Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
  • G06F21/55—Detecting local intrusion or implementing counter-measures
  • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
  • G06F21/55—Detecting local intrusion or implementing counter-measures
  • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
  • G06F21/55—Detecting local intrusion or implementing counter-measures
  • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
  • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
  • G06F21/55—Detecting local intrusion or implementing counter-measures
  • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
  • G06F21/567—Computer malware detection or handling, e.g. anti-virus arrangements using dedicated hardware
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
  • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
  • H04L63/1433—Vulnerability analysis

Definitions

• TITLE Method for detecting an anomaly in an electronic system in operation
• the present invention relates to a method for detecting an anomaly in an electronic system in operation, in particular a computer attack against the electronic system.
• the invention applies in particular to the field of critical on-board computers such as those present in avionics, space, rail, automobile, maritime, medical or IloT ("Industrial Internet of Things” in English or “Industrial Internet of Things” in French), traditionally confronted with operational safety issues, the role of which is to protect these systems and their users from failures and breakdowns.
• the IloT takes the principles of the Internet of Things (or "loT” for "Internet of Things” in English) to apply them to the industrial sector, sharing the data sensors of the different systems, and maximizing machine-machine communications without human intervention.
• the IloT promotes constant communication between the different systems to increase operational efficiency, but it is confronted with the need on the one hand to secure these communications, and on the other hand to ensure the security of each of the systems. the constituent, so that it cannot serve as a backdoor to enter the system maliciously.
• the field of portable computers (“wearable computing” in English) and implanted medical systems, in addition to the classic security problems, is also confronted with problems of confidentiality and data integrity.
• NIDS Network Intrusion Detection System
• HIDS “Host Intrusion Detection System” or “System of detection Host Intrusion” in French.
• NIDS focus on analyzing network communications. It involves capturing traffic at a particular point in a network, and analyzing the packets by comparing them to a database of attack patterns. If a set of packets matches a known attack pattern, an alert is raised.
• HIDS focus on a computer, at the level of its operating system. This is to detect abnormal behavior, by monitoring running processes, memory allocations, logged in users, etc. An alert is generated when one of the monitored quantities deviates from a predefined standard.
• the Specter attack exploits a hardware vulnerability in some branch prediction implementations of microprocessors with speculative execution. While at the functional level, a prediction error is canceled as soon as it is observed, speculative execution can however, as a side effect, allow arbitrary access to RAM locations, with data used by code that was executed "just in case” remaining stored in the cache.
• the Meltdown attack also exploits a speculation vulnerability used for out-of-order instruction execution in the processor, including caches and the Translation Lookaside Buffer (TLB). of translation” in French). Unlike the Specter attack, the Meltdown attack uses mechanisms more specific to the architecture of the processor, and allows on the one hand to access data without the corresponding access rights, but also to make privilege escalation.
• TLB Translation Lookaside Buffer
• DRAM Dynamic Random Access Memory
• the electronic system comprising one or more processors each composed of a plurality of hardware blocks, the processor being suitable for executing at least one application by interactions of the application with said hardware blocks, the detection method comprising at least the following steps:
• the method comprises one or more of the following characteristics, taken in isolation or in all technically possible combinations:
• the detection method further comprises at least one step chosen from the group consisting of: analysis of the nature of the hardware block associated with each inconsistency, analysis of the temporal frequency of the inconsistencies, and analysis of the deviation of each measurement associated with inconsistencies to the reference data set; the detection method comprising a detection step, depending on the or each analysis of an anomaly, in particular a computer attack or a hardware failure of one of the hardware blocks.
• each alert criterion depends on at least one condition on the representative parameters, the detection method comprising, when an alert associated with one of the hardware blocks is emitted, a new iteration of the steps of the detection method starting from the measurement step, the alert criterion comprising, at each iteration, an increasing number of conditions.
• each representative parameter associated with one of the hardware blocks is chosen from the group consisting of: the type of data processed by the hardware block; the type of instructions executed by the hardware block; the number of accesses to the hardware block; the number of calculations executed and/or the calculation time of the hardware block; the number of hardware block malfunctions, and the number of interactions on an interconnect network internal to the processor involving the hardware block, and the number of interactions with the exterior of the processor by the hardware block.
• each hardware block is chosen from the group consisting of: one or more calculation units, one or more branch prediction units, one or more processor internal memory registers, one or more cache memories, one or more random access memories, one or more processing chains, one or more memory protection or address translation units, one or more buses or interconnection networks, one or more input-output units each parameter representative of the operation of one of the hardware blocks being chosen from the group consisting of: the number of data of the same type processed by the calculation unit(s), the interconnection network(s) or the memory(s), the number of instructions of the same type executed by the computing unit(s), the power consumption of the computing unit(s), the temperature of the computing unit(s), the number of successes and/or prediction errors of the branch prediction, the number of memory accesses, the number of successes and/or errors of requests for the cache memory, the number of successes and/or errors of requests for the memory protection unit, the execution time of an instruction in the processing chain, the number of information exchanges via the interconnection network(s) internal to the processor, the number of information exchanges
• the electronic system comprises a plurality of counting hardware blocks each configured to measure one of the representative parameters, the measurement step comprising the measurement of a plurality of representative parameters, in particular between four and six, for example the representative parameters measured by a part of the counting hardware blocks.
• the detection method further comprises a step of: comparing the or each inconsistency associated with the alert sent with a set of predetermined known anomalies, and categorizing the alert when the or each inconsistency corresponds to the one of the known anomalies of said set of anomalies.
• the electronic system is a computer embedded in a transport platform.
• the detection method is implemented by a system chosen from the group consisting of: a dedicated programmable logic circuit forming one of said hardware blocks of the processor; software of an operating system of the electronic system configured to interact with a memory protected by a memory protection unit, and an application suitable for being implemented by the electronic system by adding a driver controlling the hardware blocks.
• a computer program product comprising a readable information medium, on which is stored a computer program comprising program instructions, the computer program being loadable on a data processing unit and suitable for cause the implementation of a detection method as defined above when the computer program is implemented on the data processing unit.
• the invention also relates to a readable information medium on which is stored a computer program product as defined above.
• an on-board computer in a transport platform configured to implement the detection method as defined above, the electronic system being the on-board computer.
• the invention also relates to a transport platform comprising the computer as defined above.
• the invention also relates to a method for generating a reference set, the reference set being representative of the operation of an electronic system in operation without anomalies, the electronic system comprising one or more processors each composed of a plurality of blocks hardware, the hardware blocks comprising hardware execution blocks and hardware counting blocks, the processor being suitable for executing at least one application by interactions of the application with said hardware execution blocks, each hardware counting block being adapted to measure an operating parameter representative of the interactions of the application with one of the execution hardware blocks to obtain measurements of said representative parameter, the generation method comprising at least the following steps:
• the method comprises one or more of the following characteristics, taken in isolation or according to all the technically possible combinations: during the measurement step, the measurements obtained are measurements of a plurality of operating parameters, in particular a number of operating parameters comprised between four and six, the set of measurements obtained being, for example, only the operating parameters measured by a part of the counting hardware blocks.
• each operating parameter representative of the interactions of one of the hardware execution blocks with the application is chosen from the group consisting of: the type of data processed by the hardware block considered, the type of instructions executed by the hardware block considered; the number of accesses to the hardware block considered, the number of calculations executed and/or the calculation time of the hardware block considered, the number of malfunctions of the hardware block considered, the number of interactions on an interconnection network internal to the processor involving the hardware block, and the number of interactions with the exterior of the processor by the considered execution hardware block.
• each hardware execution block is chosen from the group consisting of: one or more calculation units, one or more branch prediction units, one or more memory registers, one or more cache memories, one or more random access memories, a or more processing chains, one or more memory protection or address translation units, one or more interconnecting buses or networks, and one or more input-output units, each parameter representative of the operation of one of the hardware execution blocks being chosen from the group consisting of: the number of data of the same type processed by the calculation unit(s), the interconnection network(s) or the memory(s), the number of instructions of the same type executed by the calculation unit, the energy consumption of the calculation unit(s), the temperature of the calculation unit(s), the number of successes and/or prediction errors of the branch prediction unit, the number of memory accesses, the number of successes and/or errors of cache memory requests, the number of successes and/or errors of memory protection unit requests, the execution time of an instruction in the chain of processing, the number of information exchanges on the processor's internal interconnection network(s), the number of information exchanges via
• the processing step comprises an aggregation of the measurements for each operating parameter to obtain a database specific to each operating parameter.
• the set of measurements and the set of processed data occupy a respective size on a memory, the processing step comprising the application of an operation allowing the size of the set of processed data to be less than the size of the set of measures.
• the operation is implemented by a machine learning technique including training from the set of measurements.
• the machine learning technique includes training a neural network from the set of measurements.
• the operation is a statistical analysis operation such that the data set processed is a statistical distribution of the measurement set.
• a predetermined number of iterations of the measurement step is implemented in order to obtain a first set of measurements and a first set of processed data
• the generation method further comprising the following steps: second implementation of the predetermined number of iterations of the measurement step to obtain a second set of measurements and a second set of processed data,
• the invention also relates to a reference set that can be obtained by a generation method as defined above.
• the invention also relates to the use of the reference set as defined above to detect an anomaly in the electronic system in operation, in particular a computer attack against the electronic system, by comparing at least one measurement of at at least one of the operating parameters during operation of the electronic system and by comparing said measurement with the reference set to detect any inconsistencies between the measurement and said reference set.
• the invention also relates to a computer program product comprising a readable information medium, on which is stored a computer program comprising program instructions, the computer program being loadable on a data processing unit and adapted to cause the implementation of a generation method as defined above when the computer program is implemented on the data processing unit.
• the invention also relates to a readable information medium on which is stored a computer program comprising program instructions, the computer program being loadable on a data processing unit and adapted to cause the implementation of a generation method as defined above when the computer program is implemented on the data processing unit.
• FIG. 1 is a schematic representation of an electronic system according to the invention embedded in a transport system
• FIG 2 is a flowchart of a method, according to the invention, for generating a reference set
• FIG 3 is a flowchart of the splitting step of the generation process
• FIG 4 is a flowchart of the measurement and processing steps of the generation process
• Figure 5 is a flowchart of a method, according to the invention, for detecting an anomaly
• Figure 6 is a schematic representation of a processor embedded in the electronic system of Figure 1.
• Figure 1 shows an electronic system 10.
• the electronic system 10 is embedded in a transport platform 12.
• the transport platform 12 is in particular suitable for transporting passengers and/or goods.
• the transport platform 12 is, in particular, an avionic transport platform such as an airplane, a helicopter or a drone.
• the transport platform 12 is a space transport platform such as for example a satellite or a space shuttle; a rail transport platform, in particular a train; a maritime transport platform such as a ship or a submarine or an automobile transport platform such as an autonomous car or a bus.
• the invention applies to any field in which critical on-board computers are present.
• the electronic system 10 is embedded in a medical device, in a portable computer, in a home automation system or in an industrial system.
• the platform 12 possibly comprises a plurality of electronic systems 10.
• the platform comprises a take-off system, a piloting system, a communication system, an alert system, etc. .
• the electronic system 10 comprises one or more processors 14, an operating system 16 and a memory 18.
• the operating system 16 (often referred to as OS for “Operating System”) is a set of programs which directs the use of the resources of the electronic system 10 by applications.
• Each processor 14 is made up of a plurality of hardware blocks.
• the hardware blocks include 20 execution hardware blocks and 22 counter hardware blocks.
• a hardware execution block 20 is an electronic component configured to execute an elementary function of the processor 14 such as calculation, memory storage or data transfer.
• the processor 14 is suitable for executing at least one application by interactions of the application with the hardware execution blocks 20.
• the application is a program capable of carrying out a task, or a set of elementary tasks.
• the application runs using operating system services to utilize the hardware resources provided by the 20 runtime hardware blocks.
• each hardware execution block 20 is chosen from the group consisting of:
• processing chains one or more memory protection or address translation units, one or more interconnecting buses or networks, and
• Each counting hardware block 22 is adapted to measure an operating parameter representative of the interactions of the application with one of the execution hardware blocks 20 with the application to obtain measurements of said representative parameter.
• the electronic system 10 comprises a plurality of hardware counting blocks 22 capable of each measuring a specific operating parameter.
• the electronic system 10 notably comprises between four and six hardware counting blocks 22.
• the electronic system 10 comprises more than six counting hardware blocks 22.
• Each representative parameter associated with one of the hardware execution blocks 20 is chosen from the group consisting of: the type of data processed by the hardware execution block 20; the type of instructions executed by the hardware execution block 20; the number of accesses to the execution hardware block 20;
• the number of calculations executed and/or the calculation time of the hardware execution block 20 the number of malfunctions of the execution hardware block 20, and the number of interactions on an internal processor interconnect network involving the execution hardware block 20, and the number of interactions with the exterior of the processor 14 by the execution hardware block 20.
• the different data types are, for example, a boolean type, an integer type, a floating-point real type, a character type, etc.
• the different instructions are for example a calculation instruction, a data sending instruction, a storing instruction, etc.
• Each internal interconnection network of the processor 14 forms a gateway allowing communication between different entities of the processor, in particular between the different hardware blocks.
• each parameter representative of the operation of one of the hardware execution blocks 20 is chosen from the group consisting of: the number of data of the same type processed by the calculation unit(s), the network(s) of interconnection or the memory(ies), the number of instructions of the same type executed by the calculation unit(s), the energy consumption of the calculation unit(s),
• the memory 18 stores a set of reference data, or also called a reference set hereafter.
• the reference data set is representative of the operation of the electronic system 10 without anomalies.
• “Operation without anomalies” means operation of the electronic system 10 as provided and envisaged during its design and operation. Abnormal operation is therefore operation deviating from what was envisaged during the operation of the electronic system 10, due for example to a computer attack or to a hardware and/or software failure. In particular, an operating margin without anomaly is defined around the operating values planned during the design of the system. By way of example, an operating temperature interval without anomalies of the calculation units is determined at the design stage. Abnormal operation is detected when the temperature is, for example, 10°C warmer than the maximum limit of the operating interval without anomalies.
• the reference data set or reference set, makes it possible to detect possible inconsistencies between the measurement of an operating parameter and the reference data set.
• a generation method 100 of such a reference set will now be described, with reference to Figure 2 representing a flowchart of said generation method 100.
• the generation method 100 includes a step 120 of executing the application A on a test bench according to a plurality of predetermined input data E.
• test bench is meant a test environment making it possible to put the electronic system 10 under configurable and controlled conditions of use in order to to observe and measure its behavior. The execution on a test bench is therefore different from the operational use in operation thereafter of the electronic system 10.
• the input data E are representative of the operation in operation of the electronic system 10 without anomalies.
• These input data E are determined according to the use envisaged for the electronic system 10 in operation. Experience feedback from the operation of similar electronic systems is also used. These input data are chosen in order to cover a wide variety of events likely to be encountered by the electronic system 10 during its operation in normal operation, without anomalies.
• Application A is configured to implement at least two functions, each function being implemented during its own time phase P.
• application A includes an initial data acquisition phase, a data processing phase, a storage phase and a data sending phase.
• the execution of the application A is implemented according to at least two successive temporal phases P.
• the generation method 100 therefore includes a prior step 110 of dividing the application A into phases P.
• the slicing is a temporal slicing or a functional slicing.
• Figure 3 presents a decision tree allowing to choose the type of splitting of the application A.
• time slicing is chosen when the source code of application A is not known or mastered and the identification of the phases is not easy.
• the slicing is a time slicing that requires an additional step of sample rate selection.
• This choice has an impact on the total number of phases P and is determined by seeking a compromise between the fineness of the characterization of these phases and the size of the reference set obtained.
• the breakdown is performed on the basis of this period.
• the sampling frequency is higher.
• each temporal phase P corresponds to a predetermined time interval of execution of the application, in particular a time interval of less than 300 milliseconds, typically 200 milliseconds.
• the generation method 100 comprises a measurement step 130 by at least one of the counting hardware blocks 22 of at least one operating parameter representative of the interactions of one of the execution hardware blocks 20 during the step running with the app, to get measurements.
• the measurements obtained are therefore measurements of a plurality of operating parameters as defined above.
• Figure 4 illustrates in particular this measurement step 130.
• At least one new iteration I of the steps of the generation method 100 is implemented, the measurement step 130 of an iteration being implemented by at least one counting hardware block 22 different from the at least one hardware block counter 22 implementing the measurement step of another iteration I.
• a set of counting hardware blocks 22 measuring the operating parameters during an iteration I is called configuration C of the counting hardware blocks 22.
• the application A is executed over a large number of iterations I, with different input data, to capture distributions of the possible values of the different operating parameters in nominal operation.
• the generation method 100 then comprises a step 140 of processing the measurements of the operating parameters, to obtain processed data.
• processing step 140 is implemented by applying respective operations to the measurements of each phase.
• the processing step 140 includes in particular an aggregation of the measurements for each operating parameter to obtain a database specific to each operating parameter.
• the processing 140 comprises an aggregation of the measurements per phase P, measurements per configuration C, and measurements per iteration I to obtain a set of collected statistical data.
• the collected values are aggregated as follows.
• Aggregation by phase P consists of grouping together all the measured values in a table indexed by phase.
• Aggregation by configuration C extends the set of events beyond the current configuration to cover the set of configurations necessary to cover all hardware events considered in normal operation.
• the aggregation by iteration I differs from the previous aggregation by replacing the pairs (event, value) by pairs (event, set of values observed during the different iterations).
• the set of measurements collected for application A is thus likely to be very large and typically represent several gigabytes of data collected.
• the processing step 140 then comprises the application of an operation allowing the size in memory of the set of processed data to be less than the size in memory of the set of measurements.
• the operation is implemented by a machine learning technique including training from the set of measurements.
• the machine learning technique is notably implemented by training a neural network from the set of measurements.
• the reference game would then become this network once trained.
• symbolic learning or segmentation techniques are used.
• the reduction operation is a statistical analysis operation such that the processed data set is a statistical distribution of the measurement set.
• This operation is similar to that commonly performed to allow the visualization of statistical data with histograms or box plots for example.
• the statistical distribution includes a plurality of values giving key information about the statistical distribution such as minimum, maximum, mean, median, standard deviation, deciles, quartiles, etc. For example, these values are the different bins of a histogram or the quartiles for boxplots.
• This plurality of values then becomes the reference set J.
• a predetermined number of iterations of the measurement step 130 is implemented in order to obtain a first set of measurements and a first set of processed data.
• the generation method 100 then further comprises a second implementation of the predetermined number of iterations of the measurement step 130 to obtain a second set of measurements and a second set of processed data. Then, the first set of processed data is compared to the second set of processed data according to a predetermined convergence criterion.
• the convergence criterion makes it possible to determine whether these two distributions are statistically similar.
• the literature proposes different solutions to this problem such as the comparison of histograms by calculating the Bhattacharyya distance, the Kullback-Leiber divergence or the Hellinger distance.
• the generation method 100 comprises the implementation of a number of iterations of the measurement step 130 greater than the predetermined number of iterations.
• the two statistical distributions collected are concatenated and the collection is reiterated of a distribution of greater size, for example of a double size.
• This step is repeated until a convergence of the statistical distribution is obtained.
• the generation method 100 includes the generation of the reference set J from the first and second sets of processed data.
• a reference set J is thus obtained from the processed data.
• this reference set is used in particular to detect an anomaly in the electronic system 10 in operation, in particular a computer attack against the electronic system 10, by comparing at least one measurement of at least one of the operating parameters during the operation of the electronic system 10 and by comparing said measurement with the reference set to detect any inconsistencies between the measurement and the reference set.
• the hardware platform supplier delivers the computer as well as all the electronics necessary for the proper functioning of the software applications that may be assigned to it.
• the operating system supplier provides the operating system which will make it possible to manage the execution of the various application software according to their needs in terms of priority, time and frequency of execution, memory space, etc.
• the application software supplier is responsible for the proper functioning of its applications while respecting the instructions provided by the system integrator concerning the rules for the use of the system's hardware resources.
• the system integrator is given the central role. It assembles the various technological bricks, both hardware and software of the system while allocating all the necessary resources to the suppliers of the software applications. In addition, he is responsible for consolidating the operating requirements and taking into account the interactions of the various technological bricks with respect to the resources of the system. He is the one who must guarantee the operational safety and overall security of the system.
• Control of the system involves all the participants, each at their own level of responsibility, but it is the system integrator who is responsible for defining and validating the entire system under construction, ensuring that the applications running on the system's computing platforms comply at all times with non-functional specifications such as time, energy and the sharing of resources necessary for computing, safety, security, etc.
• the reference set J is advantageously used to transmit the requirements of the system integrator to the other actors and the transmission of the non-functional properties of the applications to the integrator such as the effective need in terms of shared hardware resources.
• the software supplier provides information related to the use of hardware resources by its application, and therefore a rate of use of the various shared resources.
• the J reference set is also a way for the system integrator to translate their requirements into a maximum resource utilization envelope. for each application, so as to guarantee their coexistence in the final integrated system.
• the reference set J representing the hardware behavior of applications therefore has several domains of applicability.
• the reference set J can be used in a cyber-security context, as will be explained later, to guard against external cyber-attacks.
• the reference set J can also be used to participate in the monitoring of the system, to detect abnormal cases linked to failures and to trigger measures aimed at a return to a stable state.
• the J reference set can also be used as a means of transmitting non-functional requirements. Indeed, in the context of multi-core processors, themselves complex systems coming from third-party suppliers and most often having partial specifications, the usual technique of time partitioning has become insufficient.
• the J reference set can also be used to facilitate the integration of applications by taking into account their specific use of shared hardware resources.
• the usual technique based on abstract models is no longer suitable for multi-cores.
• the reference set J can also be used to build a library of representative applications of a domain by characterizing them via the distance between their respective reference sets.
• the reference set J can also be used to anticipate the impact of integrating a new application into the system knowing its reference set.
• a method 200 for detecting an anomaly in an electronic system 10 in operation will now be described with reference to Figure 5 representing a flowchart of said detection program 200.
• the detection method 200 is performed using a reference set as generated above.
• the method 200 aims to detect a computer attack against the electronic system 10.
• the detection method 200 is also suitable for detecting a hardware and/or software failure of the electronic system 10.
• the detection method is implemented by a dedicated programmable logic circuit forming one of said hardware execution blocks 20 of processor 14.
• this implementation is carried out at the hardware level in the form of a dedicated component, as shown schematically in Figure 6 with the numerical reference 1.
• This component could thus reprogram and exploit the counting hardware blocks 22 without worrying about the levels necessary privileges at the software level.
• a hardware component also makes it easy to have a dedicated memory to store the reference sets within the component itself.
• This embodiment therefore offers a highly secure solution.
• the detection method is implemented by software of an operating system 16 of the electronic system 10 configured to interact with a memory protected by a memory protection unit.
• the benchmark set is stored in main memory.
• the software will benefit from the high privilege levels of the operating system to configure and read the hardware blocks counting 22.
• the storage area of the reference sets is protected via the memory management unit (or MMU from English management unit”).
• the detection method is implemented by an application capable of being implemented by the electronic system 10 by adding a driver controlling the hardware blocks, as represented schematically in FIG. 6 with the reference digital 3.
• the method is implemented in the form of an application running at the same level as the applications to be monitored.
• This embodiment is the easiest to implement.
• the detection method is implemented via a hybrid implementation, both software and hardware, such as for example a software-level implementation which stores the reference games in a dedicated hardware flash memory, to protect the space memory of reference sets.
• the electronic system 10 is in operational operation.
• the electronic system 10 is on board an aircraft in the process of flying to an airport.
• the electronic system 10 is then for example an avionics system for communication, piloting, etc.
• the detection method 200 comprises a first measurement step 210, during the operation of the electronic system 10, of at least one parameter representative of the interactions of the application A with one of the execution hardware blocks 20 to obtain measurements said representative parameter.
• Representative parameters are as defined above. They correspond in particular to those for which measurements were made during the process for generating the associated reference set.
• the detection method 200 includes comparing 220 the measurement with the associated reference data set, or reference set, to detect any inconsistencies between the measurement and the reference data set.
• An inconsistency is a statistical deviation of the measurement from the reference set.
• the measurement is not included in the envelope formed by the reference set.
• the detection method 200 comprises a step 230 of issuing an alert W according to an alert criterion relating to the inconsistency or inconsistencies detected.
• Each alert criterion depends on at least one condition on the representative parameters.
• Each alert criterion is for example a threshold value of the measured parameter.
• the measured parameters are alternated rapidly in order to cover all the significant events by sampling in a short period of time.
• the measured parameters are chosen by means of a hierarchical selection of the monitored events.
• the measured parameters are chosen by means of a hierarchical selection of the monitored events.
• the set of hardware execution blocks 20 for which a representative parameter measurement is performed being, at each iteration, included in the set of hardware execution blocks 20 of the previous iteration, the set of hardware execution blocks 20 being in particular included in the set of hardware execution blocks 20 associated with the alert or alerts.
• the measurement steps 210 are thus advantageously repeated over several hierarchical levels. This method improves the reliability of detection despite the limited number of counting hardware blocks 22.
• the detection method 200 comprises, when an alert W associated with one of the hardware execution blocks 20 is emitted, a new iteration of the steps of the detection method 200 starting from the measurement step 210, the criterion of alert comprising, at each iteration, an increasing number of conditions.
• a first alert condition is the exceeding of a memory access threshold of a hardware block.
• the alert condition includes in addition to this threshold, the exceeding of a threshold of calculations executed by this hardware block.
• the method 200 then comprises the analysis 240 of the nature of the execution hardware block 20 associated with each inconsistency, the analysis of the temporal frequency of the inconsistencies, and/or the analysis of the deviation of each measurement associated with the inconsistencies. to the reference data set.
• the detection method 200 then comprises a detection step 250, depending on the or each analysis of an anomaly, in particular a computer attack or a hardware failure of one of the hardware blocks. Indeed, depending on the frequency, type and severity of abnormal events, it is possible to distinguish a computer attack from a hardware failure.
• the transient events linked to operational safety are essentially one-off, and are reflected at the level of the hardware counting blocks 22 by a peak.
• Cybersecurity events on the contrary last for the duration of the attack, and attacks generally have a longer lasting effect on 22-count hardware blocks.
• the method comprises categorizing the alert when the or each inconsistency corresponds to one of the known anomalies of said set of anomalies.
• the detection method 200 does not depend on the type of attack.
• the method also makes it possible to detect new classes of attacks targeting hardware or software.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Software Systems (AREA)
• Theoretical Computer Science (AREA)
• Computer Hardware Design (AREA)
• General Engineering & Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Physics & Mathematics (AREA)
• Health & Medical Sciences (AREA)
• General Health & Medical Sciences (AREA)
• Virology (AREA)
• Computing Systems (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Debugging And Monitoring (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=81648777

Family Applications (1)

Country Status (4)

Families Citing this family (2)

Family Cites Families (11)

• 2021
  • 2021-12-31 FR FR2114743A patent/FR3131647B1/fr active Active
• 2022
  • 2022-12-30 US US18/725,109 patent/US20250278480A1/en active Pending
  • 2022-12-30 WO PCT/EP2022/088064 patent/WO2023126512A1/fr not_active Ceased
  • 2022-12-30 EP EP22840223.6A patent/EP4457672A1/de active Pending

Also Published As

Similar Documents

Legal Events