Software behavior credibility detecting method based on state transition diagram

Abstract

The invention relates to a software behavior credibility detecting method based on a diagram. A detecting system is divided into five modules including a data preprocessing module, a state diagram training module, a behavior detecting module, a real-time monitoring module and an abnormal warning module, wherein the data preprocessing module is in charge of processing preliminary data; the state diagram training module is used for training a normal behavior base; the behavior detecting module is in charge of detecting behaviors according to the built diagram, and the detection module is divided into two layers, the first layer is used for detecting states and paths, and the second layer is mainly used for detecting weights; the real-time monitoring module dynamically stores detection results in a log mode; and the abnormal warning module warns when the detecting module detects abnormal conditions, and stops running software. A detecting model can monitor software behaviors in real time, and detects behaviors which do not belong to the software, aggressive behaviors and illegal input.

Description

Technical field: [0001] The invention aims to establish a software behavior credibility detection model to ensure behavior safety, and belongs to the field of information security. Background technique: [0002] Software is essentially a tool that replaces people to perform certain actions, and the credibility of software is mainly reflected in the credibility of its behavior. Professor Qu Yanwen believes that the credibility of software behavior refers to a statistical characteristic of whether software is running as a subject, relying on its own functions to use, operate, or historical records of objects to reflect whether it violates regulations, exceeds authority, and exceeds the scope. That is to say, a trusted software should be software whose behavior and results can be expected, and the behavior status during runtime can be monitored. [0003] Existing types of behavioral trustworthiness detection generally include trustworthiness evaluation, risk assessment, situat...

AI Technical Summary

Problems solved by technology

[0004] These detection methods often only focus on abnormalities under the established behavior regulations, lack of systematic software behavior detection mechanism, it is difficult to detect the overall security of the target software, it is impossible to monitor the software behavior in real time, and it is even more difficult to locate the occurrence time and location of the abnormality. reason

Moreover, there are many factors of concern, the model is complex, and the practicability is not high

Images