基于云安全的高级计量体系恶意软件检测方法

发布时间：2018-09-08 13:30

【摘要】：高级计量体系(AMI)中,智能电表主要依赖嵌入式硬件加密(ESAM)提供保护,遭破解后可能遭恶意软件攻击威胁。针对智能电表通信和计算资源有限的特征,提出了基于白名单的云安全防护方法。首先利用运行环境封闭固定的特点,在计量中心云端安全服务器中建立并维护合法进程白名单;然后在智能电表中安装运行进程检测模块,由其枚举出所有运行进程,计算唯一标识各进程的哈希值特征码并提交到云端安全服务器,与白名单进行对比即可检出含非法进程的表计。该模式仅需在智能电表中计算并上传进程特征码,可在有限的计算和通信资源约束下满足恶意软件检测需求,能够强化AMI的网络安全防护水平。
[Abstract]:In the advanced metering system (AMI), the intelligent meter mainly relies on the embedded hardware encryption (ESAM) to provide protection, and may be attacked by malware after being cracked. Aiming at the limited communication and computing resources of intelligent ammeter, a cloud security protection method based on whitelist is proposed. First of all, the white list of legitimate processes is established and maintained in the cloud security server of the measurement center by using the characteristics of closed and fixed running environment, and then the running process detection module is installed in the intelligent electric meter, which enumerates all the running processes. The hash signature that uniquely identifies each process is calculated and submitted to the cloud security server, and a table containing illegal processes can be detected by comparison with the whitelist. This mode only needs to calculate and upload the process signature in the intelligent meter, can satisfy the malware detection requirement under the limited computing and communication resource constraints, and can enhance the level of network security protection of AMI.
【作者单位】：智能电网运行与控制湖南省重点实验室(长沙理工大学);强电磁工程与新技术国家重点实验室(华中科技大学);南方电网科学研究院;
【基金】：湖南省教育厅科研基金资助项目(15A005)~~
【分类号】：TP309;TM933.4

【相似文献】