shift them into an N-level shift register, shift out the M instruction type codes, and determine the N type codes; The N type codes are stored and arranged in parallel to construct the micro-execution state sequence.

6. The real-time detection method for abnormal behavior based on micro-execution state sequences as described in claim 5, characterized in that, The method for calculating a real-time fingerprint based on the instruction type sequence includes: The N types of codes of the N-stage shift register are used as inputs to the lightweight hash calculation circuit; A CPU clock cycle is introduced, and based on the CPU clock cycle, the hash calculation circuit performs hash operations on the N type codes to generate the real-time fingerprint.

7. The real-time detection method for abnormal behavior based on micro-execution state sequences as described in claim 1, characterized in that, Extracting legitimate fingerprints from the aforementioned legitimate fingerprint database, synchronizing the real-time fingerprints with the legitimate fingerprints to a fingerprint comparator for comparison, and generating fingerprint comparison results, the method includes: Capture the CPU's program counter value and use it as the query address; The query address is decoded, and the target access address is generated by indexing the address decoding result. Based on the target access address, the legitimate fingerprint database is traversed to read and extract legitimate fingerprints; The real-time fingerprint is compared with the legally input fingerprint using a fingerprint comparison device to generate a fingerprint comparison result.

8. The real-time detection method for abnormal behavior based on micro-execution state sequences as described in claim 7, characterized in that, The fingerprint logical synchronization comparison method further includes: The Hamming distance between the real-time fingerprint and the legitimate fingerprint is calculated using the fingerprint comparator. A preset Hamming distance threshold is set. If the Hamming distance value is greater than the Hamming distance threshold, it is determined that the comparison is mismatched and a mismatch signal is generated. The mismatch signal is added to the fingerprint comparison result.

9. The real-time detection method for abnormal behavior based on micro-execution state sequences as described in claim 8, characterized in that, The method for triggering an anomaly response unit based on the fingerprint comparison result includes: If the fingerprint comparison result contains a mismatch signal, an abnormality trigger signal is generated; The mismatch signal is latched by the abnormal trigger signal, and the CPU's program counter value, the real-time fingerprint, and the legitimate fingerprint are latched to set a security policy. Implement hardware-level security responses to block anomalies according to the described security policy.

10. A real-time abnormal behavior detection system based on micro-execution state sequences, characterized in that, The system is used to implement the real-time abnormal behavior detection method based on micro-execution state sequences as described in any one of claims 1 to 9, and the system comprises: A legitimate fingerprint database generation module is used to analyze the binary code of the embedded firmware offline and generate a legitimate fingerprint database of micro-execution state sequences. The legitimate fingerprint database is stored in the non-volatile memory of the embedded firmware. The instruction classification module is used to non-intrusively sniff the CPU's instruction bus and classify the executed instructions in real time through the hardware monitoring unit when the embedded firmware is running, so as to obtain the instruction type sequence. The fingerprint comparison result generation module is used to calculate the real-time fingerprint based on the instruction type sequence, extract legal fingerprints based on the legal fingerprint database, synchronize the real-time fingerprint and the legal fingerprint to the fingerprint comparator for comparison, and generate fingerprint comparison results. An anomaly response unit triggering module is used to trigger an anomaly response unit based on the fingerprint comparison result.

Images