The invention discloses a Teensy
virus identification and protection method for a mobile hard disk, and relates to the technical field of
virus identification and protection.The method effectively identifies high-
simulation attack equipment through composite equipment
fingerprint construction and combination of hardware
ripple features and dynamic protocol response, and breaks through the limitation of traditional single
feature detection; meanwhile, the protocol
state transition probability model adopts hidden
Markov chain real-time analysis,
microsecond-level protocol switching abnormity is accurately captured, and the problem of missing detection caused by rough time
granularity of an existing scheme is solved; in addition, a window context instruction association mechanism binds a
system focus state with an HID operation, and blocks a hidden
attack chain formed by legal instruction combination; the hierarchical fusing strategy fuses protocol endpoint control and
physical layer isolation, so that the availability of a storage function is ensured, meanwhile,
attack blocking is realized, and the situation that normal use is influenced due to full-port forbidding in a traditional scheme is avoided.