基于云安全的高级计量体系恶意软件检测方法

高级计量体系(AMI)中,智能电表主要依赖嵌入式硬件加密(ESAM)提供保护,遭破解后可能遭恶意软件攻击威胁。针对智能电表通信和计算资源有限的特征,提出了基于白名单的云安全防护方法。首先利用运行环境封闭固定的特点,在计量中心云端安全服务器中建立并维护合法进程白名单;然后在智能电表中安装运行进程检测模块,由其枚举出所有运行进程,计算唯一标识各进程的哈希值特征码并提交到云端安全服务器,与白名单进行对比即可检出含非法进程的表计。该模式仅需在智能电表中计算并上传进程特征码,可在有限的计算和通信资源约束下满足恶意软件检测需求,能够强化AMI的网络安全防护水平。

Cloud Security Based Malware Detection in Advanced Metering Infrastructure

Smart meters in advanced metering infrastructure(AMI)are protected by encryption/decryption of embedded secure access module(ESAM)and may undergo intrusion of malware once the key is compromised. Since smart meters have limited computation and communication resources, a cloud security based approach is proposed to detect malware in smart meters. A software module is installed to enumerate all processes in smart meters. Thereafter, Hash code of all processes is calculated and uploaded to the server over cloud and the malware detection module in the server can identify malware just by comparing Hash code with that in blacklist and whitelist. Since the jobs with a high requirement on computation are implemented in server over cloud, its requirement on meters is notably lower than on the traditional approach.