Abstract:Industrial control terminals play an important role in industrial control scenarios. Due to the special nature of industrial control networks, industrial control terminal systems are vulnerable to malicious attacks, which can greatly threaten the stability and security of industrial production environments. Traditional security protection methods for industrial control terminals have coarse detection granularity, and are unable to effectively detect and prevent attacks, lacking real-time responsiveness to attack events. Therefore, this paper proposes a real-time dynamic credibility evaluation mechanism based on program behavior, which integrates the matching and symmetry ideas of credibility evaluation. By conducting a real-time dynamic credibility evaluation of function call sequences and system call sequences during program execution, the credibility of industrial control terminal application program behavior can be judged. To solve the problem that the system calls generated during program execution are unstable and difficult to measure, this paper proposes a partition-based dynamic credibility evaluation method, dividing program behavior during runtime into function call behavior and system call behavior within function intervals. For function call behavior, a sliding window-based function call sequence benchmark library construction method is proposed, which matches and evaluates real-time measurement results based on the benchmark library, thereby achieving symmetry between the benchmark library and the measured data. For system call behavior, a maximum entropy system call model is constructed, which is used to evaluate the credibility of system call sequences. Experiment results demonstrate that our method performs better in both detection success rate and detection speed compared to the existing methods.

Trusted computing dynamic attestation using a static analysis based behaviour model

Improving credibility of systems integrity measurement of property remote attestation

Novel Dynamic Trusted Evaluation Model of Software Behavior

Credibility Attestation of Property Remote Attestation Method

Securing c programs by dynamic type checking

Trusted Terminal Design of Distributed Environment

Towards a source-code oriented attestation

Dynamic Supply Noise Aware Timing Analysis with JIT Machine Learning Integration

Distributed Certification Application Via a Trusted Dealer

DNAttest: Digital-twin-based Non-intrusive Attestation under Transient Uncertainty.

Trusted And Confidential Program Analysis

Remote Attestation on Program Execution

Security Model Oriented Attestation on Dynamically Reconfigurable Component-Based Systems

Hierarchical And Dynamic Trusted Evaluation Model Based On Agent

Partial Attestation: Towards Cost-Effective and Privacy-Preserving Remote Attestations

Program Behavior Dynamic Trust Measurement and Evaluation Based on Data Analysis

SCOBA: source code based attestation on custom software

Remote attestation on function execution (work-in-progress)

Dynamic Analysis and Debugging of Binary Code for Security Applications

SABDTM: Security-first Architecture-Based Dynamic Trusted Measurement Scheme for Operating System of The Virtual Computing Node

Trusted isolation environment: an attestation architecture with usage control model