RU2725855C2 - System and method of detecting software-hardware effects on unmanned robotic systems - Google Patents

Abstract

FIELD: aviation.SUBSTANCE: invention relates to the unmanned aircraft (UAV) landing method. For landing of an unmanned aircraft of aircraft type on the airstrip is received by means of the images of beacons installed onboard the aircraft of the front video camera with a narrow-band infrared filter, installed on the airstrip, the probability of the position of the beacons is estimated using a computing module, the relative orientation of the UAV is calculated and transmitted to the communication module with the inertial navigation system, which generates UAV flight control commands.EFFECT: enabling UAV landing on airstrip using optical devices of different range.4 cl, 5 dwg

Description

This invention relates to systems and methods for detecting software and hardware effects on unmanned robotic systems (hereinafter referred to as robotic systems), and can be used to detect software and hardware effects (hereinafter referred to as impacts) aimed at realizing information security threats.

There is a known system for providing access control to launched processes (programs) implemented in the "Access control system for launched processes (programs)" according to RF patent No. 2202122, IPC G06F 12/14 (2000.01), decl. 01/03/2001, publ. 04/10/2003.

The system consists in increasing the level of security of workstations, functional and information servers due to effective counteraction to the launch of destructive processes (programs) and control of user access to launched processes.

The lists of names of allowed processes are monitored with the completion of any fixed process that is not included in the list of allowed processes, which is generated by collecting statistics on processes (programs) launched on the protected object. Not only the name of the process is controlled, but also its full path, as well as the differentiation of user access to the file system.

The disadvantage of this system is the need for continuous monitoring of the list of names of allowed processes with the completion of any fixed process that is not included in the list of allowed processes, and is also implemented in systems operating under the control of general-purpose operating systems with standard file areas and a directory tree. This procedure has high computational complexity and is not applicable in real-time systems.

The known method for detecting malicious code by analyzing system requests, implemented in the "Method and device for detecting malicious code (Detecting method and architecture thereof for malicious codes)" according to US patent No. 7665138 B2, IPC G06F 17/30, G06F 21 / 00 declared 12/27/2004, publ. 02.16.2010.

The method consists in using one or several hosts of a computer system that works with one or several processes and includes several stages that intercept all system calls and related variables, highlight allowed program code, and check programs that are not on the list allowed processes. They do not require a large signature base and can detect unknown software and hardware effects with low computational complexity and high detection accuracy.

The disadvantage of this method is the need to analyze suspicious processes by executing them and identifying behaviors that characterize software and hardware impacts, as well as the presence of at least one host that are not present in unmanned robotic complexes, and the execution of suspicious processes in systems operating under the control of special-purpose operating systems in real time can lead to loss of control.

Also known is the "System and method for protecting a computer device from malicious objects using complex infection schemes" according to RF patent No. 2454705, IPC G06F 11/00 (2006.01), decl. 04/19/2011, publ. 06/27/2012.

The system and method consists in the fact that the analysis of running processes is implemented by isolating the processes launched from those objects of verification that are not trusted by means of the analysis of objects. Then, using the context forming tool, contexts are created that are stored in the context storage tool. Then they analyze these contexts using the context analysis tool using rule bases from the rule base storage tool for detecting malicious objects. Based on the analysis of the generated contexts, malicious objects are identified by the malicious processes launched from them and the computer device is protected from the actions of malicious objects by terminating these malicious processes using antivirus tools.

The disadvantage of the indicated method and system is the constant updating of the rule base in the rule base storage tool, as well as the list of trusted objects in the trusted list storage tool using the update tool connected to the anti-virus server via the computer network, which can lead to an increase in computational complexity and average time service.

The closest analogue (prototype) is the protection system of workstations, information and functional servers of computing systems and networks with dynamic lists of authorized events, implemented in the "Protection system of workstations, information and functional servers of computing systems and networks with dynamic lists of authorized events" according to the patent RF №2166792, IPC G06F 12/14 (2001.01), decl. 10/25/1999, publ. 05/10/2001.

It includes a memory block containing a functional software block, a data block, a checksum storage unit, M authorized event list storage units, a current checksum generation unit, a checksum comparison unit, M current event list generation units, M list comparison units current and authorized events, M blocks for generating commands to terminate the current event, block for generating a signal for comparing checksums, M blocks for adjusting the list of authorized events.

The disadvantage of this prototype is the need for continuous formation of lists of sanctioned events and an audit of the system during its operation, as well as the use of the principles of line-by-line comparison of tables (authorized and current events).

The aim of the claimed invention is to develop a system and method for detecting software and hardware effects on unmanned robotic systems, providing timely detection of software and hardware effects, by identifying them during the operation of an unmanned robotic complex by using statistical and expert methods for detecting anomalies and abuses.

The present invention is a system and method for detecting software and hardware effects on unmanned robotic systems.

In the known technical solution there are signs similar to those of the claimed system. This is the presence of memory blocks, storage units, formation units, and comparison units.

In the first embodiment of the proposed method for detecting software and hardware effects on unmanned robotic systems, the goal is achieved by the fact that upon initialization of the unmanned robotic complex, they scan all systems and form a set of initial parameters X _beginning , during the operation of the unmanned robotic complex at certain time intervals Δt form current parameters X _tech , carry out a two-level automatic procedure for expert assessment of the presence of software and hardware impacts by comparing the initial parameters with the current and the range of permissible values of M _x , which is carried out according to the Markov process models and final state machines, in case of revealing the facts of the hardware and software actions their parameters and carry out notification, in contrast to the prototype in the proposed method, consider the set of parameters of various characteristics X, indicating ongoing hardware and software impacts - maintenance, structure, software, operating conditions, spatial position and construction of an unmanned robotic complex, form a set of initial parameters X _begin , and also use methods for detecting anomalies and abuses.

In the second embodiment of the proposed method for detecting software and hardware effects on unmanned robotic systems, the goal is achieved in that, unlike the first variant of the proposed method, the values of the characteristics X and the range of permissible values of M _x are grouped in various combinations {x ₁ ... x _n } and sequences (matrices), carry out a two-level automatic procedure for expert assessment of the presence of software and hardware impacts by comparing the values of the initial combinations {x _{1 ...} x _n } _nach with the current combinations {x ₁ ... x _n } _tech and the range of permissible values M _{x} .

In the first version of the proposed system for detecting software and hardware effects on unmanned robotic systems, the goal is achieved by the fact that a control unit is added to the known system that is independent of the rest of the system and contains a storage unit for permissible changes in parameters and a timer, to which calculations of the parameters of dynamic processes are linked in the system detecting hardware and software impacts on unmanned robotic complexes containing a block for storing initial parameters, a block for generating initial parameters, a timer, a block for generating current parameters, a block for comparing parameters, a control unit and a block for storing permissible parameter changes during initialization of an unmanned robotic complex form and transmit the initial parameters to block for storing initial parameters; during the automatic expert assessment procedure, data from the block for storing initial parameters and the formation unit are transferred to the comparison unit parameters and the storage unit for permissible parameter changes, when the facts of software and hardware actions are detected, the comparison unit sends data to the control unit, a notification about the software and hardware effect is sent from the control unit with the sending of its parameters.

In the second embodiment of the proposed system for detecting software and hardware effects on unmanned robotic systems, the goal is achieved in that, unlike the first version of the proposed system, the storage unit for initial parameters, the unit for generating current parameters and the storage unit for permissible parameter changes include blocks for storing combinations of values parameters {x ₁ ... x _n }, and the expert assessment is carried out block by block (matrix).

Thanks to a new set of essential features in each of the variants of the methods and in the systems for detecting software and hardware effects on unmanned robotic systems that provide timely detection of software and hardware effects, by identifying them during the functioning of the robotic complex by using statistical and expert methods for detecting anomalies and abuse, that is, it provides the opportunity to achieve the formulated technical result.

1. The indicated technical result is achieved by observing the current system parameters and using statistical methods (see, for example, Debra Anderson, Teresa F. Lunt, Harold Javitz, Ann Tamaru, and Alfonso Valdes, "Detecting unusual program behavior using the statistical component of the next generation intrusion detection system (NIDES) ". // Technical Report SRI-CSL-95-06, Computer Science Laboratory, SRI International, Menlo Park, CA, USA, May 1995) during a two-level automated expert assessment procedure (see ., for example, Sebring, M., Shellhouse, E., Hanna, M. & Whitehurst, R. Expert Systems in Intrusion Detection: A Case Study. // Proceedings of the 11th National Computer Security Conference, 1988 and RA Whitehurst , "Expert Systems in Intrusion Detection: A Case Study." // Computer Science Laboratory, SRI International, Menlo Park, CA, November 1987).

The analysis of the prior art by the applicant made it possible to establish that there are no analogues that are characterized by a combination of features that are identical to all the features of the claimed technical solutions, which indicates compliance of the claimed invention with the condition of patentability “novelty”.

Search results for known solutions in this and related fields of technology in order to identify features that match the distinctive features of the prototype of each variant of the claimed inventions have shown that they do not follow explicitly from the prior art. The prior art also did not reveal the popularity of the impact provided by the essential features of the claimed invention, the transformations on the achievement of the specified technical result. Therefore, the claimed invention meets the condition of patentability "inventive step".

The claimed objects of the invention are illustrated by drawings, which show:

FIG. 1 - a method for detecting software and hardware effects on unmanned robotic systems, presented in the form of a flowchart of the algorithm;

FIG. 2 - a method for detecting software and hardware effects on unmanned robotic systems, presented in the form of a flowchart of the algorithm (option);

FIG. 3 - a system for detecting software and hardware impacts on unmanned robotic systems;

FIG. 4 - a system for detecting software and hardware impacts on unmanned robotic systems (option);

FIG. 5 - a two-level automatic procedure for expert assessment of the presence of software and hardware impacts.

The accompanying drawings are intended to better understand the claimed invention, form part of this and serve to explain the principles of the invention.

An unmanned robotic system is a complex integrated automated system - equipment, machines and assemblies are structurally integrated into systems and systems designed to solve individual problems. The control system of the complex provides control and interaction between all complexes or systems.

The unmanned robotic systems themselves operate under the control of special-purpose operating systems. The main requirement for them is the requirement to ensure predictability or determinism of system behavior in the worst external conditions, which is very different from the requirements for performance and speed of universal operating systems.

To detect external software and hardware impacts, intrusion detection tools and various anti-virus systems are used. Examples of such systems include systems such as Symantec, Dragon, Cisco, Security Agent, Kaspersky Internet Security, Norton Internet Security, etc.

But the existing various tools are not designed to work with robotic systems, since they require a certain amount of computing resources and there is a need for prompt updating of virus signature databases, however, systems based on methods for detecting anomalies and abuses of widespread use due to the variety of designs of general-purpose automated systems its application.

These systems should be ideally suited for unmanned robotic systems with a limited number of system elements.

Systems operating on these principles, such as Bro, Snort, OSSEC, NetSTAT, and Prelude, use the signature method or the state transition analysis methods as the main method for detecting attacks, which does not allow their use in robotic complexes with limited computing resources.

The claimed invention and blocks in its composition can be implemented on the hardware or software (virtual) levels.

Block 1 (1.n) is a data array that operates during the operation of the robotic complex.

Blocks 2, 4 (4.n) - a means of forming the required parameters of the robotic complex.

Block 3 is an independent timer used to form the initial and current parameters of the robotic complex.

Block 5 - analysis block, performs a two-level comparison of the initial, current values of the system and the range of permissible values, as well as notification of the control unit about detected discrepancies.

Block 6 - a control tool, as well as alerts about the detection of effects on the robotic complex.

Block 7 (7.n) - a filled data array, based on statistical data generated by the production of a robotic complex.

Thus, the implementation of all used blocks is achieved by standard means based on the classical principles of computer engineering design.

The advantages of the invention may include the following:

1. Implementation of a fundamentally new approach to the detection of software and hardware effects in robotic systems based on methods for detecting anomalies and abuses.

2. The joint use of expert systems and statistical methods to significantly reduce the resources spent.

3. The emergence of the possibility of building an effective system of counteracting software and hardware impacts on robotic systems.

4. Minimization of threats from vulnerabilities available at the software and hardware levels in robotic complexes.

5. Full autonomy and independence from external systems for detecting and countering computer attacks.

The first embodiment of the inventive system according to the first method shown in FIG. 1 is implemented as follows (Fig. 3):

a) during the initialization of the robotic complex, all systems are scanned and in the block for generating the initial parameters 2, a plurality of initial parameters X _{begin are formed} , which can be represented as follows:

X _beg = {T _obsl , M _obm , C _{pr_0} , m _A , W, t ₀ , h ₀ , ν ₀ ... x ₀ }; where T _obsl - average service time; M _obm - type, type and mode of exchange of information; With _straight -Capacity; m _A is the number of subscribers served; W - power consumption; t ₀ is the initial time; h ₀ is the initial height; ν _{0 is the} initial velocity; x ₀ is another parameter indicating the conduct of hardware and software impacts. The initial parameters may also include other parameters characterizing other characteristics of the service, structure, software, operating conditions, spatial position and design of the robotic complex.

b) after formation, the initial parameters are received in the storage unit of the initial parameters 1.

c) during the operation of the robotic complex in the current parameter formation unit 4, the current parameters are formed at time intervals specified by the timer 3

X _tech = {T _obs.tek , M _ob.tek , C _{ave. Tek} , m _{A. tek} , W _tech , t _tech , h _tech , ν _tech , ... x _tech }, where T _serv.tek is the current service time ; M _{exchange tech} - current type, type and mode of information exchange; With _pr.tek - current bandwidth; m _A.tek - the current number of subscribers served; W _tech - current power consumption; t _tech - current time; h _{tech is the} current height; ν _tech ^_ current speed, x _tech - the current value is a different parameter, indicating the conduct of hardware and software impacts.

d) in the parameter comparison unit 5, the initial parameters 1 are compared with the current 4 and the admissible values region from the admissible parameters storage unit 7, which is carried out according to the Markov process models and final state machines (see, for example, Theory of random processes and its engineering applications: textbook / E.S. Wentzel, L.A. Ovcharov. - 5th ed., Sr. - M.: KNORUS, 2011 .-- 448 p.).

The comparison procedure is shown in FIG. 5. Comparison is made in the following sequence:

- compare the current parameters with the initial parameters of the robotic complex:

where p _i (t) is the probability of the presence of software and hardware impacts.

- if necessary, calculate | Δx |:

- compare the resulting | Δx | and / or current parameters with the range of permissible values of the current parameter M _x (multiple parameters):

In the case of the identification and confirmation of facts indicating the conduct of software and hardware actions to the control unit 6 send data about the detected effect.

e) then, from the control unit 6, they are notified of the hardware-software impact with sending its parameters.

A second embodiment of the inventive system according to the first method shown in FIG. 2 is implemented as follows (FIG. 4):

a) when the robotic complex is initialized, all systems are scanned and, in the block for generating initial parameters 2, the set of initial parameters X _{beg is} formed as in the first embodiment,

b) after formation, the initial parameters are sent to the storage unit for initial parameters 1, where they are grouped in various combinations {x ₁ ... x _n } _nach and recorded in blocks 1.n, where n is the number of the memory block for a particular combination.

c) during the operation of the robotic complex in the current parameter generating unit 4, the current parameters X _tech are formed at time intervals specified by timer 3, which are sorted into settable combinations {x ₁ ... x _n } _tech and recorded in blocks 4.n, where n is the number block of memory for a particular combination.

d) in the unit for comparing parameters 5, a block comparison is made of the initial parameters 1.n with the current 4.n and the region of admissible values from the storage block of admissible parameters 7.n, respectively, which is carried out according to the type of the first option.

The comparison procedure is shown in FIG. five.

In the case of the identification and confirmation of facts indicating the conduct of software and hardware actions to the control unit 6 send data about the detected effect.

e) then, from the control unit 6, they are notified of the hardware-software impact with sending its parameters.

Thus, we can conclude that the developed system and method, through the use of statistical and expert methods for detecting anomalies and abuses, using the minimum amount of computing resources, allows timely detection of software and hardware effects on unmanned robotic systems during their operation.

Claims (4)

1. A method for detecting hardware and software impact on unmanned robotic systems, consists in the fact that upon initialization unmanned robotic system scans all systems and generating a plurality of initial parameters X _early in the course of operation of unmanned robotic system at certain time intervals Δt form current parameters X _flow from the set of parameters of various characteristics X, indicating ongoing hardware and software impacts, conduct a two-level automatic procedure for expert assessment of the presence of software and hardware impacts by comparing the initial parameters with the current and the range of permissible values of M _x , which is carried out according to the Markov process models and end state machines , in the event that facts of software and hardware impacts are identified, their parameters are generated and alerts are provided. 2. The method according to p. 1, characterized in that the values of the characteristics X and the range of permissible values of M _x are grouped in various combinations {x ₁ ... x _n } and sequences (matrices), a two-level automatic procedure for expert evaluation of the presence of software and hardware effects is carried out by comparing the values of the initial combinations {x ₁ ... x _n } _nach with the current combinations {x ₁ ... x _n } _tech and the range of permissible values of M _{x} . 3. A system for detecting software and hardware impacts on unmanned robotic systems containing a storage unit for initial parameters, a unit for generating initial parameters, a timer to which calculations of parameters of dynamic processes are connected, a unit for generating current parameters, a unit for comparing parameters, a control unit and a unit for storing permissible changes parameters. 4. The system according to p. 3, characterized in that the storage unit for the initial parameters, the unit for generating current parameters and the storage unit for permissible parameter changes include storage units for the values of the parameter combinations {x ₁ ... x _n }, and the expert assessment is carried out block or matrix .

Images