Side channel based iot terminal malware protection detection method and system
By employing a side-channel-based method for detecting malware on IoT terminals, and utilizing power consumption data and time-series analysis in conjunction with a hidden Markov model, the method addresses the issue of low detection accuracy caused by dynamic changes in the state of IoT terminals, achieving high-precision threat detection and emergency response.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- LIAONING PROVINCIAL COLLEGE OF COMM
- Filing Date
- 2026-04-15
- Publication Date
- 2026-07-21
AI Technical Summary
Existing technologies for detecting malware on IoT terminals rely on static feature matching, ignoring dynamic changes in state, resulting in low accuracy in security risk detection.
By acquiring power consumption data from IoT terminals, time-series analysis is used to extract progressive evolution features, Euclidean distance is calculated to determine business status identifiers, and anomaly detection is performed using a hidden Markov model to generate alarm signals with priority coding rules.
It enables high-precision real-time detection of IoT terminals, quickly locates potential threats, and improves the accuracy of security risk detection and emergency response efficiency.
Smart Images
Figure CN122437682A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of Internet of Things (IoT) security technology, and in particular to a side-channel-based method and system for detecting and protecting against malicious software on IoT terminals. Background Technology
[0002] The Internet of Things (IoT) technology has been widely applied in key areas such as industrial production, smart homes, and medical equipment, becoming an important infrastructure supporting the operation of modern society.
[0003] In existing technologies, malware detection for IoT terminals primarily relies on network traffic analysis or static signature matching, identifying potential threats by comparing them to known malware signature databases. However, the operating environment of IoT terminals exhibits significant business state dependence. This information is presented in the form of continuous waveforms, characterized by strong temporal sequence and variable patterns. Business state transitions are often not abrupt but rather accompanied by a gradual evolution of power consumption data over time. Device behavior is highly dependent on its specific business state, with significant differences in power consumption data and command streams across different states. Existing technologies often ignore this dynamic state change of IoT terminals, relying solely on static signature matching. This makes it difficult to effectively address IoT vulnerabilities exposed by dynamic state changes in practical applications, leading to false positives or false negatives.
[0004] Therefore, existing technologies ignore the dynamic changes in the state of IoT terminals and rely solely on static feature matching, resulting in low accuracy in security risk detection. Summary of the Invention
[0005] This invention provides a side-channel-based method and system for detecting and protecting against malware on IoT terminals, which solves the problem that existing technologies ignore the dynamic changes in the state of IoT terminals and rely solely on static feature matching, resulting in low accuracy in security risk detection.
[0006] Firstly, to address the aforementioned technical problems, this invention provides a side-channel-based method for detecting and protecting against malware on IoT terminals, comprising: The power consumption data of IoT terminals is acquired, and progressive evolution features are extracted through time series analysis. The Euclidean distance between the progressive evolution features and the pre-trained service state cluster centers is calculated, and the service state identifier is determined based on the obtained minimum Euclidean distance. The baseline waveform sequence and correlation strength value are obtained by matching the business status identifier with the preset template library. A real-time waveform sequence containing multi-channel synchronous acquisition markers is acquired, and the reference waveform sequence is aligned with the real-time waveform sequence to obtain an aligned sequence pair. The point-to-point Euclidean distance is calculated based on the aligned sequence pairs, and a second similarity score is obtained by weighting the correlation strength value and the point-to-point Euclidean distance. If the second similarity score is lower than the preset disturbance judgment threshold, a potential abnormal instruction label is generated and appended to the real-time waveform sequence to obtain the disturbance waveform data. The disturbance waveform data is input into a preset hidden Markov model for confidence analysis to obtain anomaly confidence stratification and anomaly type identification. Priority matching is performed based on the anomaly confidence level and the anomaly type identifier to generate an alarm signal with priority coding rules.
[0007] Secondly, the present invention provides a side-channel-based IoT terminal malware protection and detection system, comprising: The business status identification module acquires power consumption data of IoT terminals, extracts progressive evolution features through time series analysis, calculates the Euclidean distance between the progressive evolution features and the pre-trained centers of each business status cluster, and determines the business status identifier based on the obtained minimum Euclidean distance. The template matching module matches the service status identifier with a preset template library to obtain a baseline waveform sequence and a correlation strength value. The waveform alignment module acquires a real-time waveform sequence containing multi-channel synchronous acquisition markers, and aligns the reference waveform sequence with the real-time waveform sequence to obtain an aligned sequence pair. The similarity calculation module calculates the Euclidean distance between point pairs based on the aligned sequence pairs, and weights the Euclidean distance between point pairs based on the association strength value and the point pair Euclidean distance to obtain a second similarity score; If the second similarity score is lower than the preset disturbance judgment threshold, the anomaly preliminary judgment module generates a potential anomaly instruction tag and attaches the potential anomaly instruction tag to the real-time waveform sequence to obtain disturbance waveform data. The Hidden Markov Analysis module inputs the disturbance waveform data into a preset Hidden Markov model for confidence analysis to obtain anomaly confidence levels and anomaly type identifiers. The risk scoring and alarm generation module performs priority matching based on the anomaly confidence level and the anomaly type identifier to generate alarm signals with priority coding rules.
[0008] Compared with the prior art, the present invention has the following beneficial effects: (1) This invention uses multi-state hierarchical indexing and adaptive template window matching technology to quickly locate the candidate template set according to the business status identifier, and dynamically adjusts the truncation window length based on the dispersion of the fluctuation distribution characteristics, thereby achieving efficient retrieval and accurate matching of the benchmark waveform sequence.
[0009] (2) By introducing a business status recognition mechanism, this invention uses time-series analysis to extract progressive evolution features and match them with the pre-trained business status cluster center, which can accurately perceive the current business status of the device and effectively overcome the technical defects of traditional methods that ignore state dependencies and cause frequent false alarms.
[0010] (3) This invention introduces a priority alarm generation mechanism based on risk scoring, generates confidence weight factors based on multi-level anomaly stratification results, calculates a comprehensive risk score by combining a preset impact mapping table, and generates alarm signals with priority identifiers by matching with a priority coding rule library. This enables automated hierarchical processing of massive alarms, allowing maintenance personnel to prioritize the handling of high-risk threats, improve emergency response efficiency, and effectively ensure the continuity and security of IoT terminal services. Attached Figure Description
[0011] Figure 1 This is a schematic diagram of the process of the side-channel-based IoT terminal malware protection and detection method provided in the first embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of the side-channel-based IoT terminal malware protection and detection system provided in the second embodiment of the present invention. Detailed Implementation
[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0013] Reference Figure 1 The first embodiment of the present invention provides a method for protecting and detecting malware on IoT terminals based on side channels, including the following steps: S11, acquire power consumption data of IoT terminals, extract progressive evolution features through time series analysis, calculate the Euclidean distance between the progressive evolution features and the pre-trained service state cluster centers, and determine the service state identifier based on the obtained minimum Euclidean distance. S12, Match the business status identifier with the preset template library to obtain the reference waveform sequence and the correlation strength value; S13, acquire a real-time waveform sequence containing multi-channel synchronous acquisition markers, and align the reference waveform sequence with the real-time waveform sequence to obtain an aligned sequence pair; S14, calculate the Euclidean distance between point pairs based on the aligned sequence pairs, and weight the Euclidean distance between point pairs according to the association strength value and the point pair to obtain the second similarity score; S15, if the second similarity score is lower than the preset disturbance judgment threshold, a potential abnormal instruction label is generated and attached to the real-time waveform sequence to obtain the disturbance waveform data; S16, The disturbance waveform data is input into a preset hidden Markov model for confidence analysis to obtain anomaly confidence stratification and anomaly type identification. S17, perform priority matching based on the abnormal confidence level and the abnormal type identifier to generate an alarm signal with priority coding rules.
[0014] In step S11, the process of acquiring power consumption data of the IoT terminal, extracting progressive evolution features through time-series analysis, calculating the Euclidean distance between the progressive evolution features and the pre-trained service state cluster centers, and determining the service state identifier based on the obtained minimum Euclidean distance includes: Power consumption data is collected from the sensor array, and the power consumption data is truncated using an adaptive sliding window to obtain a power consumption waveform sequence; Empirical mode decomposition is performed on the power consumption waveform sequence to obtain intrinsic mode function components. The slope change rate of the intrinsic mode function components is calculated to extract the gradual evolution characteristics. Calculate the Euclidean distance between the progressive evolution features and the pre-trained centers of each business state cluster to obtain a state matching degree list; If the minimum Euclidean distance in the state matching degree list is less than the preset judgment threshold, then the business state category corresponding to the minimum Euclidean distance is determined as the current business state identifier.
[0015] It should be noted that a device's dynamic power consumption is physically strongly correlated with its internal operations, instruction sequences, and data processing methods. Therefore, control flow information can be inferred by analyzing power consumption waveforms, thereby detecting malicious code injection. Furthermore, power consumption fluctuations can even reveal sensitive device information. This characteristic, which is inherently a vulnerability, can be transformed into a security monitoring mechanism to achieve high-precision real-time detection of threats such as DDoS attacks.
[0016] In this embodiment, power consumption data is collected from the sensor array, and an adaptive sliding window is used to extract the power consumption waveform sequence. The window length of the adaptive sliding window is dynamically adjusted according to the current waveform energy change rate. Specifically, the energy change rate is characterized by calculating the standard deviation of the data within a local window. When the local energy standard deviation exceeds a preset energy threshold, the window length is shortened to 128 points to improve the temporal resolution for sudden malicious behavior. Otherwise, the length is maintained at 256 points to reduce redundant calculations during normal operation. The preset energy threshold is set based on the statistical characteristics of energy fluctuations under historical normal operation conditions, for example, three times the standard deviation of normal fluctuations. The window lengths of 128 points and 256 points are determined according to the sampling frequency. For example, when the sampling frequency is 8000 times per second, 128 points correspond to a 16-millisecond time window, which can cover the typical duration of transient malicious behavior, and 256 points correspond to 32 milliseconds, which is sufficient to include multiple normal cycles.
[0017] For example, an accelerometer is used to continuously collect the power consumption of a smart home gateway at a sampling frequency of 8,000 times per second to form an original waveform sequence, which is then truncated by an adaptive sliding window to obtain a power consumption waveform sequence.
[0018] It should be noted that empirical mode decomposition (IMF) is performed on the power consumption waveform sequence to obtain intrinsic mode function (IMF) components. According to the energy statistical analysis of historical normal samples, the cumulative energy of the first 5 IMF components accounts for more than 95%, which can fully characterize the main physical characteristics of the device's operating state. Therefore, the first 5 IMF components are retained for subsequent feature extraction. If the decomposition yields fewer than 5 IMF components, only the actual existing components are taken, and missing dimensions are filled with 0 or discarded. To quantify the drastic evolution of each component on the time axis, the slope change rate of each intrinsic mode function component is calculated. Specifically, a fixed-length sliding window is used to traverse the component data. Within each window, the local slope is calculated through linear fitting. Then, the absolute value of the difference between the slopes of adjacent windows is calculated, and the average value is taken as the evolutionary feature scalar of that component. The selection of the sliding window length is based on the sampling frequency and typical fluctuation period. For example, at a sampling frequency of 8000Hz, a 20-point window corresponds to a time span of 2.5 milliseconds, which can effectively capture small waveform changes. At the same time, to adapt to the changing characteristics of different time scales, three window lengths of 10 points, 20 points, and 30 points are used to calculate the slope change rate. Each intrinsic mode function component yields 3 evolutionary feature scalars. Finally, the feature scalars of the 5 components are concatenated to form a 15-dimensional progressive evolution feature vector.
[0019] For example, for the third intrinsic mode function component, after calculating the local slope with a 20-point window, the mean of the absolute values of the differences between adjacent slopes is 0.23, which is used as an eigenvalue of the component.
[0020] It should be noted that the Euclidean distance between the progressive evolution feature and the pre-trained cluster centers of each service state is calculated to obtain a state matching degree list. The cluster centers of each service state are obtained by collecting a large amount of power consumption data under historical normal operation conditions, marking the corresponding service state labels, extracting progressive evolution features, and training with the K-means clustering algorithm. The number of clusters is determined to be 8 based on the silhouette coefficient and the elbow rule, corresponding to typical service states such as idle, data forwarding, firmware update, web service, encryption operation, local storage, OTA upgrade, and abnormal jitter. Each cluster center is a 15-dimensional vector. During the calculation, the current 15-dimensional progressive evolution feature vector is used to calculate the Euclidean distance with each of the 8 cluster centers to obtain 8 distance values that constitute the state matching degree list.
[0021] For example, the current feature vector has an Euclidean distance of 0.32 from the center of the "firmware update" cluster, a distance of 2.87 from the center of the "abnormal jitter" cluster, and a distance of more than 1.5 from all other clusters. The smaller the distance, the higher the similarity to the corresponding state.
[0022] It should be noted that if the minimum Euclidean distance in the state matching list is less than the preset judgment threshold, the business state category corresponding to the minimum Euclidean distance is determined as the current business state identifier; if the minimum Euclidean distance is not less than the preset judgment threshold, the current business state is determined to be unidentifiable, the business state identifier is marked as an unknown state, and the default template in the preset general template library is used as the matching basis for the subsequent benchmark waveform sequence, or the template matching step is skipped and the process is directly transferred to the anomaly preliminary judgment process to avoid process interruption; the preset judgment threshold is obtained by statistically analyzing the distance distribution between the progressive evolution characteristics of historical normal samples under different business states and the corresponding cluster centers. Specifically, the Euclidean distance between the feature vector of each normal sample under each business state and the center of its respective cluster is calculated, and the 95th percentile of each distance value is taken and weighted to obtain a global threshold of 0.45, ensuring that the recognition accuracy of normal samples is above 95%.
[0023] For example, if the current minimum distance is 0.38 and corresponds to the "abnormal jitter" cluster, since 0.38 is less than the threshold of 0.45, the current business status is determined to be abnormal jitter and an alarm or isolation mechanism is triggered.
[0024] In step S12, the matching based on the service status identifier and the preset template library to obtain the reference waveform sequence and correlation strength value includes: Based on the business status identifier, the index node corresponding to the business status identifier is matched and located from the multi-state hierarchical index of the preset template library; Extract all candidate waveform sequences attached to the index node, perform frequency domain analysis on the time series data of all candidate waveform sequences, and extract multiple fluctuation distribution feature vectors; The first similarity score is obtained by comparing the fluctuation distribution feature vector with the feature vector of the power consumption waveform sequence one by one. The candidate waveform sequence with the highest first similarity score is selected as the reference waveform sequence, and the association strength value between the reference waveform sequence and the service status identifier is calculated based on the highest first similarity score.
[0025] It should be noted that the preset template library is built by collecting historical power consumption data of various business states during normal operation. After empirical mode decomposition and slope change rate extraction, the waveform segments in each state are clustered and filtered to construct multiple template sequences that reflect the typical behavior patterns of that state. A multi-state hierarchical index is established according to the organizational hierarchy of business states. This index adopts a tree structure, with the root node being the entire device, the lower layer being divided according to the major categories of business functions, and the next lower layer being the specific business state nodes. Each business state node carries the candidate template set corresponding to that state, so as to quickly locate the current business state based on the current business state identifier.
[0026] For example, when the business status is identified as "firmware update", the corresponding node is located along the index tree path "normal operation → firmware update". This node pre-stores templates for multiple sub-stages such as image download verification, decompression verification, writing to flash memory, block verification, and restart preparation. Each template is a typical waveform sequence extracted from historical normal samples.
[0027] It should be noted that the candidate waveform sequence contains 8 templates, which correspond to the sub-stages of the firmware update process, such as image download verification, decompression verification, writing to flash memory, block verification, and restart preparation. Each template is a typical waveform sequence extracted from a large number of historical normal samples under this service state. Specifically, the normal waveforms of each sub-stage are clustered and the cluster center waveform is selected as the template. The frequency domain analysis adopts Fast Fourier Transform, and the number of transform points is set to 1024 points according to the sampling frequency and typical period length to balance frequency resolution and computational efficiency. After obtaining the spectrum of each template, the main frequency peak and its energy ratio are extracted as the fluctuation distribution feature vector. The main frequency peak is the frequency corresponding to the maximum amplitude in the spectrum, and the energy ratio is the proportion of the energy of the main frequency peak to the total energy of the spectrum.
[0028] For example, one template's main frequency is concentrated in the 45Hz to 68Hz range and the energy in this range accounts for 71%, indicating that the template mainly vibrates at low frequencies, corresponding to the image download verification stage in firmware updates. Another template has a peak around 120Hz and the energy accounts for more than 60%, indicating higher frequency vibration characteristics caused by write operations.
[0029] It should be noted that the fluctuation distribution feature vector is compared one by one with the feature vector of the power consumption waveform sequence, and the first similarity score is obtained by using cosine similarity as the metric. The feature vector is a frequency domain feature vector or a progressively evolving feature vector with the same dimension as the candidate template extracted from the power consumption waveform sequence to ensure comparability. The cosine similarity measures the consistency of direction by calculating the cosine value of the angle between the two vectors. The closer the value is to 1, the more similar the waveform patterns are.
[0030] For example, the cosine similarity between the current real-time feature vector and the fluctuation distribution feature vector of "mirror download verification" is 0.89, indicating a high degree of agreement. The similarity with "write to flash memory" is 0.41, and the similarity with other fluctuation distribution feature vectors is all below 0.6. The higher the similarity score, the more the current physical behavior matches the template pattern.
[0031] It should be noted that after determining the baseline waveform sequence based on the highest first similarity score, the association strength value is calculated. This value reflects the degree of matching between the current real-time waveform and the baseline waveform in subsequent weighted calculations. It is quantified as the reciprocal of 1 minus the reciprocal of the difference between the first similarity scores. For example, when the similarity is 0.92, the strength value is approximately 12.5, indicating a strong mapping relationship; if the highest similarity is only 0.67, the strength value drops to approximately 3.0, suggesting a possible slight deviation that requires continuous monitoring.
[0032] In step S13, acquiring a real-time waveform sequence containing multi-channel synchronous acquisition markers and aligning the reference waveform sequence with the real-time waveform sequence to obtain an aligned sequence pair includes: Acquire a real-time waveform sequence containing multi-channel synchronous acquisition markers, and calculate the degree of time axis distortion between the reference waveform sequence and the real-time waveform sequence; When the time axis distortion is lower than a preset first distortion threshold, the reference waveform sequence and the real-time waveform sequence are linearly scaled to obtain an aligned sequence pair. When the time axis distortion degree is higher than the preset second distortion threshold, the reference waveform sequence and the real-time waveform sequence are subjected to nonlinear mapping processing to obtain an aligned sequence pair with uniform length.
[0033] It should be noted that the baseline waveform sequence is extracted from historical normal firmware update samples, with a length of 480 points, including three channels of data: voltage, current, and electromagnetic radiation. It is also marked with eight synchronization event markers, each corresponding to a key event node such as image download start, verification completion, flash write trigger, and restart command issuance, carrying the channel number and precise timestamp. The real-time waveform sequence also includes multi-channel synchronization acquisition markers automatically recorded by the sensor hardware during synchronous acquisition. These markers are generated based on the same event triggering mechanism, ensuring comparability with the markers in the baseline waveform sequence. The specific content of the markers is a hardware timestamp added in real-time by the device's main control chip based on the command execution status during the acquisition process. For example, when the firmware update program executes the image download start command, it triggers the acquisition system to record a marker at the current sampling point. Therefore, the real-time sequence naturally carries key event markers corresponding to the baseline sequence. If some markers are missing in the real-time sequence due to acquisition anomalies or hardware failures, the cross-correlation function is used to estimate the overall time delay of the corresponding channels of the two sequences as a preliminary estimate of the degree of distortion. Specifically, a sliding window cross-correlation calculation is performed on the channel data with missing markers and the corresponding channel data of the reference sequence. The offset corresponding to the maximum value of the correlation coefficient is taken as the estimated offset of the channel. Then, the offsets of other labeled channels are fused to obtain the comprehensive degree of distortion value. When calculating the degree of distortion of the time axis, the time position offset of the same event markers between multiple channels is examined first. By extracting the position of each channel marker point in the reference sequence and the real-time sequence, the number of offset points of each marker is calculated. Then, the absolute values of the offsets of each channel and each marker are weighted and averaged and divided by the length of the reference sequence for normalization to obtain the degree of distortion value in the range of 0 to 1. The weights are preset according to the importance of the markers. For example, the markers of key events have higher weights.
[0034] For example, when the peak value of the current channel in the real-time waveform sequence is delayed by 18 points and the peak value of the electromagnetic channel is advanced by 12 points compared to the reference waveform sequence, the normalized cumulative offset average value calculated based on 8 marker points is 0.37, indicating that there is a moderate degree of non-uniform stretching or compression.
[0035] It should be noted that when the distortion degree of the time axis is lower than the preset first distortion threshold, the reference waveform sequence and the real-time waveform sequence are linearly scaled to obtain an aligned sequence pair. The first distortion threshold is determined to be 0.15 based on a trade-off analysis of the alignment effect of historical samples and the computational cost. When the distortion degree is lower than 0.15, it is considered as a slight drift, and linear interpolation scaling is directly used to achieve alignment in order to improve computational efficiency.
[0036] It should be noted that when the time axis distortion exceeds a preset second distortion threshold, a nonlinear mapping process is performed on the reference waveform sequence and the real-time waveform sequence to obtain aligned sequence pairs of uniform length. The second distortion threshold is determined to be 0.28 based on a trade-off analysis of the alignment effect of historical samples and computational overhead. When the distortion exceeds 0.28, a dynamic time warping algorithm is triggered to generate a nonlinear mapping path. This algorithm achieves nonlinear alignment by constructing an Euclidean distance matrix between points in the two sequences and searching for the path with the minimum cumulative distance from the starting point to the ending point. Each point on the path represents a mapping relationship between a point in the reference sequence and a point in the real-time sequence. Simultaneously, window constraints are set to limit the path search range to avoid ill-conditioned alignment. During path generation, the algorithm tends to increase the number of matching points in high-information-density regions to preserve waveform details through local constraints, while allowing larger jumps in smooth waveform regions. To adapt to potential instantaneous spikes, the dynamic warping path defines the mapping relationship between each point in the reference sequence and one or more points in the real-time sequence. The nonlinear mapping process resamples or interpolates the real-time sequence based on the correspondence on the path. For each time index in the reference sequence, the corresponding real-time sequence point position is found according to the dynamic warping path. If one reference point in the path corresponds to multiple real-time points, the average amplitude of these real-time points is taken as the aligned amplitude of the reference point position. If multiple reference points in the path correspond to the same real-time point, the amplitude of the real-time point is copied to the corresponding multiple reference point positions, thereby generating an aligned real-time sequence of the same length as the reference sequence. Together with the reference sequence, they form an aligned sequence pair. In the firmware update scenario, when the length of the reference waveform sequence is 480 points and the length of the real-time waveform sequence is 520 points, the length of the aligned real-time sequence is uniformly 480 points after mapping through the dynamic warping path.
[0037] In step S14, the step of calculating the Euclidean distance between point pairs based on the aligned sequence pairs, and weighting the result based on the association strength value and the Euclidean distance between point pairs to obtain a second similarity score, includes: Traverse the aligned sequence pairs and calculate the point-to-point Euclidean distance between the reference waveform amplitude and the real-time waveform amplitude; The Euclidean distance between the point pairs is weighted using the correlation strength value to generate a weighted distance value; The weighted distance values are normalized to determine the second similarity score.
[0038] It should be noted that since the waveform amplitude data is a one-dimensional scalar, the Euclidean distance is the absolute value of the difference between the two amplitudes, which is used to quantify the degree of amplitude deviation of the waveform at that moment. For data that includes voltage, current, electromagnetic radiation and other multi-channel synchronous acquisition, the above calculation is performed independently for each channel to obtain the point-to-point Euclidean distance sequence corresponding to each channel.
[0039] For example, in a voltage channel, if the amplitude of a certain alignment point of the reference waveform is 3.2 volts and the amplitude of the corresponding point of the real-time waveform is 3.5 volts, then the Euclidean distance of that point is 0.3 volts, indicating that the voltage amplitude deviates by 0.3 volts at that moment.
[0040] It should be noted that the weighting operation adopts a multiplicative form, that is, the weighted distance component is equal to the Euclidean distance between the point pairs multiplied by the reciprocal of the mapping association strength. This design makes the weighted distance component closer to the original Euclidean distance when the mapping association strength is higher (closer to 1), and the weighted distance component is amplified when the association strength value is lower. This gives higher deviation weights in areas where alignment is unreliable, and avoids the alignment error from masking the real anomaly.
[0041] For example, during the voltage channel verification phase, if the Euclidean distance of a point is 0.3 and the correlation strength value of that point is 0.9, then the weighted distance value is 0.33, which is slightly higher than the original Euclidean distance but not significantly different, indicating that the matching reliability in this area is high and the deviation calculation is reliable. During the electromagnetic radiation channel restart phase, if the Euclidean distance of a point is 0.3 but the correlation strength value is only 0.6, then the weighted distance value is 0.5, which is significantly larger than the original value, suggesting that there may be unreliable alignment or a large actual deviation in this area, requiring further attention.
[0042] It should be noted that the total weighted distance is obtained by summing the weighted distance values, and then mapped to a second similarity score within the range of 0 to 1 using an extreme value normalization method based on historical sample statistics.
[0043] in, Indicates the total correlation strength value. This represents the total weighted distance. and These are the maximum and minimum total weighted distance values obtained statistically from a large number of historical normal samples. For example, by collecting waveform data of normal operation under various service states, calculating its weighted distance components and obtaining them statistically. For 50, When the total weighted distance is 12.5, the second similarity score is 0.75, which is the difference between 50 and 12.5 divided by 50. This indicates that the overall matching degree between the two sequences is relatively high. After obtaining the overall similarity score, the local similarity score can also be calculated by combining the position of the markers collected by multi-channel synchronous acquisition. If the total weighted distance exceeds the historical maximum value, S=0 or is truncated to ensure that the score is in the interval [0,1].
[0044] For example, the local total weighted distance is calculated and normalized within a 50-point window before and after the flash write mark to obtain a local second similarity score of 0.82, and a local second similarity score of 0.68 is obtained near the restart instruction mark, which is used to more precisely locate the abnormal fluctuation area.
[0045] In step S15, if the second similarity score is lower than a preset perturbation judgment threshold, a potential abnormal instruction label is generated and appended to the real-time waveform sequence to obtain perturbation waveform data, including: If the second similarity score is lower than the preset disturbance determination threshold, the current real-time waveform sequence is determined to be in an inconsistent state, and the weighted distance component in the real-time waveform sequence is searched. The start point and end point of the interval where the weighted distance component continuously exceeds the preset deviation threshold are respectively determined as the disturbance start point and disturbance end point. Based on the time positions corresponding to the start and end points of the disturbance, an anomaly occurrence timestamp is generated, and a potential anomaly instruction tag containing the anomaly occurrence timestamp is constructed; the potential anomaly instruction tag is appended to the real-time waveform sequence to obtain the disturbance waveform data.
[0046] It should be noted that if the second similarity score is lower than the preset disturbance determination threshold, the current real-time waveform sequence is determined to be in an inconsistent state, and the weighted distance component in the real-time waveform sequence is searched. The starting point and ending point of the interval where the weighted distance component continuously exceeds the preset deviation threshold are respectively determined as the disturbance start point and disturbance end point. The preset disturbance judgment threshold is obtained through statistical analysis of the second similarity scores of a large number of historical normal samples under various business states. The lower limit of the 95% confidence interval for each sample score, 0.72, is used as the threshold to ensure that the misjudgment rate of normal samples is less than 5%. The preset deviation threshold is obtained by statistically analyzing the weighted distance component sequences of historical normal samples. The mean and standard deviation of the weighted distance components under normal conditions are calculated, and the mean plus three times the standard deviation, 0.45, is used as the threshold. This setting covers 99.7% of the normal fluctuation range under the assumption of normal distribution. The judgment of continuously exceeding the deviation threshold also needs to meet the minimum duration requirement, i.e., the number of points continuously exceeding the threshold is not less than 5. This number corresponds to 0.625 milliseconds at a sampling frequency of 8000Hz, determined based on statistical analysis of the minimum duration of disturbance events in historical abnormal samples, which can effectively filter out isolated noise points. If the second similarity score is not lower than the preset disturbance judgment threshold, the current real-time waveform sequence is determined to be in a consistent state, no potential abnormal instruction label is generated, and the real-time waveform sequence is marked as normal waveform data, continuing the monitoring process for subsequent waveforms.
[0047] For example, when the second similarity score is 0.68, which is lower than 0.72, it is judged as an anomaly. By backtracking the weighted distance component sequence, it is found that the weighted distance of 15 consecutive points starting from point 128 is greater than 0.45, while most points before that remain below 0.12. Therefore, point 128 is marked as the perturbation start point. Subsequently, the weighted distance component quickly falls back to below 0.18 near point 152 and remains stable. Then, point 152 is determined as the perturbation termination point.
[0048] It should be noted that, based on the time positions corresponding to the start and end points of the disturbance, the point index is converted into an actual time value based on the sampling frequency to generate an anomaly occurrence timestamp. The timestamp is represented in the form of a time interval corresponding to the start and end points. The specific conversion formula is that time equals the point index divided by the sampling frequency. For example, when the sampling frequency is 10000Hz, the 128th point corresponds to 12.8 milliseconds and the 152nd point corresponds to 15.2 milliseconds. The anomaly occurrence timestamp interval constructed in this way is 12.8 milliseconds to 15.2 milliseconds. The anomaly occurrence timestamp interval is combined with the anomaly type identifier and channel information to construct a potential anomaly instruction tag containing complete context information.
[0049] For example, the label format is “Voltage Channel - Firmware Update Stage - Abnormal Disturbance [12.8ms, 15.2ms] - Suspected Instruction Execution Deviation”, so as to quickly locate and identify the location and possible cause of abnormal waveforms in subsequent analysis.
[0050] It should be noted that perturbation waveform data refers to the data structure obtained by attaching potential abnormal instruction tags to the real-time waveform sequence after determining that there is a potential anomaly in the real-time waveform sequence. The tag is embedded in the metadata of the real-time waveform sequence in the form of structured data, thus forming perturbation waveform data with anomaly tags. This data retains all amplitude information of the original waveform sequence, and adds tag information to identify the abnormal time period and type for subsequent deep analysis by the Hidden Markov Model. It includes the anomaly occurrence timestamp interval, anomaly type identifier, channel information, and associated service event tags. In the firmware update scenario, when the perturbation interval covers the area about 3 milliseconds after the flash write mark, the tag format is specifically "Voltage Channel - After Flash Write - Abnormal Perturbation [12.8 milliseconds, 15.2 milliseconds] - Suspected Instruction Execution Deviation".
[0051] In step S16, the perturbation waveform data is input into a preset hidden Markov model for confidence analysis to obtain anomaly confidence stratification and anomaly type identification, including: The disturbance features are extracted from the disturbance waveform data to construct a multidimensional observation vector; The multidimensional observation vector is input into a preset hidden Markov model to obtain the state probability matrix corresponding to the current observation sequence; Based on the state probability matrix, the posterior probability is calculated using the Viterbi algorithm. If the maximum value of the posterior probability exceeds the preset initial stratification threshold, the maximum value of the posterior probability is determined as the basic confidence level. The basic confidence level is matched with a preset multi-level hierarchical interval to determine the corresponding anomaly confidence level and generate the corresponding anomaly type identifier.
[0052] It should be noted that the disturbance features include amplitude change rate, frequency offset, and change slope. The amplitude change rate is obtained by calculating the difference between the maximum and minimum amplitude values of the waveform within the sliding window, which is used to quantify the degree of energy mutation in the disturbance waveform data. The frequency offset is extracted by short-time Fourier transform to show the offset of the main frequency relative to the normal fundamental frequency within the window, reflecting spectral drift. The change slope is obtained by calculating the mean of the first-order difference of the waveform within the window, which characterizes the trend change of the waveform. The above three features are determined based on the analysis of typical patterns of physical signal anomalies caused by malware injection. The sliding window length is set to 10 sampling points according to the sampling frequency and the duration of the anomaly, which corresponds to 1.25 milliseconds at an 8000Hz sampling rate, and can cover the main changes of transient disturbances.
[0053] For example, considering the disturbance characteristics of the voltage waveform during firmware update, the peak value of 2.3, the trough value of 1.8, and the slope of change of 0.5 are calculated within a certain window, forming a three-dimensional observation vector [2.3, 1.8, 0.5] corresponding to the center point of the window. The window is traversed sequentially to traverse the entire abnormal interval, and a multi-dimensional observation vector is obtained for input into the hidden Markov model for state probability analysis.
[0054] It should be noted that the preset Hidden Markov Model is obtained by collecting a large number of multi-dimensional observation sequence vectors under historical normal operating conditions and training the parameters using the Baum-Welch algorithm. The model includes three preset states: normal state, suspicious state, and abnormal state, as well as the transition probability matrix between states and the observation probability distribution corresponding to each state. During training, iterative optimization is performed with the goal of maximizing the likelihood of the observation sequence until convergence. The historical sequence context is the identified state sequence within the previous time window of the current device, used to provide temporal prior information on state evolution. The historical alarm association marker is the same operation in the past. Records of abnormal events occurring during the service phase are used to adjust the initial state distribution of the model. Specifically, by setting historical alarm association markers to indicate that an abnormal event occurred at time t0 in the past, the initial probabilities of abnormal and suspicious states are adjusted to 0.4 and 0.3 respectively at the initial time of the current sequence, and the normal state is adjusted to 0.3. The default initial probability distribution of the model may be 0.8 for normal state, 0.1 for suspicious state, and 0.1 for abnormal state. After adjustment, the probabilities of the three states need to be renormalized to ensure that the sum of the probabilities is 1. If there are multiple historical alarm markers, the most recent one or a weighted average is used to adjust the initial probability distribution. When applying the model, the current multidimensional observation vector, the previous state sequence, and historical alarm markers are used as input. The forward-backward algorithm is used to calculate the posterior probability of being in each state at each time, that is, the probability of being in a certain state at a given observation sequence. The posterior probability matrix corresponding to the current observation sequence is obtained. The dimension of the matrix is the sequence length multiplied by the number of states, and each element represents the posterior probability value of being in the corresponding state at that time.
[0055] For example, if the probability of transitioning from a normal state to a normal state in historical data is 0.85, while the probability of a normal state calculated in the current sequence is only 0.3, it indicates that there may be a state deviation.
[0056] It should be noted that the preset initial stratification threshold is obtained by statistical analysis of the maximum posterior probability of a large number of historical normal samples. The distribution of the maximum posterior probability of normal samples under various business conditions is calculated, and the 95th quantile of the distribution, 0.7, is taken as the first stratification threshold to ensure that the probability of normal samples exceeding this threshold is less than 5%. Thus, samples with a maximum posterior probability higher than 0.7 are considered to have significant state confidence.
[0057] For example, if the probability value corresponding to the abnormal state in the posterior probability distribution calculated by the Viterbi algorithm is 0.75 and exceeds the threshold of 0.7, then 0.75 is determined as the basic confidence level, representing the confidence level that the current waveform is in an abnormal state.
[0058] It should be noted that the preset multi-level stratification intervals are determined based on the joint statistical analysis of the confidence distribution and business impact of various abnormal events in historical samples. Specifically, a large number of historical abnormal samples are collected, the basic confidence level of each sample is calculated and its actual harm level is marked, and the abnormal confidence stratification of samples with different harm levels is analyzed. 0.5 to 0.7 is divided into the low confidence abnormal interval corresponding to minor or occasional disturbances, 0.7 to 0.85 is divided into the medium confidence abnormal interval corresponding to suspicious behaviors that need attention, and 0.85 and above is divided into the high confidence abnormal interval corresponding to clear malicious activities. The lower limit of 0.5 is determined based on the upper limit of the 99% distribution of confidence of normal samples to ensure that normal samples do not fall into the abnormal interval. The dividing point between 0.7 and 0.85 is determined based on the inflection point of the cumulative distribution curve of confidence of verifiable attack events in historical samples.
[0059] For example, if the base confidence level is 0.75 and the anomaly type is identified as voltage deviation, then it is matched to the medium confidence interval of 0.7 to 0.85, and the corresponding anomaly type is identified as "medium confidence anomaly - voltage deviation". This identifier will be used for subsequent risk assessment and alarm generation.
[0060] In step S17, the step of performing priority matching based on the anomaly confidence level and the anomaly type identifier to generate an alarm signal with priority coding rules includes: The anomaly impact level value is obtained by searching based on the anomaly type identifier and the preset mapping table. Based on the aforementioned anomaly confidence stratification, a confidence weighting factor is generated. The confidence weighting factor is then weighted with the anomaly impact value to obtain a comprehensive risk score. The comprehensive risk score is input into a priority coding rule base for interval matching to generate a high-priority coding sequence; The high-priority encoded sequence, the anomaly type identifier, and the anomaly confidence are layered and encapsulated to generate an alarm signal with priority encoding rules.
[0061] It should be noted that the pre-built mapping table is constructed in advance through historical security incident data and business impact analysis. Specifically, it collects data on the actual consequences of various anomaly types in different business scenarios, and comprehensively scores each anomaly type from four dimensions: business continuity impact, data corruption probability, recovery cost, and security risk level. Each dimension is scored from 0 to 1, and the weighted average of the four dimensions is taken as the digital impact degree of the anomaly type, i.e., the degree of anomaly impact. The weights are preset according to the needs of the business scenario; for example, the weight of business continuity impact is 0.4, the weight of data corruption probability is 0.3, the weight of recovery cost is 0.2, and the weight of security risk level is 0.5. The overall risk level is weighted at 0.1. The impact of each anomaly type is quantified and scored based on expert evaluation. After normalizing the scores to a range of 0 to 1, a correspondence between anomaly type and its digital impact is established. For example, voltage deviation may lead to data writing errors during firmware updates, with a comprehensive impact assessment of 0.6. Unstable current may cause power supply anomalies, leading to device restarts, with an impact assessment of 0.8. Multiple mapping tables can be set up to adapt to different contexts based on business status and application scenarios. During retrieval, the corresponding mapping table is selected based on the current business status identifier, and then the corresponding digital impact value is obtained by matching the anomaly type identifier.
[0062] It should be noted that, based on the confidence level corresponding to the anomaly type identifier, the corresponding confidence weight factor is obtained from a preset confidence weight mapping table. This mapping table is constructed based on the correlation analysis between different confidence levels and the actual degree of harm in historical security events. Low confidence levels (basic confidence levels) in the range of 0.5 to 0.7 are mapped to a weight factor of 0.3; medium confidence levels (basic confidence levels) in the range of 0.7 to 0.85 are mapped to a weight factor of 0.7; and high confidence levels (basic confidence levels greater than 0.85) are mapped to a weight factor of 1.0. The weight factor increases with increasing confidence to reflect that high-confidence anomalies should be assigned a higher risk weight. The anomaly impact value is then compared with the... The comprehensive risk score is obtained by multiplying the confidence weight factors. That is, the comprehensive risk score is equal to the abnormal impact value multiplied by the confidence weight factor. Since both the abnormal impact value and the confidence weight factor are dimensionless numbers in the range of 0 to 1, their product also falls within the range of 0 to 1, which is consistent with the risk score range in the subsequent priority coding rule base and can be directly used for priority matching. Although this multiplicative weighting method does not introduce factors such as the duration or frequency of abnormality, it has fully realized the quantitative assessment of the risk level in the technical solution defined in this patent. Moreover, the weight factor and the impact are independent of each other, avoiding the problem of inconsistent dimensions and ensuring the rationality and comparability of the scoring results.
[0063] For example, if the digital impact is 0.6 and the anomaly type is identified as medium confidence with a corresponding confidence weight factor of 0.7, the overall risk score is 0.42; if it is high confidence with a corresponding weight factor of 1.0, the score is 0.6.
[0064] It should be noted that the preset priority coding rule base is constructed through joint statistical analysis of the risk score distribution and business impact of historical security events. Specifically, it collects a large number of historical abnormal events, calculates the comprehensive risk score of each event and marks its actual hazard level. By analyzing the score distribution range of events with different hazard levels, 0 to 0.3 is divided into the low priority range corresponding to negligible occasional disturbances, 0.3 to 0.6 is divided into the medium priority range corresponding to suspicious behaviors that need attention, and above 0.6 is divided into the high priority range corresponding to malicious activities that need to be dealt with immediately. The 0.3 dividing point is determined based on the distinction between normal fluctuations and slight anomalies in risk scores, and the 0.6 dividing point is determined based on the inflection point of the cumulative distribution curve of historical attack events' scores, ensuring that high priority covers more than 95% of real attack events. The priority coding sequence is represented by a three-bit binary code, for example, 001 represents low priority, 010 represents medium priority, and 100 represents high priority, so as to facilitate rapid identification and processing by the automated system.
[0065] For example, if the overall risk score is 0.72, it is matched to the high priority interval, and a priority coding sequence of 100 is generated.
[0066] It should be noted that encapsulation refers to combining the above information into a structured alarm message according to a preset data format. Specifically, it uses JSON format for encapsulation, which includes priority encoding fields such as high priority encoding sequence 100, the anomaly type identifier, and the anomaly confidence layer such as "combination of medium confidence voltage anomaly and low confidence current anomaly - firmware update stage", as well as an anomaly occurrence timestamp field such as "12.8ms to 15.2ms". The field separators and encoding rules are designed based on industry standard alarm protocols to ensure compatibility with various safety information and event management systems.
[0067] For example, the encapsulated alarm signal is "Priority code: 100, Anomaly details: Combination of medium confidence voltage anomaly and low confidence current anomaly - firmware update stage, timestamp: 12.8ms to 15.2ms". This signal can be directly pushed to the operation and maintenance platform or security response system to achieve rapid identification and handling of high-risk anomalies.
[0068] In summary, this invention discloses a side-channel-based method for detecting and protecting against malware on IoT terminals. The method includes acquiring power consumption data; extracting progressive evolution features through time-series analysis and matching them with pre-trained service state cluster centers to determine service state identifiers; locating candidate template sets from a template library based on the identifiers to determine a baseline waveform sequence and correlation strength value; aligning the baseline waveform with the real-time waveform to obtain aligned sequence pairs and retaining multi-channel synchronous acquisition markers; calculating the Euclidean distance between point pairs and weighting it with the correlation strength value to obtain a similarity score; if the score is below a threshold, it is identified as a potential abnormal instruction and a timestamp is appended to obtain perturbation waveform data; inputting the perturbation waveform data into a Hidden Markov Model to obtain anomaly confidence levels and the anomaly type identifier; finally, generating a comprehensive risk score and matching it with a priority coding rule library to encapsulate an alarm signal. This invention, through a multi-layered technical architecture of service state perception, adaptive waveform alignment, progressive anomaly analysis, and priority alarm generation, achieves high-precision, low-false-report detection of malware on IoT terminals. It effectively solves the technical problem of existing technologies struggling to combine device context state detection with unknown attacks launched using IoT vulnerabilities, significantly improving the security protection capabilities of IoT terminals.
[0069] Reference Figure 2 The second embodiment of the present invention provides a side-channel-based IoT terminal malware protection and detection system, comprising: The business status identification module acquires power consumption data of IoT terminals, extracts progressive evolution features through time series analysis, calculates the Euclidean distance between the progressive evolution features and the pre-trained centers of each business status cluster, and determines the business status identifier based on the obtained minimum Euclidean distance. The template matching module matches the service status identifier with a preset template library to obtain a baseline waveform sequence and a correlation strength value. The waveform alignment module acquires a real-time waveform sequence containing multi-channel synchronous acquisition markers, and aligns the reference waveform sequence with the real-time waveform sequence to obtain an aligned sequence pair. The similarity calculation module calculates the Euclidean distance between point pairs based on the aligned sequence pairs, and weights the Euclidean distance between point pairs based on the association strength value and the point pair Euclidean distance to obtain a second similarity score; If the second similarity score is lower than the preset disturbance judgment threshold, the anomaly preliminary judgment module generates a potential anomaly instruction tag and attaches the potential anomaly instruction tag to the real-time waveform sequence to obtain disturbance waveform data. The Hidden Markov Analysis module inputs the disturbance waveform data into a preset Hidden Markov model for confidence analysis to obtain anomaly confidence levels and anomaly type identifiers. The risk scoring and alarm generation module performs priority matching based on the anomaly confidence level and the anomaly type identifier to generate alarm signals with priority coding rules.
[0070] It should be noted that the side-channel-based IoT terminal malware protection and detection system provided in this embodiment of the invention is used to execute all the process steps of the side-channel-based IoT terminal malware protection and detection method in the above embodiments. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.
[0071] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.
[0072] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.
Claims
1. A method for protecting and detecting malware on IoT terminals based on side-channel technology, characterized in that, include: The power consumption data of IoT terminals is acquired, and progressive evolution features are extracted through time series analysis. The Euclidean distance between the progressive evolution features and the pre-trained service state cluster centers is calculated, and the service state identifier is determined based on the minimum Euclidean distance obtained. The baseline waveform sequence and correlation strength value are obtained by matching the business status identifier with the preset template library. A real-time waveform sequence containing multi-channel synchronous acquisition markers is acquired, and the reference waveform sequence is aligned with the real-time waveform sequence to obtain an aligned sequence pair. The point-to-point Euclidean distance is calculated based on the aligned sequence pairs, and a second similarity score is obtained by weighting the correlation strength value and the point-to-point Euclidean distance. If the second similarity score is lower than the preset disturbance judgment threshold, a potential abnormal instruction label is generated and appended to the real-time waveform sequence to obtain the disturbance waveform data; The disturbance waveform data is input into a preset hidden Markov model for confidence analysis to obtain anomaly confidence stratification and anomaly type identification. Priority matching is performed based on the anomaly confidence level and the anomaly type identifier to generate an alarm signal with priority coding rules.
2. The method for protecting and detecting malware on IoT terminals based on side channels according to claim 1, characterized in that, The process of acquiring power consumption data from IoT terminals, extracting progressive evolution features through time-series analysis, calculating the Euclidean distance between the progressive evolution features and the pre-trained service state cluster centers, and determining the service state identifier based on the obtained minimum Euclidean distance includes: Power consumption data of IoT terminals is collected from the sensor array, and the power consumption data is truncated using an adaptive sliding window to obtain a power consumption waveform sequence; Empirical mode decomposition is performed on the power consumption waveform sequence to obtain intrinsic mode function components. The slope change rate of the intrinsic mode function components is calculated to extract the gradual evolution characteristics. Calculate the Euclidean distance between the progressive evolution features and the pre-trained centers of each business state cluster to obtain a state matching degree list; If the minimum Euclidean distance in the state matching degree list is less than the preset judgment threshold, then the business state category corresponding to the minimum Euclidean distance is determined as the current business state identifier.
3. The method for protecting and detecting malware on IoT terminals based on side channels according to claim 2, characterized in that, The step of matching the service status identifier with a preset template library to obtain a baseline waveform sequence and correlation strength value includes: Based on the business status identifier, match the index node corresponding to the business status identifier from the multi-state hierarchical index of the preset template library; Extract all candidate waveform sequences attached to the index node, perform frequency domain analysis on the time series data of all candidate waveform sequences, and extract multiple fluctuation distribution feature vectors; The fluctuation distribution feature vector is compared one by one with the feature vector of the power consumption waveform sequence to obtain the first similarity score; The candidate waveform sequence with the highest first similarity score is selected as the reference waveform sequence, and the association strength value between the reference waveform sequence and the service status identifier is calculated based on the highest first similarity score.
4. The method for protecting and detecting malware on IoT terminals based on side channels according to claim 3, characterized in that, The step of acquiring a real-time waveform sequence containing multi-channel synchronous acquisition markers, and aligning the reference waveform sequence with the real-time waveform sequence to obtain an aligned sequence pair includes: Acquire a real-time waveform sequence containing multi-channel synchronous acquisition markers, and calculate the degree of time axis distortion between the reference waveform sequence and the real-time waveform sequence; When the time axis distortion is lower than a preset first distortion threshold, the reference waveform sequence and the real-time waveform sequence are linearly scaled to obtain an aligned sequence pair. When the time axis distortion degree is higher than the preset second distortion threshold, the reference waveform sequence and the real-time waveform sequence are subjected to nonlinear mapping processing to obtain an aligned sequence pair with uniform length.
5. The method for protecting and detecting malware on IoT terminals based on side channels according to claim 4, characterized in that, The step of calculating the Euclidean distance between point pairs based on the aligned sequence pairs, and weighting the result based on the association strength value and the Euclidean distance between point pairs to obtain a second similarity score, includes: Traverse the aligned sequence pairs and calculate the point-to-point Euclidean distance between the reference waveform amplitude and the real-time waveform amplitude; The Euclidean distance between the point pairs is weighted using the correlation strength value to generate a weighted distance value; The weighted distance values are normalized to determine the second similarity score.
6. The method for protecting and detecting malware on IoT terminals based on side channels according to claim 5, characterized in that, If the second similarity score is lower than a preset perturbation judgment threshold, a potential abnormal instruction label is generated and appended to the real-time waveform sequence to obtain perturbation waveform data, including: If the second similarity score is lower than the preset disturbance determination threshold, the current real-time waveform sequence is determined to be in an inconsistent state, and the weighted distance component in the real-time waveform sequence is searched. The start point and end point of the interval where the weighted distance component continuously exceeds the preset deviation threshold are respectively determined as the disturbance start point and disturbance end point. Based on the disturbance start point and disturbance end point, an anomaly occurrence timestamp is generated, and a potential anomaly instruction tag containing the anomaly occurrence timestamp is constructed; The potential anomaly instruction label is appended to the real-time waveform sequence to obtain the perturbation waveform data.
7. The method for protecting and detecting malware on IoT terminals based on side channels according to claim 1, characterized in that, The step of inputting the disturbance waveform data into a preset hidden Markov model for confidence analysis to obtain anomaly confidence stratification and anomaly type identification includes: The disturbance features are extracted from the disturbance waveform data to construct a multidimensional observation vector; The multidimensional observation vector is input into a preset hidden Markov model to obtain the state probability matrix corresponding to the current observation sequence. Based on the state probability matrix, the posterior probability is calculated using the Viterbi algorithm. If the maximum value of the posterior probability exceeds the preset initial stratification threshold, the maximum value of the posterior probability is determined as the basic confidence level. The basic confidence level is matched with a preset multi-level hierarchical interval to determine the corresponding anomaly confidence level and generate the corresponding anomaly type identifier.
8. The method for protecting and detecting malware on IoT terminals based on side channels according to claim 7, characterized in that, The step of performing priority matching based on the anomaly confidence level and the anomaly type identifier to generate an alarm signal with priority coding rules includes: The anomaly impact level value is obtained by searching based on the anomaly type identifier and the preset mapping table. Based on the aforementioned anomaly confidence stratification, a confidence weighting factor is generated. The confidence weighting factor is then weighted with the anomaly impact value to obtain a comprehensive risk score. The comprehensive risk score is input into a priority coding rule base for interval matching to generate a high-priority coding sequence; The high-priority encoded sequence, the anomaly type identifier, and the anomaly confidence are layered and encapsulated to generate an alarm signal with priority encoding rules.
9. A side-channel-based IoT terminal malware protection and detection system, characterized in that, include: The business status identification module acquires power consumption data of IoT terminals, extracts progressive evolution features through time series analysis, calculates the Euclidean distance between the progressive evolution features and the pre-trained centers of each business status cluster, and determines the business status identifier based on the obtained minimum Euclidean distance. The template matching module matches the service status identifier with a preset template library to obtain a baseline waveform sequence and a correlation strength value. The waveform alignment module acquires a real-time waveform sequence containing multi-channel synchronous acquisition markers, and aligns the reference waveform sequence with the real-time waveform sequence to obtain an aligned sequence pair. The similarity calculation module calculates the Euclidean distance between point pairs based on the aligned sequence pairs, and weights the Euclidean distance between point pairs based on the association strength value and the point pair Euclidean distance to obtain a second similarity score; If the second similarity score is lower than the preset disturbance judgment threshold, the anomaly preliminary judgment module generates a potential anomaly instruction tag and attaches the potential anomaly instruction tag to the real-time waveform sequence to obtain disturbance waveform data. The Hidden Markov Analysis module inputs the disturbance waveform data into a preset Hidden Markov model for confidence analysis to obtain anomaly confidence levels and anomaly type identifiers. The risk scoring and alarm generation module performs priority matching based on the anomaly confidence level and the anomaly type identifier to generate alarm signals with priority coding rules.