Patent Application
20190156026
This application claims priority to Taiwan Patent Application No. 106140754 filed on Nov. 23, 2017, which is hereby incorporated by reference in its entirety.
The present invention relates to a monitor apparatus, method, and non-transitory computer readable storage medium thereof. More particularly, the present invention relates to a monitor apparatus, method, and non-transitory computer readable storage medium thereof that adopt the blockchain technology.
In recent years, the technology of Internet of Things (IoT) has been widely applied in various fields, which means a large number of IoT apparatuses having been deployed in various environments.
Many security problems are associated with the function-oriented IoT apparatuses. A frequently encountered problem is that the recently-discovered and/or undiscovered program security vulnerability of an IoT apparatus cannot be repaired timely and, therefore, the latest attack routes/means of hackers cannot be blocked. For example, a hacker may launch a zero-day attack against the program security vulnerability of an IoT apparatus which is not repaired timely (i.e., zero-day exploit), e.g., launching a Distributed Denial of Service (DDoS) attack against the zero-day exploit. A hacker may intrude in an IoT apparatus via the program security vulnerability that is recently discovered and/or undiscovered, make an illegal application executed on the IoT apparatus, and, thereby, manipulate the IoT apparatus to execute various illegal operations, e.g., control an IP camera to execute a specific function and derive images.
To prevent IoT apparatuses from being attacked by hackers, some conventional technologies deal with the information security issue by filtering activating applications according to a predetermined blacklist. The blacklist may comprise IP addresses (i.e., illegal or suspicious IP addresses) that have to be filtered out or features of program codes of malicious software. Nevertheless, a blacklist cannot be updated timely and, thus, there is still a window that the information security is still vulnerable. Additionally, some conventional technologies deal with the information security issue by adopting a centralized management or single-point defense architecture. However, this practice has the problems that an apparatus being responsible for the management/defense becomes the target of attacks and attack information cannot be shared. As a result, effective security protection cannot be achieved as well. Accordingly, there is still an urgent need for a monitor method that can maintain information security of IoT apparatuses.
The disclosure includes a monitor apparatus, which comprises a storage unit and a processing unit electrically connected to the storage unit. The storage unit is configured to store a blockchain ledger and a smart contract of a blockchain system. The processing unit is configured to execute a blockchain node program, and the blockchain node program performs the following operations periodically: (a) obtaining a piece of behavior information of a first electronic apparatus at a time point; (b) retrieving, via the smart contract, a plurality of pieces of previous behavior information within a time interval from the blockchain ledger, wherein the time interval is defined by the time point, and each of the pieces of previous behavior information corresponds to one of a plurality of second electronic apparatuses and the first electronic apparatus; (c) determining a legality of the piece of behavior information according to the plurality of pieces of previous behavior information; and (d) writing the piece of behavior information into the blockchain ledger.
The disclosure also includes a monitor method adapted for an electronic computing apparatus. The electronic computing apparatus stores a smart contract and a blockchain ledger of a blockchain system. The monitor method monitors a first electronic apparatus periodically. Specifically, the operation that monitoring the first electronic apparatus periodically comprises the following steps: (a) obtaining a piece of behavior information of the first electronic apparatus at a time point; (b) retrieving, via the smart contract, a plurality of pieces of previous behavior information within a time interval from the blockchain ledger, wherein the time interval is defined by the time point, and each of the pieces of previous behavior information corresponds to one of a plurality of second electronic apparatuses and the first electronic apparatus; (c) determining a legality of the piece of behavior information according to the plurality of pieces of previous behavior information; and (d) writing the piece of behavior information into the blockchain ledger.
The disclosure further includes a non-transitory computer readable storage medium having a computer program stored therein. When the computer program is loaded into an electronic computing apparatus, a plurality of codes comprised in the computer program are executed by the electronic computing apparatus to achieve the aforesaid monitor method.
The monitoring technology (including the monitor apparatus, method, and non-transitory computer readable storage medium thereof) provided herein can periodically determine the legality (i.e., being normal or abnormal) of an operation behavior of an electronic apparatus according to a piece of behavior information of the electronic apparatus. The monitoring technology provided herein can decide a time interval according to a time point of the piece of behavior information, and determine the legality of the operation behavior of the electronic apparatus according to a plurality of pieces of previous behavior information of all electronic apparatuses in the same IoT system within the time interval. Because (a) all the electronic apparatuses comprised in the function-oriented IoT system have, in principle, similar operation behaviors within the same time interval and (b) the plurality of pieces previous behavior information are stored in the blockchain ledger that cannot be tampered easily, the monitoring technology herein can accurately determine whether the electronic apparatus is abnormal through the aforesaid operations. When there is an abnormal behavior, an alert message may be provided to the user to stop the illegal operations on the electronic apparatus as soon as possible. Because all the electronic apparatuses in the IoT system adopt the same monitoring technology and maintain the same blockchain ledger together, regional joint-protection can be achieved. Hence, the monitoring technology herein overcomes the shortcomings of the conventional technologies.
The detailed technology and preferred embodiments implemented for the subject invention are described in the following paragraphs accompanying the appended drawings for people skilled in this field to well appreciate the features of the claimed invention.
In the following description, the monitor apparatus, method, and non-transitory computer readable storage medium thereof according to the present invention will be explained with reference to example embodiments thereof. However, these example embodiments are not intended to limit the present invention to any specific examples, embodiments, environment, applications, or particular implementations described in these example embodiments. Therefore, description of these example embodiments is only for purpose of illustration rather than to limit the scope of the present invention.
It should be appreciated that, in the following embodiments and the attached drawings, elements unrelated to the present invention are omitted from depiction; and dimensions of and dimensional relationships among individual elements in the attached drawings are provided only for purpose of illustration but not to limit the scope of the present invention.
A first embodiment of the present invention is an IoT system 1, a schematic architectural view of which is depicted in
In this embodiment, the monitor apparatuses 11, 13, 15, 17, and 19 adopt the same monitoring technology. For convenience, the following description will focus on the details of the monitoring technology adopted by the monitor apparatus 11. A person of ordinary skill in the art will understand the operations of the monitor apparatuses 13, 15, 17 and 19 based on the following description related to the monitor apparatus 11.
In this embodiment, the IoT system 1 adopts the blockchain technology. In other words, each of the monitor apparatuses 11, 13, 15, 17, and 19 is a blockchain node and these blockchain nodes form a blockchain system. To have the monitor apparatus 11 become a blockchain node of the blockchain system, the processing unit 113 executes a blockchain node program (not shown) and the storage unit 111 stores a smart contract 10 and a blockchain ledger 12 of the blockchain system. The smart contract 10 may comprise program codes which can verify the legality of data transmission and reception in the blockchain system. For example, the smart contract 10 may be an encrypted contract that is formulated by the administrator of the blockchain system. For the monitor apparatus 11, both receiving data from other monitor apparatuses 13, 15, 17, and 19 in the blockchain system and transmitting data to other monitor apparatuses 13, 15, 17, and 19 in the blockchain system must be verified by the smart contract 10 in advance. A person of ordinary skill in the art has the knowledge of various encryption algorithms or verification technologies that can be adopted by the smart contract 10 and how the smart contract 10 verifies operations performed in the blockchain system, so the details will not be further described herein.
The blockchain ledger 12 is maintained by all blockchain nodes (i.e., the monitor apparatuses 11, 13, 15, 17, and 19) in the blockchain system together. In this embodiment, the blockchain ledger 12 records a plurality of pieces of previous behavior information, and each of the pieces of previous behavior information is detected by one of a plurality of electronic apparatuses (i.e., the monitor apparatuses 11, 13, 15, 17, and 19) at a certain time point. Each of the monitor apparatuses 11, 13, 15, 17, and 19 stores a copy of the same blockchain ledger. Because the pieces of previous behavior information are stored in the blockchain ledger, they cannot be tampered by hackers easily. When any of the monitor apparatuses 11, 13, 15, 17, and 19 generates/detects a new piece of behavior information and adds the new piece of behavior information to its blockchain ledger (i.e., have the new piece of behavior information become one of the pieces of previous behavior information), the monitoring apparatus will transmit this new piece of behavior information to other monitor apparatuses to synchronize the blockchain ledgers (e.g., synchronizing through broadcasting). In other words, this new piece of behavior information will be added to the blockchain ledger stored in each of the monitor apparatuses 11, 13, 15, 17, and 19.
For example, the blockchain ledger 12 stores pieces of behavior information that are generated/detected by the monitor apparatuses 11, 13, 15, 17, and 19 every five minutes between 1:00 pm to 2:00 pm, and the rest monitor apparatus 13, 15, 17, and 19 store blockchain ledgers having the same contents as the blockchain ledger 12. When one or more pieces of previous behavior information are added by the monitor apparatus 11 into the blockchain ledger 12, the same piece(s) of previous behavior information will be added into the blockchain ledgers of the monitor apparatuses 13, 15, 17, and 19 as well. Please note that the way to synchronize the blockchain ledgers between the monitor apparatuses 11, 13, 15, 17, and 19 is a conventional technology in the field of blockchain technology, so it will not be further described herein.
Please note that each of the piece of behavior information and the pieces of previous behavior information may include one of or a combination of at least one piece of hardware performance information (e.g., CPU performance information, memory performance information, or hard drive performance information), a network utilization rate, at least one network packet feature value (e.g., the number of various protocols, source IP address, or destination IP address), and a number of system call of one of the electronic apparatuses (i.e., one of the monitor apparatuses 11, 13, 15, 17, and 19), but is not limited thereto.
In this embodiment, the blockchain node program executed by the processing unit 113 periodically monitors the monitor apparatus 11 and determines whether the monitor apparatus 11 is abnormal.
Specifically, the blockchain node program executed by the processing unit 113 periodically (e.g., every N seconds, where the variable N is a positive integer) executes the following operations: (a) obtaining a piece of behavior information of an electronic apparatus (i.e., the monitor apparatus 11) at a time point (e.g., the processing unit 113 may execute an agent monitor program, and the agent monitor program monitors the monitor apparatus 11 to obtain the piece of behavior information and then transmits the piece of behavior information to the blockchain node program), (b) retrieving, via the smart contract 10, a plurality of pieces of previous behavior information within a time interval from the blockchain ledger 12, wherein the time interval is defined by the time point, and each of the pieces of previous behavior information corresponds to one of a plurality of electronic apparatuses (i.e., the monitor apparatuses 11, 13, 15, 17 and 19), (c) determining a legality of the piece of behavior information according to the retrieved pieces of previous behavior information that are within the time interval, and (d) writing the piece of behavior information into the blockchain ledger 12. In some embodiments, when the legality of the piece of behavior information indicates that the piece of behavior information is an abnormal behavior information, the blockchain node program executed by the processing 113 generates an alerting signal to inform the administrator that the monitor apparatus 11 might be abnormal. Thereby, an alerting effect is provided.
Please note that the aforementioned determination mechanism is based on the idea that all IoT apparatuses (i.e., the monitor apparatuses 11, 13, 15, 17, and 19) in the IoT system 1 have, in principle, similar statuses within the same time interval. Based on this idea, the blockchain node program executed by the processing unit 113 decides a time interval according to the time point (e.g., a time interval covering this time point, or a time interval near this time point), and determines the legality of the piece of behavior information at this time point according to pieces of previous behavior information of all the IoT apparatuses within the time interval (e.g., according to similarity values).
For ease of understanding, a concrete example is given herein to show the operations periodically performed by the blockchain node program executed by the processing unit 113. Please refer to
At the time point T1, a piece of behavior information D1 of the monitor apparatus 11 is detected by the blockchain node program executed by the processing unit 113. Then, the blockchain node program executed by the processing unit 113 decides a time interval L1 (e.g., from 2 minutes before the time point T1 to the time point T1) according to the time point T1 and retrieves, via the smart contract 10, a plurality of pieces of previous behavior information A1, . . . , Ap within the time interval L1 from the blockchain ledger 12. Next, the blockchain node program executed by the processing unit 113 determines the legality of the piece of behavior information D1 of the monitor apparatus 11 at the time point T1 according to the pieces of previous behavior information A1, . . . , Ap. The blockchain node program executed by the processing unit 113 also writes the piece of behavior information D1 of the monitor apparatus 11 at the time point T1 into the blockchain ledger 12, and the piece of behavior information D1 of the monitor apparatus 11 at the time point T1 is synchronously written to other monitor apparatuses 13, 15, 17, and 19.
Now, how the blockchain node program executed by the processing unit 113 determines the legality of the piece of behavior information D1 of the monitor apparatus 11 at the time point T1 according to the pieces of previous behavior information A1, . . . , Ap will be further described.
In some embodiments, the blockchain node program executed by the processing unit 113 compares every two of the pieces of previous behavior information A1, . . . , Ap within the time interval L1 and the piece of behavior information D1 of the monitor apparatus 11 at the time point T1 to obtain a plurality of similarity values. Then, the blockchain node program executed by the processing unit 113 calculates an average and a standard deviation of the similarity values. Thereafter, the blockchain node program executed by the processing unit 113 determines the legality of the piece of behavior information D1 according to the average and the standard deviation. For example, among the similarity values calculated according to the piece of behavior information D1, if a percentage of the similarity values that fall outside M standard deviations exceeds a threshold, the piece of behavior information D1 is an abnormal behavior information. The variable M is a positive integer.
It is hereby assumed that there are 100 pieces of previous behavior information A1, . . . , Ap within the time interval L1. Considering all the 100 pieces of previous behavior information A1, . . . , Ap and the piece of behavior information D1 of the monitor apparatus 11 at the time point T1, there is 101 pieces of behavior information in total. The blockchain node program executed by the processing unit 113 calculates a similarity value between every two of the 101 pieces of behavior information to obtain
pieces of similarity values and then calculates an average and a standard deviation of the similarity values. For the 100 similarity values between the piece of behavior information D1 and the 100 pieces of previous behavior information A1, . . . , Ap, the blockchain node program executed by the processing unit 113 determines whether a percentage of similarity values that fall outside M (e.g., 3) standard deviations exceeds a threshold (e.g., 70%). If the determination result is that the percentage exceeds the threshold, the piece of behavior information is an abnormal behavior information.
In some embodiments, the blockchain node program executed by the processing unit 113 analyzes the previous behavior information A1, . . . , Ap within the time interval L1 and the piece of behavior information D1 of the monitor apparatus 11 at the time point T1 according to an outlier analysis algorithm (e.g., the K-means algorithm) to generate a clustering result, and then determines the legality of the piece of behavior information D1 according to the clustering result. Specifically, if the clustering result indicates that the piece of behavior information D1 is an outlier, the piece of behavior information D1 is considered as an abnormal behavior information. If the clustering result indicates that the piece of behavior information D1 is not an outlier, the piece of behavior information D1 is a normal behavior information. Please note that a person of ordinary skill in the art shall understand how the outlier analysis algorithm is used for clustering, so it will not be further described herein.
As mentioned, the blockchain node program executed by the processing unit 113 periodically executes the aforesaid operations (a) to (d). Accordingly, if the blockchain node program executed by the processing unit 113 detects a piece of behavior information D2 of the monitor apparatus 11 at a time point T2 that is N seconds after the time point T1, the aforesaid operations (a) to (d) will be repeated by the blockchain node program executed by the processing unit 113. Briefly speaking, the blockchain node program executed by the processing unit 113 decides a time interval L2 according to the time point T2, retrieves pieces of previous behavior information within the time interval L2 from the blockchain ledger 12, determines the legality of the piece of behavior information D2 according to the pieces of previous behavior information within the time interval L2, write the piece of behavior information D2 into the blockchain ledger 12, and writes the piece of behavior information D2 to other monitor apparatuses 13, 15, 17, and 19 synchronously. After the time point T2, the blockchain node program executed by the processing unit 113 continues to periodically perform the aforesaid operations (a) to (d), which will not be further described.
In some embodiments, the monitor apparatus 11 also determines whether an application to be activated is legal. In those embodiments, the smart contract 13 has a whitelist, which stores information of a plurality of legal applications. In those embodiments, the processing unit 113 also executes an agent monitor program (not shown). If the agent monitor program detects an activation request from an application, the agent monitor program retrieves the whitelist from the smart contract 10 and determines the legality of the application by comparing the application with the whitelist. If the application is not in the whitelist, the agent monitor program blocks the activation request of the application. Only when the application is in the whitelist will the agent monitor program allow the application be activated.
In some embodiments, the whitelist stores a hash value of each of the legal applications. In those embodiments, if the agent monitor program detects an activation request from an application, the agent monitor program calculates a hash value of the application, retrieves the whitelist from the smart contract 10, and determines the legality of the application by comparing the hash value of the application with the hash values of the legal applications. If the hash value of the application is not in the whitelist, the agent monitor program blocks the activation request of the application. Only when the hash value of the application is in the whitelist will the agent monitor program allow the application be activated.
From the above descriptions, the blockchain node program executed by the monitor apparatus 11 periodically obtains a piece of behavior information of the monitor apparatus 11, decides a time interval according to a time point of the piece of behavior information (e.g., a time interval covering the time point, or a time interval near the time point), and determines the legality of the piece of behavior information at the time point according to pieces of previous behavior information of all the monitor apparatuses 11, 13, 15, 17, and 19 within the time interval (e.g., according to similarity values). Because (a) all monitor apparatuses 11, 13, 15, 17, and 19 in the IoT system 1 have, in principle, similar behaviors within the same time interval and (b) the pieces of previous behavior information are stored in the blockchain ledger 12 that cannot be tampered easily, this embodiment can accurately determine whether the monitor apparatus 11 is abnormal. Further for an application that is going to be activated, the monitor apparatus 11 compares it with a whitelist. Because the whitelist is stored in the smart contract 10 that cannot be tampered easily, activation of an illegal application can be easily blocked. Therefore, the monitor apparatus 11 can effectively monitor applications that is/are going to be activated or that has/have been activated. The monitor apparatus 11 can not only prevent illegal applications from being activated but also timely inform the administrator/user that the monitor apparatus 11 is abnormal (for alerting purpose). Thereby, illegal operations on the electronic apparatus can be effectively blocked.
A second embodiment of the present invention is an IoT system 2 and a schematic architectural view of which is depicted in
The IoT system 2 of the second embodiment can perform similar operations, have the same functions, and deliver the same effect as the IoT system 1 of the first embodiment. Therefore, only differences between the two embodiments will be detailed in the following description. In the second embodiment, the monitor apparatuses 21a, 23a, 25a, 27a, and 29a perform the same operations, and the electronic apparatuses 21b, 23b, 25b, 27b and 29b perform the same operations. For convenience, the monitor apparatus 21a and the electronic apparatus 21b will be taken as examples for describing of the differences between these two embodiments.
Please refer to
In this embodiment, the electronic apparatus 21b periodically monitors its own status, while the monitor apparatus 21a determines whether the electronic apparatus 21b is abnormal. Briefly speaking, the electronic apparatus 21b periodically obtains a piece of behavior information at a time point (e.g., periodically monitoring by the agent monitor program executed by the electronic apparatus 21b), and periodically transmits the piece of behavior information to the monitor apparatus 21a to determine whether the electronic apparatus 21b is abnormal. From the viewpoint of the monitor apparatus 21a, the transceiving interface 27 periodically receives a piece of behavior information at a certain time point from the electronic apparatus 21b, and the blockchain node program run by the processing unit 113 performs operations as described in the first embodiment to periodically determine the legality of the piece of behavior information transmitted from the electronic apparatus 21b. Based on the descriptions in the first embodiment, a person of ordinary skill in the art shall understand how the electronic apparatus 21b and the monitor apparatus 21a operate, so it will not be further described herein.
In some embodiments, when there is an application going to be activated in the electronic apparatus 21b, the electronic apparatus 21b determines the legality of the application according to the whitelist 22 provided by the monitor apparatus 21a. Briefly speaking, when the agent monitor program executed by the electronic apparatus 21b detects an activation request from an application, the agent monitor program transmits a whitelist request 20 to the monitor apparatus 21a. The transceiving interface 27 of the monitor apparatus 21a receives the whitelist request 20 from the electronic apparatus 21b, the blockchain node program of the processing unit 113 retrieves the whitelist 22 from the smart contract 20 in response to the whitelist request 20, and the transceiving interface 27 transmits the whitelist 22 to the electronic apparatus 21b. Once the electronic apparatus 21b receives the whitelist 22, the electronic apparatus 21b determines the legality of the application by comparing the application with the whitelist 22. How the electronic apparatus 21b and the monitor apparatus 21a determine the legality of an application that is going to be activated in the electronic apparatus 21b according to the whitelist 22 can be understood by those of ordinary skill in the art, so this will not be further described herein.
In addition to the aforesaid operations, the monitor apparatus 21a of the second embodiment can also execute all the operations that can be executed by the blockchain node program of the first embodiment, and the electronic apparatus 21b of the second embodiment can also execute all the operations that can be executed by the agent monitor program of the first embodiment. How the second embodiment executes these operations, have the same functions, and deliver the same technical effects as the first embodiment can be readily appreciated by those of ordinary skill in the art, so it will not be further described herein.
A third embodiment of the present invention is a monitor method, and a portion of the flowchart of which is depicted in
The monitor method periodically performs the procedure depicted in
Please note that the piece of behavior information obtained in the step S301 may comprise one of or a combination of a piece of hardware performance information, a network utilization rate, a network packet feature value, and a number of system call of the first electronic apparatus, but is not limited thereto. Moreover, each of the pieces of previous behavior information retrieved in the step S305 may be one of or a combination of a piece of hardware performance information, a network utilization rate, a network packet feature value, and a number of system call of any of the second electronic apparatuses and the first electronic apparatus, but is not limited thereto.
In some embodiments, the step S305 may be accomplished by the following steps: (i) comparing, by the electronic computing apparatus, every two of the plurality of pieces of previous behavior information and the piece of behavior information to obtain a plurality of similarity values, (ii) calculating, by the electronic computing apparatus, an average and a standard deviation of the similarity values, and (iii) determining, by the electronic computing apparatus, the legality of the piece of behavior information according to the average and the standard deviation.
In some embodiments, the step S305 may be accomplished by the following steps: (i) analyzing, by the electronic computing apparatus, the piece of behavior information and the plurality of pieces of previous behavior information according to an outlier analysis algorithm to generate a clustering result and (ii) determining, by the electronic computing apparatus, the legality of the piece of behavior information according to the clustering result. If the clustering result is that the piece of behavior information is an outlier, the legality of the piece of behavior information indicates that the piece of behavior information is an abnormal behavior information.
In some embodiments, if the electronic computing apparatus that executes the monitor method is the first electronic computing apparatus (e.g., the monitor apparatus 1), the monitor method may further executes the procedure depicted in
In some embodiments, if the electronic computing apparatus that executes the monitor method is not the first electronic computing apparatus (e.g., the electronic computing apparatus is the monitor apparatus 21a, while the first electronic apparatus is the electronic apparatus 21b), the monitor method may further comprise a step executed by the electronic computing apparatus for receiving a whitelist request from the first electronic apparatus, and another step executed by the electronic computing apparatus for transmitting a whitelist comprised in the smart contract to the first electronic apparatus in response to the whitelist request so that the first electronic apparatus determines a legality of an application by comparing the application with the whitelist.
In addition to the aforesaid operations, the third embodiment can also execute all the operations and steps described in the first and the second embodiments, have the same functions, and deliver the same technical effect as the first and the second embodiments. How the third embodiment executes these operations and steps, have the same functions, and deliver the same technical effects as the first and the second embodiments can be readily appreciated by those of ordinary skill in the art, so it will not be further described herein.
The monitor method described in the third embodiment may be implemented by a computer program comprising a plurality of codes. The computer program may be stored in a non-transitory computer readable storage medium. When the codes comprised in the computer program are loaded into an electronic computing apparatus, the monitor method described in the third embodiment will be executed. The non-transitory computer-readable medium may be a read only memory (ROM), a flash memory, a floppy disk, a hard disk, a Compact Disk (CD), a mobile disk, a magnetic tape, a database accessible to networks, or any other storage media known to those skilled in the art and having the same functionality.
According to the descriptions of the above embodiments, the monitoring technology (including the monitor apparatus, method, and non-transitory computer readable storage medium thereof) provided in the present invention periodically determines whether behavior of an electronic apparatus (e.g., the monitor apparatus 11 or the electronic apparatus 21b) is abnormal according to a piece of behavior information of the electronic apparatus. The monitoring technology provided in the present invention decides a time interval according to a time point of the piece of behavior information, and determines the legality of the operation behavior of the electronic apparatus according to a plurality of pieces of previous behavior information of all electronic apparatuses (e.g., the monitor apparatuses 11, 13, 15, 17, and 19, or the electronic apparatuses 21b, 23b, 25b, 27b, and 29b) in the same IoT system within the time interval. Because (a) all electronic apparatuses comprised in the function-oriented IoT system have, in principle, similar operation behaviors within the same time interval and (b) the pieces of previous behavior information are stored in the blockchain ledger that cannot be tampered easily, the monitoring technology of the present invention can accurately determine whether the electronic apparatus is abnormal through the aforesaid operations. When there is an abnormal behavior, an alert message can be provided to the user to stop the illegal operations on the electronic apparatus as soon as possible. Because all the electronic apparatuses in the IoT system adopt the same monitoring technology and maintain the same blockchain ledger together, regional joint-protection effect can be achieved. Moreover, for an application that is going to be activated, the monitoring technology provided in the present invention compares it with a whitelist. Because the whitelist is stored in the smart contract that cannot be tampered easily, activation of an illegal application can be easily blocked.
According to the above descriptions, the monitor technology provided in the present invention can effectively monitor applications that is/are going to be activated and has/have been activated. The present invention can not only prevent illegal applications from being activated but also timely inform the administrator/user that the electronic apparatus is abnormal (for alerting purpose). Thus, illegal operations on the electronic apparatus can be effectively blocked.
The above disclosure is related to the detailed technical contents and inventive features thereof. People skilled in this field may proceed with a variety of modifications and replacements based on the disclosures and suggestions of the invention as described without departing from the characteristics thereof. Nevertheless, although such modifications and replacements are not fully disclosed in the above descriptions, they have substantially been covered in the following claims as appended.
| Number | Date | Country | Kind |
|---|---|---|---|
| 106140754 | Nov 2017 | TW | national |
