Abstract:Industrial control terminals play an important role in industrial control scenarios. Due to the special nature of industrial control networks, industrial control terminal systems are vulnerable to malicious attacks, which can greatly threaten the stability and security of industrial production environments. Traditional security protection methods for industrial control terminals have coarse detection granularity, and are unable to effectively detect and prevent attacks, lacking real-time responsiveness to attack events. Therefore, this paper proposes a real-time dynamic credibility evaluation mechanism based on program behavior, which integrates the matching and symmetry ideas of credibility evaluation. By conducting a real-time dynamic credibility evaluation of function call sequences and system call sequences during program execution, the credibility of industrial control terminal application program behavior can be judged. To solve the problem that the system calls generated during program execution are unstable and difficult to measure, this paper proposes a partition-based dynamic credibility evaluation method, dividing program behavior during runtime into function call behavior and system call behavior within function intervals. For function call behavior, a sliding window-based function call sequence benchmark library construction method is proposed, which matches and evaluates real-time measurement results based on the benchmark library, thereby achieving symmetry between the benchmark library and the measured data. For system call behavior, a maximum entropy system call model is constructed, which is used to evaluate the credibility of system call sequences. Experiment results demonstrate that our method performs better in both detection success rate and detection speed compared to the existing methods.

Improving credibility of systems integrity measurement of property remote attestation

Credibility Attestation of Property Remote Attestation Method

Development of the Transitive Trusted Chain Based on TPM

Trusted Terminal Design of Distributed Environment

Trust model of users' behavior in trustworthy internet

Distributed Certification Application Via a Trusted Dealer

Model-Driven Remote Attestation: Attesting Remote System from Behavioral Aspect

Partial Attestation: Towards Cost-Effective and Privacy-Preserving Remote Attestations

Remote Platform Attestation: The Testimony for Trust Manageement

Stability of Software Trustworthiness Measurements Models

Research of Trustworthy Software System in the Network

Trusted computing dynamic attestation using a static analysis based behaviour model

Remote Attestation on Program Execution

Program Behavior Dynamic Trust Measurement and Evaluation Based on Data Analysis

Security Model Oriented Attestation on Dynamically Reconfigurable Component-Based Systems

A novel delay-resilient remote memory attestation for smart grid

Towards a source-code oriented attestation

A Multilevel Security Model with Credibility Characteristics

Who Stole My Cheese?: Verifying Intactness of Anonymous RFID Systems

Research on Software Trustworthiness Evaluation Model and Its Implementation

A Unified Measurement Solution of Software Trustworthiness Based on Social-to-Software Framework