Security enhancement method and device applied to embedded device, and electronic medium

Abstract

The application relates to a security enhancement method and device applied to an embedded device, and an electronic medium, and belongs to the technical field of network security. The method comprises the following steps: monitoring network session establishment behavior features, network data flow features and operation request sequences of system resources related to a target device; generating a feature vector representing the current behavior state of the target device based on one or more of the network session establishment behavior features, the network data flow features and the operation request sequences of system resources; processing the feature vector by using an unsupervised anomaly detection model to calculate an anomaly measurement value representing the degree of deviation of the feature vector from a normal behavior mode; comparing the anomaly measurement value with a preset judgment condition; and executing a preset security response strategy when the comparison result meets the judgment condition. The application has the effect of efficiently detecting unknown network attacks in real time.

Description

Technical Field

[0001] This application relates to the technical field of network security, and in particular to a security enhancement method, apparatus, electronics, and media for embedded devices. Background Technology

[0002] With the proliferation of the Internet of Things (IoT) and smart devices, embedded devices have been widely used in various scenarios, such as smart homes, industrial control, smart offices, and smart education. These devices typically run on specific operating systems, such as OpenHarmony, and achieve interconnection and collaborative operation between devices through its OpenHarmony distributed soft bus.

[0003] This high level of connectivity, while bringing convenience, also introduces new security risks. Because embedded devices are typically deployed in open or semi-open network environments, they become targets for network attackers. Attackers may use methods such as device spoofing, man-in-the-middle attacks, and malicious data injection to infiltrate the device network, steal sensitive information, disrupt normal system operation, or even use them as springboards to attack other devices in the network.

[0004] Traditional network security measures, such as signature-based intrusion detection systems (IDS) or firewalls, primarily rely on known attack signature databases. This mechanism is effective against known attacks with explicit signatures, but it falls short against zero-day attacks, advanced persistent threats (APTs), and customized attacks targeting specific systems (such as the OpenHarmony distributed soft bus). Attackers can bypass signature-based detection with just minor modifications to their attack code.

[0005] Furthermore, embedded devices inherently possess limited resources, with their computing power (CPU), memory capacity (RAM), and power consumption all subject to strict constraints. Therefore, directly porting complex security models that consume enormous resources from servers or desktop computers to embedded devices is not feasible. These heavyweight solutions would severely degrade the performance of normal device operations, or even render the device unusable.

[0006] Therefore, existing technologies are insufficient for real-time and efficient detection of unknown network attacks on resource-constrained embedded devices, resulting in drawbacks such as low detection accuracy, high resource consumption, and inability to effectively respond to zero-day attacks. Summary of the Invention

[0007] To detect unknown network attacks in real time and efficiently, this application provides a security enhancement method, apparatus, electronics, and media for embedded devices.

[0008] Firstly, this application provides a security enhancement method for embedded devices, employing the following technical solution: A security enhancement method for embedded devices includes: Monitor the network session establishment behavior characteristics, network data flow characteristics, and operation request sequences of system resources related to the target device; Based on one or more of the network session establishment behavior characteristics, the network data flow characteristics, and the sequence of operation requests to system resources, a feature vector characterizing the current behavioral state of the target device is generated. The feature vector is processed using an unsupervised anomaly detection model to calculate an anomaly metric that characterizes the degree to which it deviates from the normal behavior pattern. The abnormal measurement value is compared with the preset judgment conditions; When the comparison result meets the determination condition, the preset security response strategy is executed.

[0009] Optionally, the unsupervised anomaly detection model is the Isolation Forest algorithm model.

[0010] Optionally, the network session establishment behavior characteristics include: the number of times the target device requests or accepts an OpenHarmony distributed soft bus connection within a preset time unit.

[0011] Optionally, the network data stream characteristics include at least one of the following: data transmission rate, packet size distribution, and packet transmission time interval pattern.

[0012] Optionally, the sequence of operation requests for system resources includes: the order and combination of requests for access to sensitive system permissions by the target device during distributed soft bus communication.

[0013] Optionally, the security response strategy includes: downgrading the permissions of the current communication and issuing an alarm.

[0014] Optionally, the method further includes: The isolated forest algorithm model is integer quantized and deployed on the neural network processing unit (NPU) of the embedded device for inference. Direct Memory Access (DMA) technology is used to achieve zero-copy data transfer between the processor core and the NPU.

[0015] Secondly, this application provides a security enhancement device for embedded devices, employing the following technical solution: A security enhancement device for embedded devices, comprising: The target device monitoring module is used to monitor the network session establishment behavior characteristics, network data flow characteristics, and operation request sequences of system resources related to the target device. The feature vector generation module is used to generate a feature vector characterizing the current behavioral state of the target device based on one or more of the network session behavioral features, the network data flow features, and the sequence of operation requests to system resources. The anomaly measurement calculation module is used to process the feature vector using an unsupervised anomaly detection model and calculate an anomaly measurement value that characterizes the degree to which it deviates from the normal behavior pattern. An anomaly condition judgment module is used to compare the anomaly measurement value with preset judgment conditions; The security policy execution module is used to execute preset security response policies.

[0016] Thirdly, this application provides an electronic device that adopts the following technical solution: An electronic device includes a processor coupled to a memory; The processor is configured to execute a computer program stored in the memory, such that the electronic device executes the computer program of the security enhancement method for an embedded device as described in any of the first aspects.

[0017] Fourthly, this application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium storing a computer program capable of being loaded by a processor and executing the security enhancement method for an embedded device as described in any of the first aspects.

[0018] In summary, this application includes at least one of the following beneficial technical effects: 1. Improved detection capability for unknown attacks. By employing an unsupervised anomaly detection method based on behavioral fingerprints, rather than the traditional method relying on fixed signatures, this invention can effectively identify new or variant attacks such as zero-day attacks and device spoofing, greatly enhancing the security protection capabilities of embedded devices.

[0019] 2. Efficient deployment on resource-constrained devices is achieved. This invention selects the computationally inefficient isolated forest model and combines it with optimization techniques such as NPU hardware acceleration and DMA zero-copy direct memory access, significantly reducing the computational, memory, and power consumption overhead during the detection process. This allows it to run continuously on embedded devices without affecting the performance of the main business.

[0020] 3. Ensures real-time detection and low latency. Through coordinated optimization of algorithms and hardware deployment, end-to-end detection latency is extremely low, enabling rapid response to network threats and preventing the escalation of security incidents due to excessive detection latency.

[0021] 4. It balances high detection rate with low false alarm rate. By comprehensively analyzing multi-dimensional behavioral characteristics such as network sessions, data streams, and operation sequences, a more accurate device behavior profile is constructed. This effectively captures anomalies while reducing false positives on normal behavior, thus improving the availability and reliability of the security solution. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the system architecture provided for an embodiment of the present invention.

[0023] Figure 2 This is a flowchart of a method provided in an embodiment of the present invention.

[0024] Figure 3 This is a schematic diagram comparing the key performance indicators of the method of this invention and the traditional method.

[0025] Figure 4 This is a hardware architecture block diagram provided for an embodiment of the present invention. Detailed Implementation

[0026] The present application will be further described in detail below with reference to the accompanying drawings.

[0027] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0028] In the description of this invention, it should be understood that the term "embedded device" refers to the hardware platform on which the method and apparatus of this invention are applied, specifically referring to intelligent devices such as interactive flat panels that possess certain computing capabilities but are resource-constrained (e.g., computing power, power consumption, memory). With the development of intelligent office and educational informatization, these devices face increasingly severe security challenges when interconnecting via the OpenHarmony distributed soft bus, such as device spoofing, man-in-the-middle attacks, and zero-day attacks. This invention addresses this background by proposing an innovative security enhancement scheme. Its core idea is to construct a behavioral fingerprint of the target device on the embedded device side, without relying on a fixed attack signature library, and to perform real-time analysis using a lightweight unsupervised anomaly detection model. This allows for the identification of any anomalies deviating from normal behavior patterns, effectively defending against unknown attacks, while also taking into account the limited resources of embedded devices.

[0029] Reference Figure 2 This invention provides a security enhancement method for embedded devices, the core process of which includes multiple steps. First, in step S201, the system continuously monitors various behavioral data related to the target device, which comprehensively reflects the device's state during network interactions. Next, in step S202, based on the monitored raw data, a feature vector is generated that quantifies the current behavioral state of the target device. Then, in step S203, a pre-deployed unsupervised anomaly detection model is used to process the feature vector to calculate an anomaly metric. In step S204, the calculated anomaly metric is compared with a preset judgment condition. Finally, in step S205, when the comparison result meets the judgment condition, the system executes a preset security response strategy. This process, by constructing and analyzing behavioral profiles in real time at the device side, achieves rapid response to dynamically changing attack behaviors.

[0030] As a preferred implementation, the unsupervised anomaly detection model can specifically be the Isolation Forest algorithm. The Isolation Forest algorithm is chosen because it is lightweight and efficient, and does not require pre-labeling a large number of anomaly samples for training. This model constructs multiple decision trees by randomly selecting features and split points. Normal points typically require more splits to be isolated, while anomaly points are isolated quickly. Therefore, the average path length required for a sample point to be isolated in the forest can be used as a measure of its anomaly degree. This characteristic makes the Isolation Forest model very suitable for deployment on embedded devices with relatively limited computing power and memory resources, enabling efficient anomaly detection tasks without affecting the device's main functional performance.

[0031] Furthermore, to efficiently execute this method on resource-constrained embedded devices, this invention also proposes a hardware-software co-optimization deployment scheme. (See reference...) Figure 4 This solution leverages the hardware characteristics of modern heterogeneous SoCs (System-on-a-Chip). Specifically, the Isolation Forest algorithm model can be first integer-quantized and then deployed on the Neural Processing Unit (NPU) 430 of the embedded device for inference. By offloading the complex model computation task to a dedicated hardware acceleration unit, the load on the central processing unit (CPU) can be significantly reduced. Simultaneously, to reduce latency and power consumption caused by data transfer between different processing units, the solution employs Direct Memory Access (DMA) technology. By configuring the DMA controller 450, zero-copy data transfer can be achieved between the processor core (such as the A55 420 small core) and the NPU 430. Feature vectors can be directly transferred from the system memory DRAM 440 to the NPU for computation without CPU intervention. This design makes the data path extremely efficient, which is key to achieving low-latency detection.

[0032] In the present invention, the features used to construct behavioral fingerprints are multi-dimensional. Specifically, network session establishment behavior features can include the number of times a target device requests or accepts OpenHarmony distributed soft bus connections within a preset time unit. For example, a device controlled by malware may initiate a large number of invalid connection requests in a short period of time, causing its connection establishment frequency to be significantly different from that of normal devices. By monitoring this feature, such scanning or connection storm attacks can be effectively identified.

[0033] Similarly, network data flow characteristics can include at least one of the following: data transmission rate, packet size distribution, and packet transmission time interval patterns. Normal communication between devices typically exhibits relatively stable data flow patterns, while attacks, such as data theft or injection of malicious payloads, often alter these patterns. For example, unusually high uplink traffic may indicate sensitive data leakage, while abrupt changes in packet size distribution may be related to the transmission of specific attack payloads. Quantifying and monitoring these fine-grained network data flow characteristics enhances the ability to detect covert attack channels.

[0034] The sequence of operation requests for system resources can be specifically represented by the order and combination of requests for sensitive system permissions made by the target device during OpenHarmony distributed soft bus communication. For example, a normal application might request "store read" and "network transfer" permissions sequentially when sharing files. A malicious application, however, might attempt to request a series of unrelated sensitive permissions such as "microphone," "camera," and "location information" without explicit user interaction. By encoding and analyzing this sequence of permission requests, illogical and non-standard application behavior patterns of permission abuse can be identified, thereby effectively detecting potential malware activity.

[0035] When an anomaly is detected, the security response strategy can specifically include downgrading the current communication permissions and issuing an alert. This is a tiered, automated handling mechanism. For example, once the anomaly metric of a device exceeds a threshold, the system can immediately downgrade the trust level of its communication session from "trusted device" to "temporary visitor" and automatically sever its access to core sensitive resources such as microphones and cameras, thereby curbing the escalation of damage at the first moment. Simultaneously, the system generates a detailed alert log and pushes it to the network administrator's device via distributed notification capabilities for manual analysis and tracing. This strategy, combining automated response with human intervention, balances timeliness and accuracy in handling the situation.

[0036] Accordingly, the present invention also provides a security enhancement device for embedded devices. (Refer to...) Figure 1 This device can be implemented within an embedded device 100 to protect its communication via the OpenHarmony distributed soft bus 200. The device includes: a target device monitoring module 110 for monitoring network session establishment behavior characteristics, network data flow characteristics, and operation request sequences for system resources related to the target device; a feature vector generation module 120 for generating feature vectors representing the current behavioral state of the target device based on various monitored features; an anomaly measurement calculation module 130 for processing the feature vectors using an unsupervised anomaly detection model to calculate an anomaly measurement value; an anomaly condition judgment module 140 for comparing the anomaly measurement value with preset judgment conditions; and a security policy execution module 150 for executing preset security response policies when the judgment conditions are met. These modules work together to form a complete closed loop for end-side anomaly detection and response.

[0037] In a specific application scenario, the method of this invention is applied to an embedded device (e.g., an interactive flat panel) deployed in a conference room and running the OpenHarmony operating system. See reference... Figure 2The execution flow of this method is as follows: First, the target device monitoring module 110 continuously collects raw data generated when the embedded device interacts with other devices through the OpenHarmony distributed soft bus 200, including connection request logs, network packet header information, and system permission request logs (step S201). Next, the feature vector generation module 120 processes the collected raw data at fixed time windows (e.g., every 1 second) and converts it into a fixed-dimensional feature vector (step S202). Subsequently, the feature vector is input into the anomaly measurement calculation module 130, where the unsupervised anomaly detection model outputs an anomaly measurement value located in the [0,1] interval (step S203). Then, the anomaly condition judgment module 140 compares the anomaly measurement value with a preset judgment condition (e.g., a threshold of 0.75) (step S204). Finally, once an anomaly is determined, the security policy execution module 150 immediately triggers a preset security response policy (step S205), for example, recording a high-risk event in the system security log.

[0038] Based on the above embodiments, the feature vector generation process can be further specified. For example, the feature vector generation module 120 can extract and quantify features from three dimensions. First, for network session establishment behavior features, the module counts the number of times the device actively initiates connections as a client and the number of times it passively accepts connections as a server within a 10-second time window. Second, for network data flow features, the module calculates the total uplink traffic, total downlink traffic, the average length of all data packets, and the proportion of data packets with a size greater than a specific threshold within the same time window. Third, for the sequence of operation requests to system resources, the module maintains a fixed-length queue, records the sequence of recently occurring sensitive permission request events, and converts them into numerical features through encoding technology. Finally, these three types of features are concatenated to form the complete feature vector that is finally input to the model.

[0039] Furthermore, the model and response strategy in the above embodiments are refined. The unsupervised anomaly detection model specifically adopts the Isolation Forest algorithm. This model is trained offline by collecting behavioral feature vectors corresponding to a large number of normal usage scenarios (such as conference projection, file transfer, etc.) in a laboratory environment, thereby learning the distribution pattern of "normal behavior." When the anomaly metric exceeds the preset judgment condition, the security response strategy includes two levels: at the access control level, the security policy execution module 150 dynamically downgrades the trust level of the remote device initiating the abnormal behavior, prohibiting it from accessing sensitive hardware resources; at the alarm and tracing level, the module generates structured security alarms and can push them to the management terminal in real time using distributed notification capabilities.

[0040] To more fully demonstrate the preferred embodiments of the present invention, a complete solution deployed on a specific hardware platform will be described below. This embodiment describes a complete implementation on a high-performance embedded device equipped with a Rockchip RK3588 SoC. (Refer to...) Figure 4 This solution involves coordinated optimization of both hardware and software. In terms of software deployment, the low-resource-consuming behavior monitoring and feature extraction tasks (corresponding to the target device monitoring module 110 and the feature vector generation module 120) are scheduled to run on the lower-power A55 420 core. The trained Isolation Forest algorithm model, after undergoing INT8 integer quantization using a toolkit, is deployed to a dedicated neural network processing unit (NPU) 430 for inference.

[0041] To achieve extremely low latency, this solution employs a highly efficient data path. Feature vectors generated by the small A55 420 core are directly written to a specific shared region of the system memory DRAM 440. By configuring the Direct Memory Access (DMA) controller 450, zero-copy transfer of feature vectors from the system memory DRAM 440 to the Neural Processing Unit (NPU) 430 is achieved. After inference, the anomaly metric calculated by the NPU is automatically transferred back to another memory region via DMA. The entire process requires no intervention from the large A76 410 core or the small A55 420 core, avoiding performance bottlenecks caused by data movement in the CPU. A high-priority daemon runs on the powerful large A76 410 core, dedicated to polling or waiting for the transferred anomaly metric and immediately performing anomaly detection and security response. This collaborative design achieves extremely low end-to-end detection latency. (Refer to...) Figure 3 Compared with traditional software-based detection methods, this invention has significant advantages in detection latency and resource consumption. In comprehensive tests in real-world scenarios, this solution achieved a detection rate of over 87% for various unknown attacks, while the false alarm rate was less than 0.5%.

[0042] Those skilled in the art will understand that the present invention also provides an electronic device, such as the aforementioned embedded device. This electronic device includes a processor and a memory coupled to the processor, the processor executing a computer program stored in the memory to cause the electronic device to perform the security enhancement method as described in any of the foregoing embodiments.

[0043] Furthermore, the present invention provides a computer-readable storage medium on which a computer program or instructions are stored. When the computer program or instructions are executed on a computer (e.g., a processor in an embedded device), the computer causes the computer to perform the steps described above, such as new_method_name. The storage medium can be any form of non-volatile or volatile memory, such as ROM, RAM, flash memory, hard disk, etc.

Claims

1. A security enhancement method for embedded devices, characterized in that, include: Monitor the network session establishment behavior characteristics, network data flow characteristics, and operation request sequences of system resources related to the target device; Based on one or more of the network session establishment behavior characteristics, the network data flow characteristics, and the sequence of operation requests to system resources, a feature vector characterizing the current behavioral state of the target device is generated. The feature vector is processed using an unsupervised anomaly detection model to calculate an anomaly metric that characterizes the degree to which it deviates from the normal behavior pattern. The abnormal measurement value is compared with the preset judgment conditions; When the comparison result meets the determination condition, the preset security response strategy is executed.

2. The method according to claim 1, characterized in that, The unsupervised anomaly detection model is the Isolation Forest algorithm model.

3. The method according to claim 1, characterized in that, The network session establishment behavior characteristics include: the number of times the target device requests or accepts an OpenHarmony distributed soft bus connection within a preset time unit.

4. The method according to claim 1, characterized in that, The network data stream characteristics include at least one of the following: data transmission rate, data packet size distribution, and data packet transmission time interval pattern.

5. The method according to claim 1, characterized in that, The sequence of operation requests for system resources includes the order and combination of requests for access to sensitive system permissions by the target device during distributed soft bus communication.

6. The method according to claim 1, characterized in that, The security response strategy includes: downgrading the permissions of the current communication and issuing an alarm.

7. The method according to claim 2, characterized in that, The method further includes: The isolated forest algorithm model is integer quantized and deployed on the neural network processing unit (NPU) of the embedded device for inference. Direct Memory Access (DMA) technology is used to achieve zero-copy data transfer between the processor core and the NPU.

8. A security enhancement device for embedded devices, characterized in that, include: The target device monitoring module is used to monitor the network session establishment behavior characteristics, network data flow characteristics, and operation request sequences of system resources related to the target device. The feature vector generation module is used to generate a feature vector characterizing the current behavioral state of the target device based on one or more of the network session behavioral features, the network data flow features, and the sequence of operation requests to system resources. The anomaly measurement calculation module is used to process the feature vector using an unsupervised anomaly detection model and calculate an anomaly measurement value that characterizes the degree to which it deviates from the normal behavior pattern. An anomaly condition judgment module is used to compare the anomaly measurement value with preset judgment conditions; The security policy execution module is used to execute preset security response policies.

9. An electronic device, characterized in that, Includes a processor, which is coupled to a memory; The processor is configured to execute a computer program stored in the memory to cause the electronic device to perform the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It includes a computer program or instructions that, when run on a computer, cause the computer to perform the method as described in any one of claims 1 to 7.

Images