CN116595503A - A Fingerprint Recognition Method for Industrial Internet of Things Devices Based on System Call Behavior - Google Patents

Abstract

The invention discloses a fingerprint identification method for industrial internet of things equipment based on system call behavior, which comprises the following steps: sending a security request to an unknown equipment terminal through a server terminal; generating a system call string after receiving the security request at the unknown equipment terminal; The device fingerprint of the unknown device is generated by string; the unknown device sends the device fingerprint to the server; after the server receives the device fingerprint, it calculates the correlation value with the pre-stored device fingerprint, and judges whether the device behavior is based on the calculated correlation value. change. The method can effectively improve the accuracy of fingerprint identification while protecting device privacy.

Description

A Fingerprint Recognition Method for Industrial Internet of Things Devices Based on System Call Behavior

technical field

The invention belongs to the technical field of industrial information security defense, in particular to a method for identifying fingerprints of industrial Internet of Things devices based on system call behavior.

Background technique

The Industrial Internet of Things (IIoT) may utilize disparate devices to collect sensitive data, communicate with other systems, and monitor critical processes in critical infrastructure applications. However, in an IIoT ecosystem, unauthorized or spoofed devices may compromise or impair the performance and security of critical infrastructure, and more seriously, may cause enormous damage to personal safety. Therefore, a serious challenge facing the Industrial Internet of Things is how to ensure the security of equipment.

To this end, the researchers proposed a device identification scheme based on the device behavior fingerprint of the system call, which allows a trusted server (SERVER) to verify its security status by collecting the fingerprint of the device (DEVICE). More specifically, SERVER sends a challenge (challenge), asking DEVICE to give back a response (response fingerprint) related to its system call and device performance. Then, SERVER verifies the received response fingerprint, and SERVER uses the received fingerprint and database Correlation calculations are performed on the existing fingerprints in the database to evaluate the security status of DEVICE, so as to judge whether DEVICE is safe. When an unsafe industrial IoT device is found, an alarm will be issued to ensure the security of the device.

However, there are still some defects in the existing device fingerprint identification scheme: 1) the location information of the system call will be ignored when extracting the system call fingerprint of the device, which may cause the extracted fingerprint to be inaccurate. 2) The existing device system call fingerprint is based on the name of the system call function, which is not conducive to the cross-platform use of the fingerprint identification scheme, and some privacy of the device may be leaked when the cross-platform use is used.

Therefore, how to improve the accuracy of fingerprint recognition, protect device privacy, and ensure the security of devices in the Industrial Internet of Things has become a key issue in current research.

Contents of the invention

In view of the above problems, the present invention provides a fingerprint identification method for industrial Internet of Things devices based on system call behavior that solves at least some of the above technical problems.

The embodiment of the present invention provides a method for identifying fingerprints of industrial Internet of Things devices based on system call behavior, including the following steps:

S1. Send a security request to the unknown device through the server;

S2. The unknown device generates a system call string after receiving the security request;

S3. Generate the device fingerprint of the unknown device according to the system call string;

S4. The unknown device sends the device fingerprint to the server;

S5. After receiving the device fingerprint, the server calculates a correlation value with the pre-stored device fingerprint, and judges whether the behavior of the device changes according to the calculated correlation value.

Further, the security request includes an encrypted package, a digital signature and a time stamp.

Further, the step S2 specifically includes: after receiving the security request, the unknown device uses the LD_PRELOAD method and the ptrace method to extract the system call list of the unknown device, and generates the system call list according to the system call list. call string.

Further, the system call string is obtained based on the close objective function, the free objective function, the malloc objective function, the memcpy objective function, the mprotect objective function, the signal objective function and the usleep objective function.

Further, the step S3 specifically includes:

S31. Obtain a system call n-gram string according to the system call string;

S32. Obtain a system call frequency string according to the system call n-gram string;

S33. Based on the system call frequency string, generate a device fingerprint of the unknown device.

Further, the attributes of the device fingerprint include the maximum value, mean value, standard deviation, peak number, entropy value, skewness value and quartile value of the system call frequency string.

Further, the specific calculation formula of the correlation value is as follows:

Among them, res _Xi represents the i-th number in the preset device res _X ; res _Yi represents the i-th number in the unknown device res _Y ; Indicates the average value of the numbers in the preset device res _X ; /> represents the average value of the numbers in the unknown device res _Y ; Indicates the standard deviation of the numbers in the preset device res _X ; /> Indicates the standard deviation of numbers in res _Y for an unknown device; n indicates the data dimension of res _X or res _Y.

Further, in the step S5, when the correlation value is smaller than the threshold, it means that the behavior of the device changes, and at this time, the server sends an alarm.

Further, in the step S5, when the correlation value is greater than or equal to the threshold value, it means that the device behaves normally, and at this time, the preset device fingerprint in the server-side database is updated.

Compared with the prior art, a fingerprint recognition method for industrial Internet of Things devices based on system call behavior recorded in the present invention has the following beneficial effects:

The invention collects the behavior fingerprint of the system call of the industrial control equipment, uses a correlation algorithm to judge the security of the industrial control equipment, and distinguishes real equipment from unauthorized and untrustworthy equipment. On the one hand, the platform-independent system call extraction method is used to support the cross-platform use of the method while protecting device privacy. On the other hand, a part of the system call location information is retained, which improves the accuracy of fingerprint identification.

The present invention studies the behavior and performance of industrial control devices at the hardware and kernel levels through the extraction of system calls, and combines system and function call tracking technology, signal processing and hardware performance analysis to realize device category identification based on security challenges/responses solution, providing high security performance;

The invention does not require extensive network flow monitoring, does not generate significant overhead on computing resources of industrial control equipment, has low cost and is easy to implement.

Additional features and advantages of the invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

The technical solutions of the present invention will be described in further detail below with reference to the accompanying drawings and embodiments.

Description of drawings

The accompanying drawings are used to provide a further understanding of the present invention, and constitute a part of the description, and are used together with the embodiments of the present invention to explain the present invention, and do not constitute a limitation to the present invention. In the attached picture:

FIG. 1 is a schematic diagram of a system model corresponding to a fingerprint identification method for an industrial Internet of Things device based on a system call behavior provided by an embodiment of the present invention.

Fig. 2 is a schematic flowchart of a fingerprint identification method for industrial Internet of Things devices based on system call behavior provided by an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

The embodiment of the present invention provides a fingerprint identification method for industrial Internet of Things devices based on system call behavior. The system model corresponding to this method is shown in Figure 1, which specifically includes two types of entities: unknown industrial control equipment (DEVICE) and server (SERVER ). Among them, SERVER is a trusted entity with massive storage space and powerful computing power. In addition to undertaking the task of calculating fingerprint correlation, in the embodiment of the present invention, the server is also used to store the fingerprints of known devices that have been obtained. . The DEVICE end is an unknown entity. In the embodiment of the present invention, the DEVICE end can interact with the SERVER end. By collecting the fingerprints of the DEVICE end and sending these collected fingerprints to the SERVER end, it is used to determine whether the unknown DEVICE entity can letter.

Most industrial control devices are resource-constrained devices with limited energy, computing power, and storage capacity. At the same time, industrial control devices are generally large in scale and highly complex. Attackers may use spoofed devices with software and hardware architectures that closely resemble real devices to increase their chances of concealing malicious operations. Furthermore, devices with unauthorized components are often capable of supporting most CPS operations, but are prone to underperformance and failure when responsible for more demanding and critical tasks. In these scenarios, device fingerprinting is suitable for identifying original devices and differentiating them from unauthorized and untrusted devices. In the embodiment of the present invention, it is assumed that these industrial control devices include resource-limited devices and resource-unlimited devices.

The embodiment of the present invention provides a fingerprint recognition method for industrial Internet of Things devices based on system call behavior. The specific implementation steps are shown in Figure 2, including:

S1. Send a security request to the unknown device through the server;

S2. The unknown device generates a system call string after receiving the security request;

S3. Generate the device fingerprint of the unknown device according to the system call string;

S4. The unknown device sends the device fingerprint to the server;

S5. After receiving the device fingerprint, the server side calculates the correlation value with the pre-stored device fingerprint, and judges whether the behavior of the device changes according to the calculated correlation value.

The method collects the behavioral fingerprints of the system calls of the industrial control equipment, uses a correlation algorithm to judge the security of the industrial control equipment, and distinguishes real equipment from unauthorized and untrustworthy equipment. On the one hand, the platform-independent system call extraction method is used to support the cross-platform use of the method while protecting device privacy. On the other hand, a part of the system call location information is retained, which improves the accuracy of fingerprint identification.

The above-mentioned steps S1-S4 are just for the convenience of description, and do not limit the specific execution steps of the method; the above-mentioned steps will be described in detail below.

In the above step S1, the scheduler running on the server sends a security request containing a secret challenge to an unknown industrial control device; the challenge includes an encrypted package, a digital signature and a time stamp; where the encrypted package is used to prevent eavesdroppers from learning The structure and content of the security request; the digital signature guarantees the integrity of the request; the use of the timestamp prevents attackers from using old security requests and can resist replay attacks.

In the above step S2, after receiving the security request, the unknown device side activates the local feature extraction module, and the feature extraction module uses the LD_PRELOAD method and the ptrace method to extract the system call list of the unknown device side, and generates a system call string according to the system call list; The generation of the system call string is based on the extraction of the following target functions: close target function, free target function, malloc target function, memcpy target function, mprotect target function, signal target function and usleep target function, see the following table 1 for details As shown; the feature extraction module also monitors the performance of unknown devices in terms of CPU utilization and memory utilization when extracting calls.

LD_PRELOAD is a proxy library that allows the user to force loading of one or more specified detour functions. When the target process calls the target function, it will use the detour function defined in the proxy library instead of the original function defined in the system library. You can use the following command to inject the proxy library into the target process to achieve function call extraction: LD_PRELOAD= [library name]./[target executable]. Ptrace is what linux can use to get and alter other system calls. Ptrace allows the user to use the PTRACE_PEEKUSER instruction to let the parent process check the parameters of the system call executed in the child process; the PTRACE_POKEUSER instruction allows the parent process to change the system call parameters; PTRACE_DETACH: Stop the trace process that the parent process hooks; PTRACE_SINGLESTEP: Stop after each instruction track.

In the present invention, at first utilize above-mentioned LD_PRELOAD and the specific calling function list that Ptrace extracts to obtain original calling index string (ocs), after obtaining original calling index string (ocs), just can obtain n according to this original calling index string ocs -gram string, n-gram is represented by characters containing n consecutive system calls on the original call index string, and finally the call frequency sequence (cfs) can be calculated, and the frequency sequence (cfs) is represented by each value in the n-gram string Occurrence frequency components, frequency sequences are used to generate device fingerprint files. The figure below shows the whole process from the original call index string (ocs) to the successful feature extraction.

Table 1 Objective function and related functions

In the above step S3, according to the system call string, obtain the corresponding system call n-gram string (wherein the value range of n is n=1, 2, 3); after that, the corresponding n-gram string can be calculated according to the obtained 3 n-gram strings. The system call frequency string of the system call frequency string is composed of the number of occurrences of each value in the n-gram string; finally, the feature extraction module uses the system call frequency string to calculate the device fingerprint of the unknown device side; see Table 2 below for details and shown in Table 3;

Table 2 System call frequency string generation algorithm

Table 3 device fingerprint generation algorithm

As can be seen from Table 3 above, the attributes in the device fingerprint include: {Max_Fi, Mean_Fi, Std_Fi, Kurtosis_Fi, Entropy_Fi, skewness_Fi, Q1_Fi, Q2_Fi, Q3_Fi}. The meaning of each attribute is described below. Max_Fi represents the maximum value in the system call frequency string Fi; Mean_Fi represents the average value in the system call frequency string Fi; Std_Fi represents the standard deviation in the system call frequency string Fi, which is used to reflect the degree of dispersion of a data set; Kurtosis_Fi represents the system call The number of peaks in the frequency string Fi is used to describe the steepness or smoothness of the data distribution; Entropy_Fi represents the entropy value in the system call frequency string Fi, which is used to evaluate the uncertainty of the value in the data; skewness_Fi represents the system call frequency Skewness in the string Fi is used to describe the symmetry of the data distribution, and the skewness of the normal distribution is 0; Q1_Fi represents the first quartile in the string Fi of the system call frequency; Q2_Fi represents the quartile in the string Fi of the system call frequency The second quartile; Q3_Fi refers to the third quartile in the system call frequency string Fi; the above quartiles are all used to save the location information of a certain call in the system call string.

In the above step S4, the unknown device sends the collected device fingerprint information to the server, and waits for the server to perform the next data processing.

In the above step S5, the server acquires the real pre-stored device fingerprints that already exist in the database, and calculates the correlation value between the received device fingerprints and the pre-stored device fingerprints in the database. The correlation value calculation method can be found in the following table 4 shown;

Table 4 Correlation Value Calculation

The specific calculation formula of the correlation value is as follows:

Among them, res _Xi represents the i-th number in the preset device res _X ; res _Yi represents the i-th number in the unknown device res _Y ; Indicates the average value of the numbers in the preset device res _X ; /> represents the average value of the numbers in the unknown device res _Y ; Indicates the standard deviation of the numbers in the preset device res _X ; /> Indicates the standard deviation of numbers in res _Y for an unknown device; n indicates the data dimension of res _X or res _Y.

When the correlation value is less than the threshold u, it means that the behavior of the device has changed, that is, the unknown device is untrustworthy. At this time, the server sends an alarm; the operator judges the behavior change of the system call after receiving the alarm information sent by the server. Whether it is legal; if it is determined to be legal, then you can choose to update the fingerprint database on the server; if it is determined to be illegal, then you can take effective solutions for the corresponding device;

When the correlation value is greater than or equal to the threshold u, it means that the device behaves normally, that is, the unknown device is credible. At this time, the preset device fingerprint in the server-side database is directly updated, that is, the unknown device fingerprint is stored in the server-side database.

To sum up, the embodiment of the present invention provides a fingerprint identification method for industrial Internet of Things devices based on system call behavior, using the method of observing system call behavior changes to realize safe and efficient fingerprint identification for unknown industrial control devices; and, by extracting High adaptability is realized by features that have nothing to do with the name of the system call; in addition, the method provided by the embodiment of the present invention is easy to implement, does not generate too much extra overhead of industrial control equipment, and has low cost.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (8)

1. A method for fingerprint identification of industrial internet of things equipment based on system call behavior, it is characterized in that, comprising the following steps: S1. Send a security request to the unknown device through the server; S2. The unknown device generates a system call string after receiving the security request; S3. Generate the device fingerprint of the unknown device according to the system call string; S4. The unknown device sends the device fingerprint to the server; S5. After receiving the device fingerprint, the server calculates a correlation value with the pre-stored device fingerprint, and judges whether the behavior of the device changes according to the calculated correlation value. 2. A kind of industrial Internet of Things device fingerprint identification method based on system call behavior as claimed in claim 1, is characterized in that, described security request comprises encrypted package, digital signature and time stamp. 3. A method for identifying fingerprints of industrial Internet of Things devices based on system call behavior as claimed in claim 1, wherein said step S2 specifically comprises: after receiving said security request, said unknown device uses LD_PRELOAD method and ptrace method to extract the system call list of the unknown device, and generate the system call string according to the system call list. 4. A kind of industrial internet of things device fingerprint identification method based on system call behavior as claimed in claim 1, is characterized in that, described step S3 specifically comprises: S31. Obtain a system call n-gram string according to the system call string; S32. Obtain a system call frequency string according to the system call n-gram string; S33. Based on the system call frequency string, generate a device fingerprint of the unknown device. 5. A kind of industrial internet of things device fingerprint identification method based on system call behavior as claimed in claim 4, is characterized in that, the attribute of described device fingerprint comprises the maximum value, average value, standard deviation, peak value of system call frequency string , entropy, skewness, and quartiles. 6. A kind of industrial internet of things device fingerprint identification method based on system call behavior as claimed in claim 1, is characterized in that, the specific calculation formula of described correlation value is as follows: Among them, res _Xi represents the i-th number in the preset device res _X ; res _Yi represents the i-th number in the unknown device res _Y ; Indicates the average value of the numbers in the preset device res _X ; /> Indicates the average value of the numbers in the unknown device res _Y ; /> Indicates the standard deviation of the numbers in the preset device res _X ; /> Indicates the standard deviation of numbers in res _Y for an unknown device; n indicates the data dimension of res _X or res _Y. 7. A method for fingerprinting industrial IoT devices based on system call behavior according to claim 1, characterized in that, in the step S5, when the correlation value is less than a threshold, it means that the behavior of the device has changed , at this time, the server sends an alarm. 8. A method for fingerprinting industrial Internet of Things devices based on system call behavior as claimed in claim 1, wherein in said step S5, when said correlation value is greater than or equal to a threshold value, it means that the device behavior Normal, update the preset device fingerprint in the server-side database at this time.