An anti-virus system for internet of things device terminals

Abstract

The application discloses an anti-virus system for an Internet of Things device terminal, and relates to the technical field of Internet of Things security.The system comprises an Internet of Things terminal, an edge gateway and a cloud server.The Internet of Things terminal is provided with a side channel feature extraction microprobe module, which collects hardware microarchitecture event data during device operation in combination with a kernel state probe and a hardware performance counter, normalizes the data into a feature vector, and performs local reasoning by an end-side detection model.The cloud server trains student models subjected to pruning and quantization processing based on a teacher model for different chip architectures, and distributes the student models to the terminal.The terminal verifies and completes the tracing and confirmation of an update package by a single hash chain.The application realizes low-overhead, cross-architecture and trusted update of the anti-virus detection of the Internet of Things terminal without decrypting traffic and relying on continuous networking upload, and solves the problems of large detection overhead, difficulty in cross-architecture generalization of the model and vulnerability of the update channel to hijacking and poisoning.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, specifically to an antivirus system for IoT device terminals. Background Technology

[0002] IoT devices are typically built on low-power microcontrollers or lightweight system-on-a-chip, running real-time operating systems or a trimmed Linux kernel. Their hardware resources are generally characterized by small memory capacity, limited storage space, and insufficient processor computing power; some terminals have less than 64 megabytes of usable memory. Processor frequencies are typically in the tens of megahertz to one gigahertz range. Modern processors generally have built-in hardware performance counters that can perform hardware-level counting of processor microarchitectural events such as cache access and branch prediction. Meanwhile, mainstream Linux kernels provide kernel-mode probe mounting mechanisms, supporting the running of sandbox programs in kernel mode for low-overhead monitoring of system calls, network transmission and reception, and other events. Furthermore, without modifying the kernel source code or recompiling the kernel, knowledge distillation and model quantization techniques have been used in the field of artificial intelligence to compress and deploy deep learning models with large parameter counts to embedded devices. This means that by having a student model with a smaller parameter count learn the output distribution of a teacher model with a larger parameter count, the student model can achieve inference performance close to that of the teacher model while maintaining a smaller scale. In the field of distributed systems, the hash tree structure of blockchain is used for data integrity verification. It has the asymmetric computation characteristics of storing the root hash on the chain and verifying the hash path off the chain. The verifier only needs to hold the root hash and hash path to verify whether a data block belongs to the hash tree without downloading all the data.

[0003] Currently, the industry's solutions for addressing IoT terminal security issues mainly fall into two categories: network bypass traffic detection solutions and cloud-based centralized AI detection solutions. Network bypass traffic detection solutions deploy deep packet inspection devices at gateways or core switching nodes to perform feature matching and anomaly detection on passing network traffic. A typical process involves parsing and restoring the protocol of the gateway's mirrored traffic, and then judging anomalies based on a signature library and issuing alarms and blocking commands. Cloud-based centralized AI detection solutions involve IoT terminals periodically uploading raw behavior logs or network traffic to a cloud server. The cloud uses a deep learning model with a large parameter scale to perform unified inference and judgment, and then sends the detection results back to the terminal for processing. In this solution, the terminal only undertakes data collection and uploading functions and does not deploy any local detection models. Updates to the detection models are usually pushed directly to the terminal using ordinary hypertext transfer protocols or file transfer protocols.

[0004] The two existing solutions mentioned above have the following shortcomings: First, since most traffic from IoT devices is currently transmitted in encrypted form, deep packet inspection devices cannot decrypt it and therefore cannot obtain the traffic payload content, which limits their feature matching capabilities. Even if statistical feature analysis is performed on encrypted traffic, the detection granularity is limited to the network layer, and it cannot detect malicious execution behavior at the device's internal firmware layer. It is also difficult to effectively identify malicious code that has already resided inside the device but has not yet generated abnormal network behavior. Second, cloud-based centralized detection solutions require continuous uploading of raw logs and traffic to the cloud, which consumes a lot of terminal bandwidth and cloud storage and computing resources, and there is a detection latency, making it difficult to meet the requirements for real-time detection and removal. Third, single models trained in the cloud cannot accommodate heterogeneous systems such as ARM, MIPS, and RISC-V. The differences in behavioral feature distribution on chip architecture terminals lead to insufficient cross-architecture generalization ability, and false positives and false negatives are common. Fourth, the model update channels in this solution generally lack cryptographic-based tracing and verification mechanisms. Once the update server or transmission link is compromised, attackers can use the update channel to deploy tampered detection models to a large number of terminals. However, due to limited resources, the terminals cannot bear the complex overhead of certificate chain verification or full hash comparison, forming a weak link in the security loop. In summary, the existing technology still lacks a complete anti-virus solution that can simultaneously take into account low detection overhead, resistance to encrypted traffic interference, cross-architecture generalization ability, and trusted verification capability of update channels in an ultra-lightweight IoT terminal environment. Therefore, we propose an anti-virus system for IoT device terminals. Summary of the Invention

[0005] The purpose of this invention is to provide an antivirus system for Internet of Things (IoT) device terminals.

[0006] The technical problem this invention aims to solve is that existing antivirus solutions for IoT terminals have high detection overhead, cannot detect malicious behavior in the firmware layer hidden by encrypted traffic, and their detection models are difficult to adapt to heterogeneous chip architecture terminals, and the model update channel lacks a low-overhead trusted verification mechanism. Therefore, this invention provides an antivirus system that is suitable for resource-constrained IoT terminals, does not rely on traffic decryption, has cross-chip architecture generalized detection capabilities, and has a low-overhead trusted verification mechanism in the update channel.

[0007] To address the aforementioned technical problems, the present invention employs the following technical solution: an antivirus system for IoT device terminals, comprising an IoT terminal, an edge gateway, and a cloud server. The IoT terminal is equipped with a side-channel feature extraction micro-probe module and an edge detection model. The side-channel feature extraction micro-probe module collects hardware microarchitecture event data during device operation based on a kernel-mode mounted probe and a processor hardware performance counter. Without decrypting network traffic or performing a full file system scan, the module normalizes the collected raw event counts to construct a feature vector reflecting the device's current behavioral state. This feature vector is then passed to the edge detection model, which performs local inference on the feature vector and outputs a malicious behavior confidence score. The cloud server is equipped with a knowledge distillation engine, based on multiple... A teacher model with a large parameter scale is obtained by training historical behavior samples of the chip architecture. For each target chip architecture, a student model is generated that matches the computing power and storage constraints of the architecture and has undergone structured pruning and weight quantization. The student model is then distributed to the IoT terminal as the edge detection model for the corresponding architecture. The edge gateway is equipped with a blockchain light node module, which is responsible for constructing a hash tree from the model update package digest and submitting the root hash to the blockchain network to complete the on-chain notarization calculation task. After receiving the update package body and the corresponding hash path proof data, the IoT terminal obtains the local reconstructed root hash through a single hash chain recursive calculation and compares it with the on-chain notarization root hash read from the edge gateway. Only if the comparison is consistent will the update package be loaded, thereby completing the trusted verification of the update package source with almost no increase in the terminal's computing power burden.

[0008] Compared with the prior art, the beneficial effects of the present invention by adopting the above technical solution are as follows:

[0009] 1. The side-channel feature extraction micro-probe module of this invention constructs feature vectors based on kernel-mode probe mount points and hardware performance counter reading interfaces. It does not require decrypting network traffic or performing a full scan of the file system. Since the micro-probe module only performs periodic reading of hardware performance counters and lightweight normalization operations, it does not involve high-overhead operations such as traffic decryption and full scan. According to theoretical calculations, the acquisition overhead can be controlled within one percent of the total processor load. It also has natural immunity to malicious traffic using encrypted transmission and can detect abnormal execution behavior of the device's internal firmware layer.

[0010] 2. This invention uses a knowledge distillation architecture that combines a cloud-based teacher model with a device-side polymorphic student model to generate differentiated detection models that have undergone pruning and quantization for different chip architectures. The size of the detection model can be compressed to the level of hundreds of KB. While maintaining a high detection accuracy, it solves the problem of model generalization under heterogeneous chip architectures and has the ability to detect and kill unknown polymorphic viruses and zero-day variants in real time locally.

[0011] 3. This invention utilizes an edge gateway to act as a light node in the blockchain, transferring the computational overhead of hash tree construction and consensus interaction for update packet digests from the terminal side to the edge gateway side. The IoT terminal only needs to perform one hash chain verification operation to complete the traceability and confirmation of the update packet. This effectively prevents the risk of hijacking and poisoning of the update channel without increasing the terminal's computing power burden. Ultimately, it forms a complete security closed loop integrating detection, judgment, and update in a resource-constrained environment. In existing technologies, anti-virus solutions for IoT terminals generally deploy side-channel detection, model compression, and update channel verification as independent technical links, without considering the collaborative adaptation relationship of the three in resource-constrained scenarios. This invention breaks through this conventional design approach by deploying the three types of technical links in layers according to their respective computational characteristics on the terminal, edge gateway, and cloud. This allows the detection overhead, model generalization ability, and update credibility verification overhead to be synergistically optimized under the same resource constraints, forming a non-obvious overall technical effect. Attached Figure Description

[0012] Figure 1 This is a schematic diagram of the side channel feature extraction process in an embodiment of the present invention;

[0013] Figure 2 This is a schematic diagram of the cloud-based knowledge distillation lightweight model training and distribution process in an embodiment of the present invention;

[0014] Figure 3 This is a schematic diagram of the edge blockchain trusted update package verification process in an embodiment of the present invention. Detailed Implementation

[0015] The following is in conjunction with the appendix Figure 1-3 The specific embodiments of the present invention will be further described below. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.

[0016] Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0017] The antivirus system described in this invention adopts a three-layer collaborative architecture consisting of an IoT terminal layer, an edge gateway layer, and a cloud server layer. The IoT terminal layer integrates a side-channel feature extraction micro-probe module and an edge detection model, which are connected to the hardware performance counter register and kernel-mode probe mounting point of the hardware layer. The edge gateway layer deploys a blockchain light node module and a hash tree construction unit. The cloud server layer deploys a teacher model training platform and a knowledge distillation engine. There are three types of data flows between the three layers: feature alarm reporting flow from the terminal to the edge gateway, model policy update distribution flow from the cloud to the terminal via the edge gateway, and update summary uploading flow from the edge gateway to the blockchain network. The three core functional modules work together to form a complete security closed loop that combines side-channel feature acquisition, real-time edge AI detection, and trusted verification of update channels.

[0018] I. Firmware-level lightweight side-channel feature extraction micro-probe module:

[0019] This module is deployed in the kernel layer of the IoT terminal. Its core principle is to use the kernel-mode probe mounting point unit and the hardware performance counter reading unit to periodically collect the hardware microarchitecture execution sequence features of the device during operation without decrypting network traffic or performing a full scan of the file system. After being processed by the feature vector construction unit, the feature vector output interface is output to the edge detection model.

[0020] During the kernel startup phase, the micro-probe module loads the pre-compiled probe program to key kernel paths such as system call entry points and interrupt handling entry points through the kernel-mode probe loading interface. At the same time, it registers the types of hardware events to be monitored with the processor's hardware performance counter register group. The monitored hardware event types include cache misses, branch prediction failures, and instruction pipeline blocking cycles. The micro-probe module sets a collection time window and continuously reads the raw count values ​​of the hardware performance counter register within each time window. It also records the system call sequence and its frequency captured by the kernel-mode probe. At the end of the time window, the micro-probe module processes the collected raw count values ​​according to a preset normalization method to obtain normalized feature components. The normalized feature components are then concatenated in a preset order to construct a complete feature vector.

[0021] The feature vector constructed in this module can be represented as:

[0022] ;

[0023] in, Indicates within the time window Built-in feature vectors Indicates the first Hardware microarchitecture events in time windows Normalized statistics within, , The total number of selected hardware event categories, such as cache miss rate, branch prediction failure rate, and instruction pipeline blocking cycle percentage;

[0024] The normalization calculation method for each component is as follows:

[0025] ;

[0026] in, Indicates the first Hardware-like events in time windows The original count value within, and These represent the minimum and maximum values ​​of this type of event in historical statistics, used to normalize the original count values ​​to an interval. To eliminate the impact of differences in the counter dimensions of different hardware platforms on subsequent model inference, the micro probe module transmits the constructed feature vector to the inference input of the edge detection model through the local inter-process communication interface, and clears the current window counter register to enter the acquisition cycle of the next time window.

[0027] For more restricted kernel environments, such as certain bare-metal real-time operating system platforms, where hardware performance counter access is not granted or kernel-mode probe mounting mechanisms are not supported, this module can also use a lightweight system call sequence monitoring method. This involves inserting a counting hook at the system call distribution entry point to statistically analyze the frequency distribution of various system calls within a unit time window. This data is then used as the source for constructing feature vectors. This approach can reflect the device's runtime behavior characteristics without decrypting network traffic, achieving a detection effect similar to the hardware performance counter solution.

[0028] II. Cross-Architecture Adaptive Knowledge Distillation Miniature Artificial Intelligence Detection Engine Module:

[0029] This module employs a knowledge distillation architecture that combines cloud-based teacher model training with edge-side multi-morphic student model inference. This architecture addresses the challenge of detection model generalization caused by heterogeneous chip architectures in IoT devices. The cloud server collects historical behavior feature vector samples from IoT terminals covering various chip architectures, including ARM, MIPS, and RISC-V, and labels them with malicious and benign tags to form a training sample set. Based on this training sample set, the cloud server trains a teacher model with a large parameter scale. Once the model reaches a preset detection accuracy threshold on the validation set, the teacher model parameters are frozen. For each target chip architecture, the knowledge distillation engine initializes a small-scale student model that matches the computing power and storage constraints of that architecture. The same batch of training samples is then input into the teacher model and the corresponding student model to obtain their respective output logical values.

[0030] During knowledge distillation training, the overall loss function of the student model is defined as:

[0031] ;

[0032] in, This represents the total loss value used for training the student model. This represents the true label of the sample, taking one of two values: malicious or benign. This represents the raw logical value of the student model's output layer. This represents the raw logical value of the teacher model's output layer. Represents the normalized exponential function, This represents the distillation temperature coefficient, with a value greater than one, and is used for softening probability distribution. This represents the cross-entropy loss function, used to measure the deviation between the student model's predictions and the true labels. This represents the relative entropy loss function, used to measure the deviation between the output probability distributions of the student model and the teacher model. This represents the weighting coefficient, with a value range of [interval]. A specific value within this range is used to balance the proportion of learning from real labels and imitating teacher-provided soft labels;

[0033] The loss value of the current batch is calculated according to the overall loss function described above, and the corresponding student model parameters are updated through the backpropagation algorithm. This process is repeated until the student model converges. The converged student model is then subjected to structured pruning and weight quantization processing in sequence. For example, the 32-bit floating-point weights are quantized into 8-bit integers to generate the final lightweight model file that meets the storage constraints of the target architecture. The cloud server distributes the lightweight student model files corresponding to each architecture to the corresponding IoT terminals through the trusted update mechanism described later. After the terminal is loaded, it can perform real-time inference on the aforementioned feature vectors locally, output the confidence score of malicious behavior, and trigger local alarms and isolation measures when the score exceeds a preset threshold.

[0034] III. Edge-Assisted Blockchain Trusted Update Anti-Hijacking Module:

[0035] This module introduces an edge gateway as a light node in the blockchain, which bears the main computational overhead of hash tree construction and consensus interaction. The IoT terminal only needs to perform a lightweight cryptographic verification once to complete the traceability confirmation of the update package. After the cloud server generates the incremental update package of the model or strategy, it performs a hash operation on the update package body to obtain the leaf hash value, and sends the update package body together with the leaf hash value to the edge gateway. The edge gateway summarizes the leaf hash values ​​of multiple update packages to be distributed in its jurisdiction, pairs them up in pairs according to the hash tree construction rules, and calculates them layer by layer to finally generate the hash tree root hash. As a light node in the blockchain, the edge gateway submits the root hash and related transaction metadata to the blockchain network. After consensus confirmation, it completes the on-chain notarization and forms an immutable on-chain notarization root hash.

[0036] When an IoT terminal initiates an update request, the edge gateway sends the corresponding update package to the terminal, along with a set of sibling node hash values ​​for each layer of the corresponding path in the hash tree. The IoT terminal performs a local hash operation on the received update package to obtain the initial leaf hash value. Then, following the hash chain recursive formula and combining it with the received sibling node hash value set, it calculates layer by layer to finally obtain the local reconstructed root hash. The hash chain recursive formula is expressed as:

[0037] ;

[0038] in, This represents the initial leaf hash value calculated using a hash function for the update package body to be verified. Represents a cryptographic hash function. This indicates the first hash path proof data. The hash value of the sibling node of the layer, symbol This represents the bit string concatenation operation. Indicates the recursive calculation up to the nth The intermediate hash value obtained from the layer, This represents the number of levels in the hash tree, i.e., the total length of the path proof data, and is the final calculated value. This is the root hash value reconstructed locally at the terminal, which is then compared with the on-chain evidence-stored root hash. Perform a comparison; if the conditions are met... If the update package is found to be tamper-proof and of reliable origin, the terminal loads and applies the update package. If the comparison results are inconsistent, the terminal refuses to load the update package and reports an alarm to the edge gateway.

[0039] In the aforementioned blockchain-based trusted update verification mechanism, an alternative implementation based on a trusted execution environment can also be adopted. That is, the edge gateway or cloud update server holds the private key to digitally sign the update package digest. The trusted execution environment security zone built into the IoT terminal only needs to use the pre-set public key to verify the signature, without building a hash tree and maintaining a blockchain ledger. This can also achieve trusted verification of the update package source, and is more adaptable to closed industrial network environments that do not have blockchain network access conditions.

[0040] IV. Application Examples:

[0041] Taking a smart gateway terminal deployed in an industrial site as an example, this terminal uses an ARM architecture processor with approximately 32 megabytes of available memory. After system deployment, the micro-probe module continuously collects hardware microarchitecture event data of the terminal at fixed intervals and constructs feature vectors. The edge detection model performs local inference on the feature vectors based on the student model issued under the corresponding ARM architecture. When the terminal is invaded by a polymorphic variant of malicious code that did not appear in the training samples before, although the malicious code does not generate abnormal traffic that can be detected by the network layer, the cache access pattern and instruction pipeline blocking characteristics caused by its execution process are deviated. Based on this, the malicious behavior confidence score output by the edge detection model exceeds the preset threshold, thereby triggering local alarms and isolation. When the cloud server issues the student model update package to the batch of terminals, the edge gateway constructs the update package digest together with the update digests to be distributed to other terminals into a hash tree and completes the on-chain storage. When the terminal receives the update package, it verifies and confirms the source of the update package is trustworthy through the local hash chain before loading it. Thus, the entire detection and update process does not rely on the decryption operation of network traffic, nor does it generate a continuous cloud data upload burden.

[0042] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of the present invention. Therefore, any modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope defined by the claims of the present invention.

Claims

1. An antivirus system for Internet of Things (IoT) device terminals, characterized in that, This includes IoT terminals, edge gateways, and cloud servers; The IoT terminal is equipped with a side-channel feature extraction micro-probe module and an edge detection model. The side-channel feature extraction micro-probe module is used to collect hardware microarchitecture event data during device operation based on kernel-mode probes and processor hardware performance counters. The collected hardware microarchitecture event data is normalized to construct a feature vector reflecting the current behavior state of the device. The feature vector is output to the edge detection model. The edge detection model is used to infer from the feature vector and output a malicious behavior confidence score. The cloud server is equipped with a knowledge distillation engine, which is used to generate student models that have undergone pruning and quantization processing based on the teacher model trained in the cloud for various target chip architectures. The student model corresponding to the chip architecture of the IoT terminal is then sent to the IoT terminal as the edge detection model. The edge gateway is equipped with a blockchain light node module. This module receives the update package body and leaf hash values ​​from the cloud server, constructs a hash tree from the leaf hash values ​​of multiple update packages to be distributed, calculates the root hash, and submits the root hash to the blockchain network for on-chain notarization. The IoT terminal also initiates an update request to the edge gateway, receives the update package body and hash path proof data returned by the edge gateway, performs layer-by-layer hash calculation based on the hash path proof data and the locally reconstructed leaf hash values ​​to obtain the locally reconstructed root hash, compares the locally reconstructed root hash with the on-chain notarized root hash read from the edge gateway, loads the update package if the comparison results match, and refuses to load and reports an alarm to the edge gateway if the comparison results do not match.

2. The antivirus system for IoT device terminals according to claim 1, characterized in that: The side-channel feature extraction micro-probe module is specifically used for: mounting the pre-compiled probe program to the system call entry point and interrupt handling entry point through the kernel-mode probe loading interface; registering the hardware event types to be monitored with the processor's hardware performance counter register group; continuously reading the raw count values ​​of the hardware performance counter register within a preset time window; recording the system call sequence and call frequency captured by the probe; and at the end of the preset time window, normalizing the collected raw count values ​​to obtain normalized feature components, and concatenating the normalized feature components in a preset order to construct the feature vector.

3. The antivirus system for IoT device terminals according to claim 2, characterized in that: The normalization process specifically involves dividing the difference between the original count value of a certain type of hardware event within the preset time window and the lower limit of the historical statistical interval of that type of hardware event by the difference between the upper and lower limits of the historical statistical interval of that type of hardware event, thereby obtaining the normalized feature component corresponding to that type of hardware event. This is used to eliminate the impact of differences in the count dimensions of different hardware platforms on subsequent model inference.

4. The antivirus system for IoT device terminals according to claim 1, characterized in that: The side-channel feature extraction micro-probe module is also used to: insert a counting hook at the system call distribution entry point when the processor does not have access to the hardware performance counter and the kernel does not support the kernel-mode probe mounting mechanism, to count the call frequency distribution of various system calls within the preset time window, and to construct the feature vector based on the call frequency distribution.

5. The antivirus system for IoT device terminals according to claim 1, characterized in that: The cloud server is also used for: collecting historical behavior feature vector samples of IoT terminals covering multiple chip architectures, labeling them with malicious and benign tags to form a training sample set; training the teacher model based on the training sample set; freezing the parameters of the teacher model after the detection accuracy of the teacher model on the validation set reaches a preset threshold; initializing a student model that matches the computing power and storage constraints of each target chip architecture for each target chip architecture; inputting the training sample set into the teacher model and the corresponding student model respectively to obtain the output logic values ​​of the teacher model and the student model; updating the parameters of the student model through backpropagation based on the overall loss value until the student model converges; and performing structured pruning and weight quantization processing on the converged student model in sequence to generate a student model that meets the storage constraints of the target chip architecture.

6. The antivirus system for IoT device terminals according to claim 5, characterized in that: The overall loss value is obtained by weighted summation of cross-entropy loss value and relative entropy loss value. The cross-entropy loss value is used to measure the deviation between the predicted result output by the student model and the true label of the sample. The relative entropy loss value is used to measure the deviation between the probability distribution output by the student model after softening by the distillation temperature coefficient and the probability distribution output by the teacher model.

7. The antivirus system for IoT device terminals according to claim 1, characterized in that, The edge gateway is specifically used for: receiving the update package body issued by the cloud server, performing a hash operation on the update package body to obtain the leaf hash value, summarizing the leaf hash values ​​of multiple update packages to be distributed within its jurisdiction, pairing them up in pairs and calculating layer by layer according to the hash tree construction rules to generate the hash tree root hash, submitting the hash tree root hash and related transaction metadata to the blockchain network, completing the on-chain notarization after consensus confirmation, and when receiving an update request initiated by the IoT terminal, issuing the corresponding update package body to the IoT terminal, and providing the set of sibling node hash values ​​of the update package at each layer of the corresponding path in the hash tree.

8. The antivirus system for IoT device terminals according to claim 7, characterized in that: The IoT terminal is specifically used for: performing a local hash operation on the received update package body to obtain a local leaf hash value; concatenating and hashing the local leaf hash value with the set of hash values ​​of the sibling nodes layer by layer to obtain a local reconstruction root hash; reading the on-chain evidence root hash from the edge gateway; comparing the local reconstruction root hash with the on-chain evidence root hash; loading and applying the update package when the comparison result is consistent; refusing to load the update package when the comparison result is inconsistent; and reporting an alarm message to the edge gateway.

9. An antivirus system for IoT device terminals according to claim 1, characterized in that: The edge detection model is also used to trigger a local alarm and perform isolation measures on the corresponding process when the confidence score of the malicious behavior exceeds a preset threshold.

Images