Mobile application security protection system, method, device and storage medium

Abstract

The present invention discloses a security protection system, method, device and storage medium for mobile applications. The method includes: a security protection SDK detects threat data of mobile applications, and determines whether the mobile application is currently affected by a single known threat event based on the threat data; if so, the threat protection strategy for the single known threat event deployed in the security protection SDK is enabled for protection; if not, the threat data is sent to a SOAR automatic orchestration response model, and the script in the SOAR automatic orchestration response model outputs a protection strategy based on the threat data for security protection of the mobile application. It can be seen that the solution of the present invention, through the combination of the security protection SDK and the SOAR automatic orchestration response model, can achieve comprehensive and timely detection and response to various threats suffered by mobile applications.

Description

Technical Field

[0001] The present invention relates to the field of mobile security technology, and in particular to a security protection system, method, device and storage medium for mobile applications. Background Art

[0002] With the widespread adoption of various mobile apps on smartphones, the number of app stores in my country has surpassed 200, with nearly 5 million apps available and over a trillion downloads, demonstrating rapid growth. However, the rapid development of mobile internet and inclusive finance has also led to a surge in online fraud schemes that exploit mobile apps to defraud users of their personal information and account funds. This behavior has caused significant losses to users, damaged the credibility of developers, and inflicted immeasurable damage.

[0003] While traditional app hardening has been relatively effective initially, it's not without its challenges. During actual app operation and use, users are beginning to discover automated hacker tools that bypass verification codes and even decompress hardening packages. These automated attack tools can exploit app vulnerabilities and simulate legitimate business operations, rendering simple security protection technologies ineffective. Because existing security technologies focus on single-action protection against known threats, they are often helpless against multiple simultaneous threats or unknown threats, such as those faced by groups with diverse cyberweapons.

[0004] Therefore, mobile apps urgently need a mechanism that can flexibly detect and respond to various types and quantities of threats. Summary of the Invention

[0005] In view of the above problems, embodiments of the present invention are proposed to provide a security protection system, method, device and storage medium for mobile applications that overcome the above problems or at least partially solve the above problems.

[0006] According to one aspect of an embodiment of the present invention, a security protection system for a mobile application is provided, comprising: a mobile application, a security protection SDK, and a SOAR automatic orchestration response model, wherein the security protection SDK is integrated into the mobile application;

[0007] The security protection SDK is deployed with a variety of known threat event detection technologies and threat protection strategies for the detection and protection of a single known threat event;

[0008] The SOAR automatic orchestration response model includes scripts for processing known multiple threat events and / or unknown threat events, and is used to perform security protection after receiving threat data of known multiple threat events and / or unknown threat events sent by the security protection SDK.

[0009] According to another aspect of an embodiment of the present invention, a security protection method for a mobile application implemented based on the above system is provided, comprising:

[0010] The security protection SDK detects threat data of the mobile application and identifies whether the mobile application is currently attacked by only a single known threat event based on the threat data;

[0011] If so, enable the threat protection strategy for the single known threat event deployed in the security protection SDK for protection;

[0012] If not, the threat data is sent to the SOAR automatic orchestration response model, and the script in the SOAR automatic orchestration response model outputs a protection strategy according to the threat data to perform security protection on the mobile application.

[0013] According to another aspect of the present invention, there is provided an electronic device, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus;

[0014] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute operations corresponding to the above-mentioned mobile application security protection method.

[0015] According to another aspect of an embodiment of the present invention, a computer storage medium is provided, wherein the storage medium stores at least one executable instruction, and the executable instruction enables a processor to perform operations corresponding to the above-mentioned mobile application security protection method.

[0016] According to the security protection system, method, device and storage medium for mobile applications of the embodiments of the present invention, the security protection SDK is used to detect and protect against attacks from various automation tools, preventing attackers from launching batches of simulated legitimate business attacks through automation tools to shield various business risks and solve the problem of untimely response to single known threat events; and for multiple known threats and / or unknown threats, SOAR can be used to automatically orchestrate the response model to accurately judge and implement a series of reasonable and effective protection strategies. It can be seen that the solution of the present invention can improve the efficiency and comprehensiveness of security protection for mobile applications.

[0017] The above description is only an overview of the technical solutions of the embodiments of the present invention. In order to more clearly understand the technical means of the embodiments of the present invention, they can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiments of the present invention more obvious and easy to understand, the specific implementation methods of the embodiments of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the embodiments of the present invention. The same reference numerals are used throughout the accompanying drawings to denote the same components. In the accompanying drawings:

[0019] Figure 1 A diagram showing the composition of a security protection system for mobile applications provided by an embodiment of the present invention is shown;

[0020] Figure 2 A flowchart of a mobile application security protection method provided by an embodiment of the present invention is shown;

[0021] Figure 3 A schematic diagram of an application page for a DNS hijacking attack in a specific example of the present invention is shown;

[0022] Figure 4 A schematic diagram showing the process of automatically orchestrating responses of the SOAR model;

[0023] Figure 5 A schematic structural diagram of a computing device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0024] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0025] Before implementing the embodiments of the present invention, several abbreviations involved in the present invention are explained here:

[0026] 1) SDK (Software Development Kit): Generally refers to a collection of development tools that software engineers use to build application software for a specific software package, software framework, hardware platform, operating system, etc. In a broad sense, it refers to a collection of related documents, examples, and tools that assist in the development of a certain type of software.

[0027] 2) SOAR (Security Orchestration, Automation, and Response): SOAR is a security protection technology that enables enterprises to gather inputs of interest to security operations teams. Its core approach is to digitally manage security processes or plans in a closed-loop manner, such as those for handling worm outbreaks, mining virus alerts, and suspected phishing emails, creating a playbook. By visually orchestrating threat events, it organically integrates people, technology, and processes to form standardized, repeatable, and more efficient security operations processes. Table 1 below illustrates the core concepts of SOAR.

[0028]

[0029] Figure 1 FIG1 shows a composition diagram of a security protection system for mobile applications provided by an embodiment of the present invention. Figure 1 As shown, the system includes: a mobile application 110, a security protection SDK 120 and a SOAR automatic orchestration response model 130, wherein the security protection SDK 120 is integrated into the mobile application 110;

[0030] The security protection SDK 120 is deployed with multiple known threat event detection technologies and threat protection strategies for detecting and protecting against a single known threat event. By integrating the security protection SDK 120 into the mobile application 110, various threats to the mobile application 110 can be easily detected. When a single known threat event is detected, the corresponding protection strategy can be quickly activated for security protection.

[0031] In addition, the security protection SDK120 uses multiple methods to prevent itself from being cracked. First, the security protection SDK120 has undergone code obfuscation and slimming operations, and has added operating environment detection and anti-debugging mechanisms to combat decompilation or other reverse analysis methods; secondly, the security protection SDK120 will perform two-way verification with the server, that is, the client verifies the server to prevent forgery by the server, and the server will also perform signature and fingerprint verification on the client. Any abnormality will lead to communication interruption.

[0032] Furthermore, the SOAR automatic orchestration response model 130 includes a script for handling known multiple threat events and / or unknown threat events, which is used to perform security protection after receiving threat data of known multiple threat events and / or unknown threat events sent by the security protection SDK. In an embodiment of the present invention, a single known threat is detected and responded to by the security protection SDK, while multiple known threats and / or unknown threats are responded to by the SOAR automatic orchestration response model 130. The script in the SOAR automatic orchestration response model 130 constructs a protection strategy for threat events and output responses, formulates an execution plan and script for handling threats, and establishes a self-learning attack and defense range by studying reports on previous expert threat event handling. The script is then learned to obtain a script. When multiple known threats and / or unknown threats are present, a series of protection strategies can be output based on the correspondence between threat event inputs and output responses in the script, as well as the processing priority of multiple threat events, to achieve the processing of multiple known threats in a reasonable order and the effective handling of unknown threats.

[0033] For example, if the security protection SDK detects that the mobile app is in a dual-open environment and is under multiple threat risk attacks such as interface hijacking and DNS hijacking, SOAR intelligent orchestration can automatically respond to and orchestrate these threats. These threats are digitally managed to form a playbook, which constructs threat events, outputs corresponding protection strategies, formulates execution plans and scripts for handling threats, closes alarm events, and tracks the protection strategies of threat scripts. It automatically enriches the context of security events, continuously tracks them, and handles them in a coordinated manner. On the mobile app side, these threats can be prompted with pop-up boxes, and the app can be exited and restarted, etc. At the same time, a coordinated feedback mechanism is formed to avoid existing dangers as soon as possible, prevent user information leakage, and prevent mobile apps from being reverse engineered and hacked.

[0034] In some optional embodiments of the present invention, the system further includes: an AI deep learning module, the AI ​​deep learning module is used to construct a script in the SOAR automatic orchestration response model through AI deep learning or artificial intelligence algorithms. The script can construct a model and parameters of input events and output strategies through AI deep learning or artificial intelligence algorithms. For example, the deep learning model can hide the feature set in the decision-making process instead of using fixed rules such as If-then in existing scripts, so as to prevent attackers from bypassing security measures by changing several variables. Define priorities for policies based on the characteristics of the business and eliminate conflicts. Improve the efficiency of security operations by automating tasks, orchestrating workflows, improving collaboration, and enabling organizations to respond to events at machine speeds.

[0035] The mobile application security protection system provided by this embodiment uses a security protection SDK to detect and protect against attacks from various automated tools, preventing attackers from launching batches of business attacks that simulate legitimate operations through automated tools. This shields various business risks and addresses the issue of delayed response to single known threat events. Furthermore, SOAR can automatically orchestrate response models to accurately assess multiple known and / or unknown threats and implement a series of reasonable and effective protection strategies. This demonstrates that this embodiment can improve the efficiency and comprehensiveness of mobile application security protection.

[0036] Figure 2 FIG1 shows a flow chart of a security protection method for mobile applications provided by an embodiment of the present invention. The method is implemented based on the security protection system for mobile applications in the aforementioned embodiment. Figure 2 As shown, the method includes the following steps:

[0037] Step S210: The security protection SDK detects threat data of the mobile application.

[0038] The security protection SDK is integrated into mobile applications to detect threat data of mobile applications in real time.

[0039] Step S220: Identify whether the mobile application is currently attacked by only a single known threat event based on the threat data; if so, execute step S230; if not, execute step S240.

[0040] Among them, the security protection SDK is deployed with detection technology for known threat events, which can directly identify whether the threat data corresponds to a known threat event.

[0041] In addition, known threat events include at least one of the following: framework attacks, injection attacks, debugging attacks, interface hijacking, location fraud, simulator analysis, crash analysis, virus and Trojan attacks, root attacks, malicious application attacks, kernel destruction, system acceleration attacks, LIBC (ANSI C function library under Linux) attacks, device information tampering, network proxy, sensitive configuration, risky processes, domain name risks, and WIFI analysis.

[0042] Step S230: Enable the threat protection policy for the single known threat event deployed in the security protection SDK for protection.

[0043] The security protection SDK also deploys threat protection strategies for each known threat event. For a single known threat, security protection can be directly implemented based on the threat protection strategy of the known threat, such as pop-up reminders, TOAST prompts, floating balls, notification bars, jumping to specified pages, opening links, launching applications, etc., to achieve timely response to single known threats.

[0044] In the embodiment of the present invention, the security protection SDK mainly plays a role in the following aspects:

[0045] First, it can detect and mark existing threats in the threat material library, such as framework attacks such as the Xposed framework, Substrate framework, Frida framework, and WSM framework; debug and modify application process information to obtain user information, dynamically tamper with debugging attacks, and other malicious attacks; check whether the device is rooted or jailbroken (wool party members need to obtain root permissions of the device to conduct automatic attacks through mobile apps), etc.

[0046] Secondly, by performing environmental detection on the requesting terminal, the legitimacy and credibility of the requesting terminal device can be quickly assessed, making it easier to use enhanced risk control rules and behavioral analysis when the request source is found to be a suspicious terminal environment, thus eliminating automated attacks in the early stages.

[0047] Third, when a mobile app is discovered to be attacked by a known threat event, the security protection strategy can be called in time, and an automatic response can be performed in the mobile app at the first time, allowing users to handle threat events more intuitively and avoid subsequent threats. Figure 3 FIG. 1 shows a schematic diagram of an application page of a DNS hijacking attack in a specific example of the present invention. Figure 3 As shown, when a user enters a page with embedded HTML while using a mobile app, the iOS system starts to frantically jump to other apps - Tmall Mobile, Taobao Mobile, Sina Weibo, etc., and forcibly sends various advertisements. At this time, using the security protection SDK, you can detect that the mobile app is suffering from DNS hijacking, activate the protection strategy mode, kill the current mobile app process or restart the app to prevent users from suffering further losses.

[0048] Step S240: The threat data is sent to the SOAR automatic orchestration response model. The script in the SOAR automatic orchestration response model outputs a protection strategy based on the threat data to perform security protection on the mobile application.

[0049] For situations that are not single known threats, SOAR needs to automatically orchestrate the response model to handle them.

[0050] Specifically, the playbook sets the handling priorities for multiple threat events. When the threat data received by the SOAR automated orchestration response model corresponds to multiple known threat events, the playbook outputs the corresponding protection strategy based on the processing priority. This ensures that the handling of multiple threat events meets the urgency of the event and prevents successful application attacks due to improper processing order. Multiple threat events on mobile apps are handled in a closed-loop manner. Through the SOAR model, multiple threat events are digitally managed to form a playbook. The playbook constructs threat events, outputs response protection strategies, and develops execution plans and scripts for handling threats. It also closes alarm events and tracks the threat protection script. This automatically enriches the security incident context, continuously tracks it, and coordinates its handling. On the mobile app side, these threats can be sequentially addressed with pop-up reminders, TOAST prompts, app exits, and app restarts, forming a coordinated feedback mechanism to immediately mitigate existing risks, prevent user information leakage, and prevent mobile apps from being reverse engineered, hacked, or compromised, which could impact the company's reputation.

[0051] In addition, the SOAR automatic orchestration response model can orchestrate and automatically respond to unknown threat events in mobile apps. When the threat data obtained by the security protection SDK corresponds to an unknown threat event, the SOAR automatic orchestration response model can make accurate judgments by analyzing the current security context, and then implement a series of reasonable and effective protection strategies.

[0052] Figure 4 The figure shows a flow chart of automatic orchestration response of SOAR model. Figure 4 As shown in the figure, when an event triggers the SOAR model, the SOAR model processes the event and obtains a response strategy.

[0053] Furthermore, in order to utilize the SOAR automatic orchestration response model to reasonably respond to multiple known threat events and / or unknown threat events, it is necessary to first train the model, which mainly involves obtaining a script. In some optional embodiments of the present invention, the security protection SDK collects client information of the mobile application and sends the client information to the SOAR automatic orchestration response model; the SOAR automatic orchestration response model constructs analysis data of user behavior based on the client information; the AI ​​deep learning module constructs the parameters of the script by learning the analysis data and historical threat processing reports, that is, the parameters of the model that obtains the output strategy based on the input event, including parameters for determining the event processing priority. Among them, historical threat handling reports record the handling strategies given by experts for various threat events, as well as the corresponding handling effects. Based on the historical threat handling reports and combined with the analysis data obtained from some basic client information, a self-learning attack and defense target range is established and learned through the AI ​​deep learning module, and script parameters can be obtained so that the script arrangement can be combined with client information and the output strategy is more reasonable. At the same time, it is trained using AI deep learning to improve the efficiency of obtaining scripts, and the parameters for script updates can be quickly obtained based on the continuous updates of historical threat handling reports or threat events.

[0054] In the above optional embodiment, the client information includes at least one of the following: application certificate information, application version information, Bluetooth address, WLAN MAC address, battery charging status, accelerometer information, gyroscope information, wireless network IP information, wireless network SSID information and GPS device fingerprint information.

[0055] The mobile application security protection method provided in this embodiment utilizes AI deep learning to construct models and parameters for inputting threat events and outputting protection strategies. Deep learning hides the feature set in the decision-making process, rather than using existing fixed rules such as if-then, preventing attackers from circumventing security measures by changing several variables. The security team then receives alert information from SIEM / situational awareness for the mobile app, automatically orchestrates threats existing on the mobile app, and uses scenario-specific scripts to flexibly dispatch security capabilities and initiate protection measures, forming a SOAR model. A security protection SDK is also embedded in the mobile app. When the mobile app faces a single threat, it responds to protection strategies in real time, such as pop-up notifications, message warnings, and app exits. For multiple threats, the SOAR intelligent orchestration model is used to construct threat events and output corresponding protection strategies. Furthermore, the server can record whether the threat attack has been effectively handled, automatically enriching the security event context, continuously tracking it, and implementing coordinated response measures, forming a closed-loop threat handling system. For unknown threats, the SOAR model can develop execution plans and scripts based on existing scenarios or cases for similar threat handling, promptly notifying users of the threat on the mobile app to avoid losses.

[0056] An embodiment of the present invention provides a non-volatile computer storage medium, wherein the computer storage medium stores at least one executable instruction, and the computer executable instruction can execute the security protection method for mobile applications in any of the above method embodiments.

[0057] Figure 5 The schematic diagram of the structure of the computing device provided by the embodiment of the present invention is shown. The specific embodiment of the present invention does not limit the specific implementation of the computing device.

[0058] like Figure 5 As shown, the computing device may include: a processor (processor) 502 , a communications interface (Communications Interface) 504 , a memory (memory) 506 , and a communication bus 508 .

[0059] Processor 502, communication interface 504, and memory 506 communicate with each other via communication bus 508. Communication interface 504 is used to communicate with other devices, such as clients or other server network elements. Processor 502 is used to execute program 510, which may specifically perform the steps of the aforementioned embodiment of the security protection method for mobile applications on a computing device.

[0060] Specifically, the program 510 may include program codes, which include computer operation instructions.

[0061] Processor 502 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The one or more processors included in a computing device may be processors of the same type, such as one or more CPUs, or processors of different types, such as one or more CPUs and one or more ASICs.

[0062] The memory 506 is used to store the program 510. The memory 506 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0063] The program 510 may be specifically configured to enable the processor 502 to perform the following operations:

[0064] The security protection SDK detects threat data of the mobile application and identifies whether the mobile application is currently attacked by only a single known threat event based on the threat data;

[0065] If so, enable the threat protection strategy for the single known threat event deployed in the security protection SDK for protection;

[0066] If not, the threat data is sent to the SOAR automatic orchestration response model, and the script in the SOAR automatic orchestration response model outputs a protection strategy according to the threat data to perform security protection on the mobile application.

[0067] In an optional manner, the known threat events include at least one of the following: framework attacks, injection attacks, debugging attacks, interface hijacking, location fraud, simulator analysis, crash analysis, virus and Trojan attacks, ROOT attacks, malicious application attacks, kernel destruction, system acceleration attacks, LIBC attacks, device information tampering, network proxy, sensitive configuration, risky processes, domain name risks, and WIFI analysis.

[0068] In an optional manner, the script sets the priority of handling multiple threat events;

[0069] The program 510 further causes the processor 502 to perform the following operations: the script outputs a protection strategy corresponding to the threat data according to the processing priority.

[0070] In an optional manner, the program 510 further causes the processor 502 to perform the following operations:

[0071] The security protection SDK collects client information of mobile applications and sends the client information to the SOAR automatic orchestration response model;

[0072] The SOAR automatic orchestration response model constructs analytical data of user behavior based on the client information;

[0073] The AI ​​deep learning module constructs the parameters of the script by learning the analysis data and historical threat handling reports.

[0074] In an optional manner, the client information includes at least one of the following: application certificate information, application version information, Bluetooth address, WLAN MAC address, battery charging status, accelerometer information, gyroscope information, wireless network IP information, wireless network SSID information and GPS device fingerprint information.

[0075] The algorithm or display provided herein is not inherently related to any particular computer, virtual system or other device. Various general-purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the embodiment of the present invention is not directed to any specific programming language. It should be understood that various programming languages ​​can be utilized to implement the content of the embodiment of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the embodiment of the present invention.

[0076] In the description provided herein, numerous specific details are described. However, it is understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0077] Similarly, it should be understood that in order to streamline the embodiments of the invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the invention, various features of the embodiments of the invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed approach should not be interpreted as reflecting an intention that the claimed embodiments of the invention require more features than are expressly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in less than all of the features of the individual embodiments disclosed above. Accordingly, the claims that follow the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of the invention.

[0078] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed herein may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0079] Furthermore, those skilled in the art will appreciate that although some embodiments herein include certain features included in other embodiments but not other features, combinations of features from different embodiments are intended to be within the scope of the present invention and to form different embodiments. For example, in the claims below, any of the claimed embodiments may be used in any combination.

[0080] The various component embodiments of the present invention can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all of the functions of some or all of the components according to the embodiments of the present invention. The embodiments of the present invention can also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing an embodiment of the present invention can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0081] It should be noted that the above embodiments illustrate rather than limit the embodiments of the invention, and that a person skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The embodiments of the invention may be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments should not be understood as limiting the order of execution unless otherwise specified.

Claims

1. A security protection system for mobile applications, comprising: Mobile application, security protection SDK, SOAR automatic orchestration response model and AI deep learning module, the security protection SDK is integrated into the mobile application; The security protection SDK is deployed with a variety of known threat event detection technologies and threat protection strategies for the detection and protection of a single known threat event; The SOAR automatic orchestration response model includes a script for handling multiple known threat events and / or unknown threat events, and is used to perform security protection after receiving threat data of multiple known threat events and / or unknown threat events sent by the security protection SDK. The SOAR automatic orchestration response model is also used to construct user behavior analysis data based on client information of mobile applications; The AI ​​deep learning module constructs the parameters of the script by learning the analysis data and historical threat handling reports.

2. The system according to claim 1, wherein: The AI ​​deep learning module is used to construct a script in the SOAR automatic orchestration response model through AI deep learning or artificial intelligence algorithms.

3. A security protection method for mobile applications implemented based on the system of claim 1 or 2, comprising: The security protection SDK detects threat data of the mobile application and identifies whether the mobile application is currently attacked by only a single known threat event based on the threat data; If so, enable the threat protection strategy for the single known threat event deployed in the security protection SDK for protection; If not, the threat data of the multiple known threat events and / or unknown threat events are sent to the SOAR automatic orchestration response model, and the script in the SOAR automatic orchestration response model outputs a protection strategy based on the threat data to perform security protection on the mobile application; The SOAR automatic orchestration response model constructs analysis data of user behavior based on client information of mobile applications; the AI ​​deep learning module constructs parameters of the script by learning the analysis data and historical threat handling reports.

4. The method according to claim 3, wherein: The known threat events include at least one of the following: framework attacks, injection attacks, debugging attacks, interface hijacking, location fraud, simulator analysis, crash analysis, virus and Trojan attacks, ROOT attacks, malicious application attacks, kernel destruction, system acceleration attacks, LIBC attacks, device information tampering, network proxy, sensitive configuration, risky processes, domain name risks, and WIFI analysis.

5. The method according to claim 3 or 4, wherein: The script sets the priority for handling multiple threat events; The step of sending the threat data to the SOAR automatic orchestration response model, wherein the script in the SOAR automatic orchestration response model outputs a protection strategy based on the threat data, further includes: The script outputs a protection strategy corresponding to the threat data according to a processing priority.

6. The method according to claim 5, wherein: Before the script in the SOAR automatic orchestration response model outputs a protection strategy based on the threat data, the method further includes: The security protection SDK collects client information of the mobile application and sends the client information to the SOAR automatic orchestration response model.

7. The method according to claim 6, wherein: The client information includes at least one of the following: application certificate information, application version information, Bluetooth address, WLAN MAC address, battery charging status, accelerometer information, gyroscope information, wireless network IP information, wireless network SSID information, and GPS device fingerprint information.

8. A computing device comprising: A processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute an operation corresponding to the security protection method for mobile applications according to any one of claims 3 to 7.

9. A computer storage medium, wherein the storage medium stores at least one executable instruction, wherein the executable instruction enables a processor to execute an operation corresponding to the mobile application security protection method according to any one of claims 3 to 7.

Images