基于指令流的嵌入式系统非预期行为检测方法  

Unexpected behaviors detection in embedded system based on instruction stream

作　　者：苏永新[1] 段斌[1] 

机构地区：[1]湘潭大学信息工程学院,湖南湘潭411105

出　　处：《计算机应用》2011年第6期1483-1486,共4页journal of Computer Applications

基　　金：国家863计划项目(2007AA012476);国家自然科学基金资助项目(61040026);湖南省自然科学基金资助项目(08JJ6031)

摘　　要：针对嵌入式系统安全检测具有独立性、快速性、不干涉应用软件的需求,提出了一种嵌入式系统软件非预期行为检测方法。该方法的主要特点是检测系统独立于嵌入式系统,与之并行运行;通过嵌入式系统执行的指令与源程序预期的指令逐条比对,检出嵌入式系统任何不符合源程序的行为;借助哈希运算屏蔽被检系统指令集多样性引入的复杂性,使检测系统对各种指令集的嵌入式系统具有普遍适用性。实验结果表明,该方法具备检出嵌入式系统执行的代码与源代码间比特偏差的能力,从而能检出最小粒度的计划外代码的执行;在不计保护现场指令片段对非中断服务程序的影响时,检测时延不超过6个时钟周期。Most traditional embedded system security detection methods cannot meet all of the requirements of fast detection,independent detection and without interference to application program.Thus,the authors have developed a method of unexpected behaviors detection for embedded system to meet those requirements.The proposed detection system is independent and operates parallel to an embedded processor.And,the logic of the proposed detection is to compare the instruction stream from embedded processor with the instruction expected by source binary,thus detecting any unexpected behaviors caused by deviating from its original program.Moreover,the detection logic presents common suitability of adapting different repertoires.Then experimental results show that this method has the ability of detecting minimum granularity unexpected behavior by checking out random bit flips,and with average detection latency of 6 cycles if taking no account of the instructions for interrupt-site protection.

关 键 词：嵌入式系统安全 指令流 行为检测 实时 恶意代码 

分 类 号：TP393.03[自动化与计算机技术—计算机应用技术] TP309.1[自动化与计算机技术—计算机科学与技术]