Intelligent terminal intrusion detection method

Abstract

The present invention discloses an intelligent terminal intrusion detection method and medium, wherein the method comprises: S101, acquiring feature information; S102, performing coding conversion, and generating a feature data set according to the numerical features obtained by the conversion; S103, performing standardization and normalization to obtain a training data set; S104, training a local end model, and extracting a first parameter sequence; S105, executing S101-S104 in a loop for multiple times to obtain multiple first parameter sequences; S106, acquiring a second parameter sequence, and determining a final parameter sequence corresponding to the local end; S107, encrypting the final parameter sequence, and sending a compressed package to a server end; S108, the server end performs fusion optimization on the server end model according to the multiple compressed packages, and feeds back the fusion optimized intrusion detection model to the intelligent terminal, so that the intelligent terminal performs intrusion detection; on the premise of being able to perform effective intrusion detection on the intelligent terminal, the personal information security of the user is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an intelligent terminal intrusion detection method and a computer-readable storage medium. Background Art

[0002] The rapid development of the Internet and smart devices has led to a surge in network traffic, making its infrastructure more complex and heterogeneous. In addition, since smart terminals or wearable devices generally use distributed networks, a large amount of data is generated every day. Therefore, in order to ensure the security of smart terminals, it is imperative to perform intrusion detection on smart terminals.

[0003] In the related art, personal data is mostly transmitted from the local end to a centralized server, and the centralized server is used to train the model based on the data to obtain a detection model; however, this method is not conducive to the protection of personal data, and there is a risk that users may leak personal information. Summary of the invention

[0004] The present invention aims to solve at least one of the technical problems in the above-mentioned technology to a certain extent. To this end, one object of the present invention is to provide a smart terminal intrusion detection method, which can effectively detect intrusion on the smart terminal and protect the user's personal information security.

[0005] A second object of the present invention is to provide a computer-readable storage medium.

[0006] To achieve the above-mentioned purpose, the first embodiment of the present invention proposes a smart terminal intrusion detection method, comprising the following steps: S101, obtaining feature information of the smart terminal in a normal state and an invaded state respectively, wherein the feature information includes system feature information and flow feature information; S102, encoding and converting the system feature information and the flow feature information to convert the system feature information and the flow feature information into numerical features, and generating a feature data set according to the converted numerical features; S103, standardizing and normalizing the data in the feature data set to obtain a training data set; S104, training a local model according to the training data set to obtain a local initial model. model, and extract the first parameter sequence corresponding to the local initial model; S105, execute S101-S104 multiple times in a loop to obtain multiple first parameter sequences; S106, obtain the second parameter sequence returned by the server, and determine the final parameter sequence corresponding to the local end according to the second parameter sequence and multiple first parameter sequences; S107, encrypt the final parameter sequence to form a compressed package, and send the compressed package to the server; S108, the server performs fusion optimization on the server model according to the compressed packages sent by multiple smart terminals, and feeds back the fusion optimized intrusion detection model to the smart terminal, so that the smart terminal performs intrusion detection through the fusion optimized intrusion detection model.

[0007] According to the smart terminal intrusion detection method of the embodiment of the present invention, first, S101, obtain characteristic information of the smart terminal in a normal state and an invaded state respectively, wherein the characteristic information includes system characteristic information and flow characteristic information; S102, encode and convert the system characteristic information and the flow characteristic information to convert the system characteristic information and the flow characteristic information into numerical characteristics, and generate a characteristic data set according to the converted numerical characteristics; S103, standardize and normalize the data in the characteristic data set to obtain a training data set; S104, train a local end model according to the training data set to obtain a local end initial model, and extract a first parameter sequence corresponding to the local end initial model; S105 05, execute S101-S104 in a loop for multiple times to obtain multiple first parameter sequences; S106, obtain the second parameter sequence returned by the server, and determine the final parameter sequence corresponding to the local end according to the second parameter sequence and multiple first parameter sequences; S107, encrypt the final parameter sequence to form a compressed package, and send the compressed package to the server; S108, the server performs fusion optimization on the server model according to the compressed packages sent by multiple smart terminals, and feeds back the fusion optimized intrusion detection model to the smart terminal, so that the smart terminal performs intrusion detection through the fusion optimized intrusion detection model; thereby achieving effective intrusion detection on the smart terminal and ensuring the security of the user's personal information.

[0008] In addition, the intelligent terminal intrusion detection method proposed in the above embodiment of the present invention may also have the following additional technical features:

[0009] Optionally, the system characteristic information includes memory information, battery power information, display information and port status information; the traffic characteristic information includes compressed packet information generated when the smart terminal is connected to other terminals and data is transmitted.

[0010] Optionally, the final parameter sequence is determined according to the following formula:

[0011]

[0012]

[0013] Among them, β represents the deviation of the local initial model quality, α represents the weighted parameter of the database quality, and P i represents multiple first parameter sequences, S represents the second parameter sequence, j represents the number of training iterations, P r Represents the final parameter sequence, P b represents the parameter sequence in the original intelligent terminal intrusion detection model at the local end, and K represents the correlation coefficient.

[0014] Optionally, the final parameter sequence is encrypted to form a compressed package, including: obtaining a random security parameter, and generating a public key and a corresponding private key based on the random security parameter; encrypting the final parameter sequence according to the public key to obtain an encrypted sequence; and compressing and packaging the encrypted sequence, the public key and the private key to generate a compressed package.

[0015] To achieve the above objectives, a second aspect of the present invention provides a computer-readable storage medium on which a smart terminal intrusion detection program is stored. When the smart terminal intrusion detection program is executed by a processor, the smart terminal intrusion detection method as described above is implemented.

[0016] According to the computer-readable storage medium of an embodiment of the present invention, by storing a smart terminal intrusion detection program, the processor implements the smart terminal intrusion detection method as described above when executing the smart terminal intrusion detection program, thereby ensuring the security of the user's personal information under the premise of effective intrusion detection of the smart terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 The figure is a flow chart of a smart terminal intrusion detection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0019] In the related art, when performing intrusion detection, the security of the user's personal information is difficult to be guaranteed; according to the smart terminal intrusion detection method of the embodiment of the present invention, first, S101, obtain the characteristic information of the smart terminal in a normal state and an invaded state respectively, the characteristic information includes system characteristic information and flow characteristic information; S102, encode and convert the system characteristic information and the flow characteristic information to convert the system characteristic information and the flow characteristic information into numerical characteristics, and generate a characteristic data set according to the converted numerical characteristics; S103, standardize and normalize the data in the characteristic data set to obtain a training data set; S104, train a local end model according to the training data set to obtain a local end initial model, and extract the local end initial model. S105, executing S101-S104 multiple times in a loop to obtain multiple first parameter sequences; S106, obtaining the second parameter sequence returned by the server, and determining the final parameter sequence corresponding to the local end according to the second parameter sequence and the multiple first parameter sequences; S107, encrypting the final parameter sequence to form a compressed package, and sending the compressed package to the server; S108, the server performs fusion optimization on the server model according to the compressed packages sent by the multiple smart terminals, and feeds back the fusion optimized intrusion detection model to the smart terminal, so that the smart terminal performs intrusion detection through the fusion optimized intrusion detection model; thereby achieving effective intrusion detection on the smart terminal and ensuring the security of the user's personal information.

[0020] In order to better understand the above technical solution, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0021] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0022] Figure 1 FIG. 1 is a flow chart of a method for detecting intrusion in an intelligent terminal according to an embodiment of the present invention. Figure 1 As shown, the intelligent terminal intrusion detection method includes the following steps:

[0023] S101, acquiring characteristic information of the smart terminal in a normal state and an invaded state, respectively, wherein the characteristic information includes system characteristic information and traffic characteristic information.

[0024] That is, characteristic information of the smart terminal (ie, the local terminal) when it is in a normal state and an invaded state is obtained, so that the recognition model can be trained based on the characteristic information; wherein the characteristic information includes system characteristic information and traffic characteristic information.

[0025] It should be noted that there are many ways to select system characteristic information and traffic characteristic information.

[0026] As an example, the system characteristic information includes memory information, battery power information, display information and port status information; the traffic characteristic information includes compressed packet information generated when the smart terminal is connected to other terminals for data transmission.

[0027] In addition, it can be understood that there are multiple ways to collect feature information when the smart terminal is in a normal state and in an invaded state.

[0028] As an example, the collection is performed in a simulated manner; that is, when the smart terminal is in a normal state, its characteristic information is collected; then, the smart terminal is simulated to be invaded, and its characteristic information is collected when it is in an invaded state; at the same time, after the collection is completed, the collected characteristic information is marked according to its different states, so as to complete the collection of characteristic information of the smart terminal in a normal state and an invaded state. Specifically, the system characteristic information can be collected through the Binder control of the Android system, and the traffic characteristic information can be collected through the sniffer tool of the control end.

[0029] S102, encoding and converting the system characteristic information and the flow characteristic information to convert the system characteristic information and the flow characteristic information into numerical characteristics, and generating a characteristic data set according to the converted numerical characteristics.

[0030] As an example, the character type features in the collected system status feature information and traffic feature information are encoded and converted, that is, the types of a character type feature that have appeared are counted, and the type after statistics is n, that is, an n-dimensional vector; the vector value only contains two values ​​0 or 1, and each vector contains only 1 1 to represent the value type of the feature. Specifically, assuming the type is protocol, the character type feature is udp, which is converted to the corresponding numerical feature 001, the character type feature is tcp, which is converted to the corresponding numerical feature 010, and the character type feature is icmp, which is converted to the corresponding numerical feature 100.

[0031] S103, standardize and normalize the data in the feature data set to obtain a training data set.

[0032] S104, training a local model according to the training data set to obtain a local initial model, and extracting a first parameter sequence corresponding to the local initial model.

[0033] That is to say, the local end selects a suitable machine learning model (for example, adopts a convolutional neural network as a sub-model of the local intrusion detection model), and then trains the selected machine learning model according to the training data set to obtain the local initial model and extract the first parameter sequence corresponding to the local initial model.

[0034] As an example, a convolutional neural network is used as a sub-model of the local intrusion detection model. Then, assuming that the training data set contains N types of features and M groups of data are taken, the data set will form a data matrix of size N*M; the data matrix is ​​used as the input of the convolutional neural network, and the convolution layer will perform a convolution operation on the input data matrix to achieve correlation analysis and fit it into an intrusion detection curve, thereby obtaining the local initial model. Next, the parameters of the local initial model are extracted to obtain the first parameter sequence: P b ={ω1,ω2,…,ω n}.

[0035] S105, executing S101-S104 in a loop for multiple times to obtain multiple first parameter sequences.

[0036] S106, obtaining a second parameter sequence returned by the server, and determining a final parameter sequence corresponding to the local end according to the second parameter sequence and the plurality of first parameter sequences.

[0037] It is understandable that due to the different local training processes, the data set itself has some significant characteristics of malicious intrusion, and the local data set is not independent and identically distributed, which will cause the model trained on the local side to be unsuitable for multiple malicious intrusion detection situations. Therefore, based on this situation, the quality of the data set and the parameters of the optimized model fed back from the server are combined to achieve the preprocessing of the local model parameters.

[0038] As an example, first, extract the first parameter sequence P corresponding to the local initial model b ={ω1,ω2,…,ω n}; Then, the final parameter sequence is calculated according to the following formula:

[0039]

[0040]

[0041] Among them, β represents the deviation of the local initial model quality, α represents the weighted parameter of the database quality, and Pi represents multiple first parameter sequences, S represents the second parameter sequence, j represents the number of training iterations, P r Represents the final parameter sequence, P b represents the parameter sequence in the original intelligent terminal intrusion detection model at the local end, and K represents the correlation coefficient.

[0042] That is, the parameter sequence P obtained by multiple trainings i A difference analysis is performed with the parameter sequence S returned by the server to obtain the corresponding mean square error; then, the mean square error is weighted according to the quality of the database to obtain the model quality deviation; then, a correlation analysis is performed on the parameter sequence obtained by multiple optimizations to obtain the correlation coefficient K; further, the parameter sequence obtained by local model training is preprocessed in the above manner to obtain the final parameter sequence.

[0043] S107, encrypt the final parameter sequence to form a compressed package, and send the compressed package to the server.

[0044] There are multiple ways to encrypt the final parameter sequence to form a compressed package.

[0045] In some embodiments, the final parameter sequence is encrypted to form a compressed package, including: obtaining a random security parameter, and generating a public key and a corresponding private key based on the random security parameter; encrypting the final parameter sequence according to the public key to obtain an encrypted sequence; and compressing and packaging the encrypted sequence, the public key, and the private key to generate a compressed package.

[0046] As an example, first, the encrypted public key pk and the encrypted private key sk are generated by the random security parameter λ; then, the encrypted public key pk and the parameter sequence P to be encrypted are input into the encryption function to generate the encrypted sequence C; then, the encrypted parameter sequence C is compressed and packaged together with its encrypted public key pk and encrypted private key sk to form a network packet that can be transmitted by TCP. Then, the local end establishes a connection with the server end to transmit the network packet.

[0047] S108, the server side performs fusion optimization on the server side model according to the compressed packets sent by the multiple smart terminals, and feeds back the fusion optimized intrusion detection model to the smart terminal, so that the smart terminal performs intrusion detection through the fusion optimized intrusion detection model.

[0048] As an example, after receiving the encrypted compressed package from the local end, the server end decrypts and decompresses the compressed package. Specifically, first, the intrusion detection model compressed package from the local end is received, and the encrypted parameter sequence C, the encrypted public key pk, and the encrypted private key sk are obtained after decompression; then, the encrypted parameter sequence and the encrypted private key sk obtained by decompression are input into the decryption function to perform decryption operation to obtain the local parameter sequence P. Then, the server end model is fused and optimized according to the final parameter sequence in the compressed package sent by multiple local ends to obtain the optimized intrusion detection model; then, the optimized intrusion detection model is fed back to the local end so that the local end can perform intrusion detection through the optimized intrusion detection model.

[0049] In summary, according to the smart terminal intrusion detection method of the embodiment of the present invention, first, S101, obtain characteristic information of the smart terminal in a normal state and an invaded state respectively, wherein the characteristic information includes system characteristic information and flow characteristic information; S102, perform encoding conversion on the system characteristic information and the flow characteristic information to convert the system characteristic information and the flow characteristic information into numerical characteristics, and generate a characteristic data set according to the converted numerical characteristics; S103, standardize and normalize the data in the characteristic data set to obtain a training data set; S104, train a local end model according to the training data set to obtain a local end initial model, and extract a first parameter sequence corresponding to the local end initial model; S105, execute S101-S104 in a loop for multiple times to obtain multiple first parameter sequences; S106, obtain the second parameter sequence returned by the server, and determine the final parameter sequence corresponding to the local end according to the second parameter sequence and multiple first parameter sequences; S107, encrypt the final parameter sequence to form a compressed package, and send the compressed package to the server; S108, the server performs fusion optimization on the server model according to the compressed packages sent by multiple smart terminals, and feeds back the fusion optimized intrusion detection model to the smart terminal, so that the smart terminal performs intrusion detection through the fusion optimized intrusion detection model; thereby achieving effective intrusion detection on the smart terminal and ensuring the security of the user's personal information.

[0050] To implement the above embodiment, the present invention provides a computer-readable storage medium on which a smart terminal intrusion detection program is stored. When the smart terminal intrusion detection program is executed by a processor, the smart terminal intrusion detection method described above is implemented.

[0051] According to the computer-readable storage medium of an embodiment of the present invention, by storing a smart terminal intrusion detection program, the processor implements the smart terminal intrusion detection method as described above when executing the smart terminal intrusion detection program, thereby ensuring the security of the user's personal information under the premise of effective intrusion detection of the smart terminal.

[0052] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0053] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0054] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0055] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0056] It should be noted that in the claims, any reference signs placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claim. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention may be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

[0057] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0058] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

[0059] In the description of the present invention, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0060] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0061] In the present invention, unless otherwise clearly specified and limited, a first feature being "above" or "below" a second feature may mean that the first and second features are in direct contact, or the first and second features are in indirect contact through an intermediate medium. Moreover, a first feature being "above", "above" or "above" a second feature may mean that the first feature is directly above or obliquely above the second feature, or simply means that the first feature is higher in level than the second feature. A first feature being "below", "below" or "below" a second feature may mean that the first feature is directly below or obliquely below the second feature, or simply means that the first feature is lower in level than the second feature.

[0062] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms should not be understood as necessarily referring to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0063] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A smart terminal intrusion detection method, characterized in that: The following steps are involved: S101, acquiring characteristic information of the smart terminal in a normal state and an invaded state, wherein the characteristic information includes system characteristic information and traffic characteristic information; S102, performing encoding conversion on the system characteristic information and the flow characteristic information to convert the system characteristic information and the flow characteristic information into numerical characteristics, and generating a characteristic data set according to the converted numerical characteristics; S103, standardizing and normalizing the data in the feature data set to obtain a training data set; S104, training a local end model according to the training data set to obtain a local end initial model, and extracting parameters of the local end initial model to obtain a corresponding first parameter sequence; S105, executing S101-S104 repeatedly to obtain multiple first parameter sequences; S106, obtaining a second parameter sequence returned by the server, and determining a final parameter sequence corresponding to the local end according to the second parameter sequence and the plurality of first parameter sequences; The final parameter sequence is determined according to the following formula: Among them, β represents the deviation of the local initial model quality, α represents the weighted parameter of the database quality, and P i represents multiple first parameter sequences, S represents the second parameter sequence, j represents the number of training iterations, P r Represents the final parameter sequence, P b represents the parameter sequence in the original intelligent terminal intrusion detection model at the local end, and K represents the correlation coefficient; S107, encrypting the final parameter sequence to form a compressed package, and sending the compressed package to the server; S108, the server side performs fusion optimization on the server side model according to the compressed packets sent by the multiple smart terminals, and feeds back the fusion optimized intrusion detection model to the smart terminal, so that the smart terminal performs intrusion detection through the fusion optimized intrusion detection model.

2. The intelligent terminal intrusion detection method according to claim 1, characterized in that: The system characteristic information includes memory information, battery power information, display information and port status information; The traffic characteristic information includes compressed packet information generated when the smart terminal is connected to other terminals and data is transmitted.

3. The intelligent terminal intrusion detection method according to claim 1, characterized in that: The final parameter sequence is encrypted to form a compressed package, including: Obtaining a random security parameter, and generating a public key and a corresponding private key according to the random security parameter; Encrypting the final parameter sequence according to the public key to obtain an encrypted sequence; The encryption sequence, the public key and the private key are compressed and packaged to generate a compressed package.

4. A computer-readable storage medium, characterized in that: A smart terminal intrusion detection program is stored thereon, and when the smart terminal intrusion detection program is executed by the processor, the smart terminal intrusion detection method according to any one of claims 1 to 3 is implemented.

Images