Unknown malicious code detection method for embedded processor

Abstract

The invention discloses an unknown malicious code detection method for an embedded processor. The method comprises the following steps: creating an embedded system self-set, generating a detector set and detecting an unknown malicious code; collecting and encoding instruction sequence information of a normal program in a system at a processor instruction level to generate a binary string set as the self-set; generating a binary string as a candidate detector at random and carrying out negative selection on the binary string and elements in the self-set to generate a detector set; matching with the binary string of behavior information of a to-be-detected code collected from the instruction level by the binary string in the detector set; carrying out fuzzy matching among the binary string in the self-set, the binary string of the detector and the to-be-detected binary string by a double-threshold ymir rule, so that the detection rate on the unknown malicious code is increased; and the resource consumption of the system is reduced. The self-set and the detector set are stored by a CAM word memory-addressable memory, so that the searching and matching efficiency is improved; and the generation efficiency of the detector is improved.

Description

technical field [0001] The invention belongs to the technical field of digital integrated circuit and embedded system security, and more specifically relates to an unknown malicious code detection method of an embedded processor. Background technique [0002] In recent years, embedded systems are increasingly threatened by malicious codes. In the prior art, most of the methods to solve the vulnerability of embedded systems to malicious software attacks continue to use traditional virus defense methods, which are as follows: [0003] (1) Malicious code detection technology based on hash digest: use the characteristics of hash function to check the integrity of files and other resources in the system to determine whether they have been tampered with by malicious code; the method has good versatility for various malicious codes , but the false positive rate is high. [0004] (2) Malicious code detection technology based on signatures: use signatures to distinguish malicious c...

AI Technical Summary

Problems solved by technology

[0006] In view of the above defects or improvement needs of the prior art, the present invention provides an unknown malicious code detection method for an embedded processor, the purpose of which is to solve the problem of excessive resource overhead of the existing detection method

Images