A method and system for security monitoring of intelligent terminals participating in flexible resource aggregation and regulation

Abstract

The present invention discloses a method and system for monitoring the security of smart terminals that participate in flexible resource aggregation and regulation. The method includes obtaining data on risk evidence items in the smart terminal, where the risk evidence items represent target objects whose data in the smart terminal will change when the smart terminal is attacked; comparing monitoring rules for each risk point in the smart terminal with the data on the risk evidence items to determine whether to trigger the monitoring rules, where the monitoring rules include discrimination conditions and initial trust levels for attack behaviors corresponding to the risk points, and triggering monitoring rules where the discrimination conditions match the data on the risk evidence items; and determining attack behaviors against the smart terminal based on the trust levels of the attack behaviors in the triggered monitoring rules. The method has a high ability to identify attack behaviors.

Description

Technical Field

[0001] The present invention relates to the field of communication security technology, and in particular to a method and system for security monitoring of intelligent terminals participating in flexible resource aggregation and regulation. Background Art

[0002] With the advancement of technology, a large number of smart terminals are participating in integrated access services for new energy sources such as electric vehicles, wind power, and solar power, enabling accurate, real-time perception across power sources, grids, users, and supply chains. Security monitoring methods for smart terminals often deploy agent software on the terminals to collect and report data such as CPU and memory utilization, and the status of key processes. The platform then determines whether any abnormalities exist based on baseline values ​​and issues security alerts.

[0003] At present, there is no security monitoring method specifically for smart terminals involved in flexible resource aggregation and control. At the same time, the data collection and monitoring items of existing security monitoring methods on smart terminals are heavily dependent on the exploitation of known vulnerabilities and manual analysis experience in basic network attack incidents. There is a lack of comprehensive attack surface sorting and threat analysis for smart terminals, and there are problems such as single collection items and insufficient risk identification capabilities.

[0004] Therefore, there is an urgent need for a method to improve the ability to identify attack behaviors. Summary of the Invention

[0005] In view of this, the embodiments of the present invention provide a security monitoring method, a security monitoring system, an electronic device, and a computer-readable storage medium for intelligent terminals participating in flexible resource aggregation and regulation, which have a high ability to identify attack behaviors.

[0006] In one aspect, the present invention provides a method for security monitoring of intelligent terminals participating in flexible resource aggregation and regulation, the method comprising:

[0007] Acquire data of a risk evidence item in a smart terminal, where the risk evidence item represents a target object whose data in the smart terminal will change when the smart terminal is attacked;

[0008] Comparing the monitoring rules of each risk point in the smart terminal with the data of the risk evidence item to determine a trigger monitoring rule, wherein the monitoring rule includes a discrimination condition and an initial trust level of the attack behavior corresponding to the risk point, and the trigger monitoring rule is a monitoring rule whose discrimination condition matches the data of the risk evidence item; and

[0009] The attack behavior targeting the smart terminal is determined according to the initial trust level of the attack behavior in the trigger monitoring rule.

[0010] Another aspect of the present invention provides a safety monitoring system, comprising:

[0011] A data acquisition module, configured to acquire data of a risk evidence item in a smart terminal, wherein the risk evidence item represents a target object whose data in the smart terminal will change when the smart terminal is attacked;

[0012] a comparison module, configured to compare the monitoring rules for each risk point in the smart terminal with the data of the risk evidence item to determine a trigger monitoring rule, wherein the monitoring rule includes a discrimination condition and an initial trust level for the attack behavior corresponding to each risk point, and the trigger monitoring rule is a monitoring rule whose discrimination condition matches the data of the risk evidence item; and

[0013] The attack behavior monitoring module is used to determine the attack behavior against the smart terminal according to the initial trust level of the attack behavior in the trigger monitoring rule.

[0014] Another aspect of the present invention provides an electronic device, comprising a processor and a memory, wherein the memory is used to store a computer program, and when the computer program is executed by the processor, the method described above is implemented.

[0015] Another aspect of the present invention provides a computer-readable storage medium for storing a computer program. When the computer program is executed by a processor, the method described above is implemented.

[0016] In the technical solutions of some embodiments of the present application, monitoring rules for each risk point in a smart terminal are established. After obtaining data on risk evidence items in the smart terminal, the monitoring rules for each risk point in the smart terminal are compared with the data on the risk evidence items to determine the triggering monitoring rules. Based on the initial trust level of the attack behavior in the triggering monitoring rules, the attack behavior against the smart terminal is determined. In this way, when monitoring attack behavior, the collected data can be sequentially compared with the monitoring rules for each risk point in the smart terminal, thereby comprehensively monitoring possible attack behaviors against the smart terminal and improving the ability to identify attack behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The features and advantages of the present invention will be more clearly understood by referring to the accompanying drawings, which are schematic and should not be construed as limiting the present invention in any way. In the accompanying drawings:

[0018] Figure 1 A schematic diagram of the overall architecture of a smart terminal provided by an embodiment of the present application is shown;

[0019] Figure 2 A schematic diagram of a data flow attack path of an attack surface provided by an embodiment of the present application is shown;

[0020] Figure 3 A schematic diagram showing a flow chart of a safety monitoring method provided by an embodiment of the present application is shown;

[0021] Figure 4 A schematic diagram of a safety monitoring system according to an embodiment of the present invention is shown;

[0022] Figure 5 A schematic diagram of an electronic device provided by an embodiment of the present application is shown. DETAILED DESCRIPTION

[0023] To make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of the present invention.

[0024] Based on the security monitoring method of this application, it is possible to monitor whether there are attacks against smart terminals, and the ability to identify attacks is relatively high. Before executing the security monitoring method of this application, you can first comprehensively sort out the risk points existing in the smart terminal, then establish monitoring rules for each risk point, and finally monitor attacks against the smart terminal based on the established monitoring rules. The following is a detailed description of the risk point sorting and monitoring rule establishment.

[0025] In some embodiments, risk points represent malicious operations that can be performed on smart terminals under the hardware and software architecture of smart terminals, such as data tampering, obtaining smart terminal operating system permissions, etc. Each risk point can correspond to one or more attack behaviors. That is, the same malicious operation can be performed on a smart terminal through one or more different attack behaviors. For example, by exploiting the open SSH service TCP22 port of the smart terminal and the login bypass vulnerability in the lower version of the SSH service, it is possible to obtain the smart terminal operating system permissions through a brute force attack, or to obtain the smart terminal operating system permissions through a login bypass authentication attack.

[0026] In some embodiments, when sorting out the risk points of smart terminals, the attack surface of the smart terminals can be decomposed based on the overall architecture of the smart terminals that participate in flexible resource aggregation and regulation, and the risk points in the smart terminals can be determined based on the data flow attack path of each attack surface. Figure 1 , which is a schematic diagram of the overall architecture of a smart terminal provided in one embodiment of the present application. Figure 1 In the , the overall architecture of the intelligent terminal may include:

[0027] Basic platform, including hardware communication interface, drivers and basic operating system;

[0028] Resource virtualization platform, consisting of an abstraction layer for containers and hardware resources;

[0029] Micro-application platform, which has the function of completing specific business, including basic software and business software;

[0030] The data bus, based on inter-container IP technology and the MQTT protocol, enables cross-container message interaction;

[0031] Information security platform, including data collection security, data storage security, data access security and data uplink communication security.

[0032] based on Figure 1 In the overall architecture of a smart terminal shown in Figure 1, the attack surface represents the set of attack paths that can be used to attack the smart terminal through a single input source. This input source can be an HTTP data source, an OSS data source, or something similar. The resulting attack surface can include, but is not limited to, the smart terminal's hardware interfaces, operating system, containers, system services, applications, network communications, the main station, and sensor units. Simply put, the attack surface represents the entry point into the smart terminal or the data flow entities between its components. Through this attack surface, malicious operations can be performed against the smart terminal. Generally speaking, the more attack surfaces a smart terminal has, the greater its vulnerability to attack.

[0033] In some embodiments, for the decomposed attack surface, threat modeling can be performed on each attack surface based on the STRIDE threat modeling method to generate data flow attack paths for each attack surface, thereby determining the risk points in the smart terminal. Figure 2 , which is a schematic diagram of a data flow attack path of an attack surface provided by an embodiment of the present application. Figure 2 In this example, the attack surface is the system service of the smart terminal. Assuming that the smart terminal has opened a high-risk SSH service port (i.e., TCP port 22), an attacker can directly obtain ordinary user permissions of the smart terminal operating system based on attack behaviors such as brute force cracking or SSH login authentication bypass vulnerabilities. Furthermore, based on the privilege escalation vulnerability in the smart terminal, the attacker can obtain root permissions of the operating system. The STRIDE threat modeling method is a conventional technology in the relevant field and will not be explained in detail here. Based on the STRIDE threat modeling method, the risk points in smart terminals can be divided into the following six types:

[0034] Identity spoofing: This refers to attempting to gain operating system access by using a false identity. Attackers can use stolen user authentication information or spoofed IP addresses to achieve identity spoofing. Once an attacker successfully gains operating system access as a legitimate user or local host, they can further escalate privileges or perform other malicious operations as authorized users.

[0035] Data tampering: refers to the malicious modification of data without authorization, such as tampering with communication data between two computers on a network.

[0036] Repudiation: This refers to an attacker's ability to deny (legally or illegally) that they performed an action or business. Without proper auditing measures, it is difficult to verify that the attacker has launched a repudiation attack.

[0037] Information Disclose: This refers to the unintended disclosure of private data. For example, an attacker can access the contents of unauthorized forms or files, or monitor plaintext data sent over the network. Some examples of information disclosure vulnerabilities include hidden form fields, database connection statements and connection information left in web page comments, and inadequate exception handling that can reveal internal system information to an attacker. All of this information can be very helpful to an attacker in carrying out an attack.

[0038] Denial of Service (DOS): refers to the process of rendering a system or application unavailable. For example, a DoS attack can be achieved by flooding a server with requests, consuming all available system resources. Alternatively, a DoS attack can be achieved by sending malformed input sufficient to crash an application process.

[0039] Privilege escalation occurs when a user with limited privileges gains privileged access to an application as a privileged user. For example, an attacker with limited privileges can use this escalation to compromise or take over a trusted process or account with higher privileges.

[0040] Based on the STRIDE threat modeling method, we can traverse the possible risk points in smart terminals and obtain a list of risk points in smart terminals.

[0041] Furthermore, the risk level of each risk point in the obtained risk point list can be evaluated. Specifically, the obtained risk point list can be input into the DREAD model to evaluate the risk level of each risk point. The DREAD model can evaluate the risk level of each risk point according to the criteria shown in Table 1.

[0042] Table 1 Risk Level

[0043]

[0044] Based on Table 1, different risk levels can be assigned different weights, such as a high risk level with a weight of 3, a medium risk level with a weight of 2, and a low risk level with a weight of 1. For a risk point, the risk point can be evaluated in sequence according to the evaluation factors to obtain the weight of the risk point at each evaluation factor, and then the risk level of the risk point can be calculated based on the weight of the risk point at each evaluation factor. For example, the risk point A has a weight of 3 in terms of potential destructiveness; a weight of 2 in terms of reproducibility; a weight of 1 in terms of exploitability; a weight of 2 in terms of affected users; and a weight of 1 in terms of discoverability. Based on the above weights, the risk level of the risk point can be determined. For example, the above weights can be added together. The larger the value obtained by the addition, the higher the risk level of the risk point.

[0045] Furthermore, for each risk point in the risk list, the risk evidence items for each risk point can also be determined based on methods such as manual experience analysis. The risk evidence items represent the target objects whose data in the smart terminal will change when the smart terminal is attacked, such as log files, processes, TCP packets, etc. in the smart terminal. Specifically, for one of the risk points, the evidence item of the risk point is the target object whose data will change in the smart terminal when the attack behavior corresponding to the risk point occurs. It is understandable that the attack behavior corresponding to each risk point can be different, so the risk evidence items corresponding to different risk points can also be different. Table 2 exemplifies the risk evidence items of a risk point.

[0046] Table 2 Risk evidence items

[0047]

[0048] For the risk points shown in Table 2, the corresponding risk evidence items are SSH login logs, the CPU utilization of the SSH process, and the message information received on TCP port 22. For example, if an attacker attempts to attack a smart terminal through brute force, the SSH login log will contain log information of multiple user login attempts within a single period, or the CPU utilization of the SSH process will increase.

[0049] It should be noted that if a risk point corresponds to multiple attack behaviors, then when different attack behaviors occur, the risk evidence items corresponding to that risk point may have different data changes. Let's use Table 2 as an example. Assume that the risk point in Table 2 corresponds to two attack behaviors. When one attack behavior occurs, the data in the SSH login log and the CPU utilization of the SSH process may change. When the other attack behavior occurs, the data in the TCP port 22 and the CPU utilization of the SSH process may change.

[0050] Furthermore, after determining the risk point and the risk evidence item corresponding to the risk point, the discrimination conditions for the attack behavior corresponding to the risk point can also be determined based on methods such as manual experience analysis. Specifically, the discrimination conditions can be used to characterize the data characteristics of the risk evidence item in the smart terminal. That is, the data characteristics of the risk evidence item when the attack behavior corresponding to the risk point occurs. The discrimination conditions can be an expert assessment of security anomalies for the risk evidence item data. Taking the risk point in Table 2 as an example, it is assumed that the risk point corresponds to two attack behaviors, one of which uses a brute force method to obtain the operating system permissions of the smart terminal, and the other attack behavior uses login authentication to bypass vulnerabilities to obtain the operating system permissions of the smart terminal. Table 3 exemplifies the discrimination conditions for the two attack behaviors.

[0051] Table 3 Judgment conditions

[0052]

[0053] It is understandable that based on the identified risk points, risk evidence items, and attack behavior discrimination conditions, the smart terminal can be monitored in reverse. For example, during the operation of the smart terminal, the data of the risk evidence items in the smart terminal can be collected in real time. If, among the collected risk evidence items, the log information in the SSH login log and the CPU utilization of the SSH process meet the discrimination conditions shown in the second row of Table 3, then it can be determined that a brute force attack has occurred against the smart terminal. In this application, pre-established monitoring rules can be used to monitor attack behaviors against smart terminals. Among them, the monitoring rules can correspond one-to-one to the risk points.

[0054] In some embodiments, the monitoring rules include the criteria for determining the attack behavior corresponding to the risk point and the initial trust level. The criteria are as described above and are not repeated here. The initial trust level can represent the credibility of the attack behavior. Specifically, the initial trust level of the attack behavior can be determined based on at least one of the following:

[0055] The risk level of the risk point corresponding to the monitoring rule. For example, based on Table 1 above, if the risk level of a risk point is high, its reproducibility and exploitability are high. In this case, it may not be necessary to bypass the security mechanism of the smart terminal to directly operate the smart terminal. Since the attack threshold is low, the attacker can attack again at will, so the initial trust level can be high (that is, the credibility of the occurrence can be high).

[0056] The threat level of the attack. Generally, the higher the threat level of an attack, the higher the initial trust level can be, allowing for greater attention to be paid to that attack. The threat level of an attack can be calculated based on manual analysis and experience.

[0057] In some embodiments, when a risk point corresponds to multiple attack behaviors, the monitoring rules for the risk point can specify a discrimination condition and initial trust level for each attack behavior corresponding to the risk point. Assuming that the risk point is obtaining access rights to the network system where the smart terminal is located, and that the risk point corresponds to two attack behaviors, the monitoring rules for the risk point can be exemplified by expression (1).

[0058] RULE<condition name>:IF{r1,r2}THEN{R1,R2},CF={C1,C2} (1)

[0059] Here, r1 can represent the judgment condition of attack behavior 1, r2 can represent the judgment condition of attack behavior 2, R1 represents attack behavior 1, R2 represents attack behavior 2, C1 represents the initial trust of attack behavior 1, and C2 represents the initial trust of attack behavior 2. For ease of understanding, expression (1) can be represented by Table 4.

[0060] Form 4 Monitoring Rules

[0061]

[0062]

[0063] It is understandable that the monitoring rules corresponding to different risk points may contain discrimination criteria and initial trust levels for the same attack behavior. For example, the monitoring rules for risk point A and risk point B may both include a brute force attack based on the SSH system service. Furthermore, the initial trust levels for the attack behavior in the monitoring rules for risk point A and risk point B may differ. For example, in the monitoring rules for risk point A, the initial trust level for the attack behavior is 0.3, while in the monitoring rules for risk point B, the initial trust level for the attack behavior is 0.4.

[0064] Based on the risk points, risk evidence items and monitoring rules obtained, the security monitoring method of this application can be executed to monitor attack behaviors against smart terminals. Figure 3 , which is a flow chart of a security monitoring method provided in one embodiment of the present application. The security monitoring method can be applied to a smart terminal or a monitoring device that monitors attack behaviors on a smart terminal. When the security monitoring method is applied to a smart terminal, the smart terminal can determine whether there is an attack behavior against the device based on the operation of the device; when the security monitoring method is applied to a monitoring device, the monitoring device can run the security monitoring method of the present application to collect data from the smart terminal, and determine whether there is an attack behavior against the smart terminal based on the collected data. Figure 3 In the present invention, the safety monitoring method may include the following steps:

[0065] Step S31 : obtaining data of risk evidence items in the smart terminal. The risk evidence items represent target objects whose data in the smart terminal will change when the smart terminal is attacked.

[0066] In some embodiments, the target objects in the smart terminal that will experience data changes when the attack behavior corresponding to each risk point occurs can be analyzed. The target objects corresponding to all risk points in the smart terminal can be aggregated to obtain risk evidence items. The target objects corresponding to each risk point can be analyzed and obtained based on the method related to Table 2 above, which will not be detailed here.

[0067] In some embodiments, data of evidence items in the smart terminal can be collected in real time or periodically, so as to monitor attack behaviors against the smart terminal in real time or periodically through subsequent steps S32 and S33 based on the collected data.

[0068] In step S32, the monitoring rules of each risk point in the smart terminal are compared with the data of the risk evidence item to determine the triggering monitoring rules, wherein the monitoring rules include the judgment conditions and initial trust level of the attack behavior corresponding to the risk point. The triggering monitoring rules are monitoring rules whose judgment conditions match the data of the risk evidence item.

[0069] In some embodiments, for any monitoring rule, it is determined that the discrimination condition of the monitoring rule matches the data of the risk evidence item when the following conditions are met:

[0070] Determining a first data feature of the risk evidence item based on the acquired data of the risk evidence item, and determining a second data feature of the risk evidence item based on a discrimination condition of the monitoring rule;

[0071] If the first data feature and the second data feature match, it is determined that the discrimination condition of the monitoring rule matches the data of the risk evidence item.

[0072] In the case where there are multiple discrimination conditions in the monitoring rule, each discrimination condition can be compared with the data of the risk evidence item in turn. Specifically, for any discrimination condition, the target risk evidence items that need to be paid attention to and the second data features of these target risk evidence items in the discrimination condition can be determined based on the discrimination condition. Then, these target risk evidence items are screened out from the data of the acquired risk evidence items, and the first data features of these target risk evidence items are determined. If the first data feature matches the second data feature, it means that the discrimination condition matches the data of the acquired risk evidence items.

[0073] Taking the above Table 4 as an example, the two judgment conditions in Table 4 can be compared with the data of the obtained risk evidence items respectively. Assuming that in the data of the obtained risk evidence items, there is log information in the SSH login log that the user has attempted to log in multiple times in a single time period, the CPU utilization of the SSH process is increased, and the TCP22 port has not received abnormal message information, it means that the judgment condition in the second row of Table 4 matches the data of the obtained risk evidence items, but the judgment condition in the third row does not match the data of the obtained risk evidence items.

[0074] However, if in the data of the obtained risk evidence item, there is no log information in the SSH login log that the user has attempted to log in multiple times in a single period of time, the CPU utilization of the SSH process has not increased, and no abnormal message information has been received on the TCP22 port, then it means that both judgment conditions in Table 4 do not match the data of the obtained risk evidence item.

[0075] In some embodiments, when a risk point corresponds to multiple attack behaviors, if one of the discrimination conditions in a monitoring rule matches the data of the risk evidence item, the monitoring rule is determined to be a triggering monitoring rule. For example, in Table 4 above, assuming that the discrimination condition in the second row matches the data of the acquired risk evidence item, but the discrimination condition in the third row does not match the data of the acquired risk evidence item, the monitoring rule can be determined to be a triggering monitoring rule. However, if both discrimination conditions in Table 4 do not match the data of the acquired risk evidence item, the monitoring rule does not need to be determined to be a triggering monitoring rule.

[0076] In this way, the acquired risk evidence items are sequentially compared with the monitoring rules corresponding to each risk point to determine whether a monitoring rule is triggered in the network monitoring rules. If a monitoring rule is triggered, step S33 can be continued.

[0077] Step S33: determining the attack behavior targeting the smart terminal according to the initial trust level of the attack behavior in the trigger monitoring rule.

[0078] In some embodiments, if the initial trust level of the attack behavior in the triggering monitoring rule is greater than a threshold, it may indicate that there is an attack behavior against the smart terminal, and the attack behavior is an attack behavior whose initial trust level in the triggering monitoring rule is greater than the threshold.

[0079] In some embodiments, considering that a single attack behavior may correspond to multiple risk points of a smart terminal, that is, a single attack behavior may cause multiple monitoring rules to be determined as triggering monitoring rules, and the initial trust levels of the attack behavior may exist in all of the multiple triggering monitoring rules, but the initial trust levels for the attack behavior in the multiple triggering monitoring rules may not be exactly the same. In this case, in order to improve the accuracy of monitoring, the above-mentioned determination of the attack behavior against the smart terminal based on the initial trust levels of the attack behavior in the triggering monitoring rules may include:

[0080] For any attack behavior, if the initial trust of the attack behavior in multiple trigger monitoring rules is different, the initial trust of the attack behavior in multiple trigger monitoring rules is integrated to obtain the integrated credibility of the attack behavior;

[0081] If the fusion credibility of the attack behavior is greater than the threshold, it is determined that the attack behavior is included in the attack behavior against the smart terminal.

[0082] Specifically, the initial trust levels in multiple trigger monitoring rules can be integrated based on the DS evidence theory. The DS evidence theory is a conventional technology in the relevant field and will not be described in detail here.

[0083] It is understandable that, in addition to the DS evidence theory, the fusion of the initial trust levels in multiple trigger monitoring rules can also be achieved based on other fusion methods, and this application does not limit this.

[0084] In some embodiments, after identifying attacks against smart terminals, these attacks can be displayed on the monitoring interface to issue an alert, facilitating timely response by staff. Of course, detected attacks can also be sent to staff via text messages or other means. This application does not limit the alert method.

[0085] In the technical solutions of some embodiments of the present application, monitoring rules for each risk point in a smart terminal are established. After obtaining data on risk evidence items in the smart terminal, the monitoring rules for each risk point in the smart terminal are compared with the data on the risk evidence items to determine the triggering monitoring rules. Based on the initial trust level of the attack behavior in the triggering monitoring rules, the attack behavior against the smart terminal is determined. In this way, when monitoring attack behavior, the collected data can be sequentially compared with the monitoring rules for each risk point in the smart terminal, thereby comprehensively monitoring possible attack behaviors against the smart terminal and improving the ability to identify attack behaviors.

[0086] See also Figure 4 , is a module diagram of a safety monitoring system provided in one embodiment of the present application. The safety monitoring system includes:

[0087] A data acquisition module, configured to acquire data of a risk evidence item in a smart terminal, wherein the risk evidence item represents a target object whose data in the smart terminal will change when the smart terminal is attacked;

[0088] a comparison module, configured to compare the monitoring rules for each risk point in the smart terminal with the data of the risk evidence item to determine a trigger monitoring rule, wherein the monitoring rule includes a discrimination condition and an initial trust level for the attack behavior corresponding to each risk point, and the trigger monitoring rule is a monitoring rule whose discrimination condition matches the data of the risk evidence item; and

[0089] The attack behavior monitoring module is used to determine the attack behavior against the smart terminal according to the initial trust level of the attack behavior in the trigger monitoring rule.

[0090] See also Figure 5 , is a schematic diagram of an electronic device provided in one embodiment of the present application. The electronic device includes a processor and a memory, wherein the memory is used to store a computer program. When the computer program is executed by the processor, the above-mentioned security monitoring method is implemented.

[0091] The processor may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0092] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the methods described in the embodiments of the present invention. The processor executes the non-transitory software programs, instructions, and modules stored in the memory to perform various processor functions and data processing, thereby implementing the methods described in the aforementioned method embodiments.

[0093] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include a memory remotely located relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0094] One embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and when the computer program is executed by a processor, the above-mentioned security monitoring method is implemented.

[0095] Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention. Such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for security monitoring of intelligent terminals participating in flexible resource aggregation and control, characterized in that: The method comprises: Acquire data of a risk evidence item in a smart terminal, where the risk evidence item represents a target object whose data in the smart terminal will change when the smart terminal is attacked; Comparing the monitoring rules of each risk point in the smart terminal with the data of the risk evidence item to determine a trigger monitoring rule, wherein the monitoring rule includes a discrimination condition and an initial trust level of the attack behavior corresponding to the risk point, and the trigger monitoring rule is a monitoring rule whose discrimination condition matches the data of the risk evidence item, wherein the initial trust level of the attack behavior is determined based on the risk level of the risk point corresponding to the monitoring rule and the threat level of the attack behavior, and the risk level is obtained based on the following method: for any risk point, evaluating the risk point in turn according to the evaluation factors to obtain the weight of the risk point at each of the evaluation factors, and calculating the risk level of the risk point based on the weight of the risk point at each of the evaluation factors, wherein the evaluation factors include at least one of potential destructiveness, reproducibility, exploitability, affected users, and discoverability; The attack behavior targeting the smart terminal is determined according to the initial trust level of the attack behavior in the trigger monitoring rule.

2. The method according to claim 1, wherein The determining of the attack behavior against the smart terminal according to the initial trust level of the attack behavior in the trigger monitoring rule includes: For any attack behavior, if the initial trust levels of the attack behavior in multiple trigger monitoring rules are different, the initial trust levels of the attack behavior in the multiple trigger monitoring rules are integrated to obtain the integrated trust level of the attack behavior; If the fusion credibility of the attack behavior is greater than a threshold, it is determined that the attack behavior is included in the attack behavior directed at the smart terminal.

3. The method according to claim 1, wherein When a risk point corresponds to multiple attack behaviors, in the risk point monitoring rules, the discrimination conditions are specified for each attack behavior corresponding to the risk point; Determining the trigger monitoring rule includes: If one of the discrimination conditions in a monitoring rule matches the data of the risk evidence item, the monitoring rule is determined to be a triggered monitoring rule.

4. The method according to claim 1, wherein The discrimination condition is used to characterize the data features of the risk evidence item; for any monitoring rule, the discrimination condition of the monitoring rule is determined to match the data of the risk evidence item when the following conditions are met: Determining a first data feature of the risk evidence item based on the acquired data of the risk evidence item, and determining a second data feature of the risk evidence item based on a discrimination condition of the monitoring rule; If the first data feature and the second data feature match, it is determined that the judgment condition of the monitoring rule matches the data of the risk evidence item.

5. The method according to claim 1, wherein The risk points in the smart terminal are determined based on the following method: Based on the overall architecture of the smart terminal, the attack surface of the smart terminal is decomposed, and the risk points in the smart terminal are determined according to the data flow attack path of each attack surface, wherein the attack surface represents a set of ways to attack the smart terminal through an input source.

6. The method according to claim 1, wherein The risk evidence items are determined based on the following method: Analyze the target objects whose data will change in the smart terminal when the attack behavior corresponding to each risk point occurs; Gather target objects corresponding to all risk points in the smart terminal to obtain the risk evidence items.

7. A safety monitoring system, characterized in that: The system comprises: A data acquisition module, configured to acquire data of a risk evidence item in a smart terminal, wherein the risk evidence item represents a target object whose data in the smart terminal will change when the smart terminal is attacked; a comparison module for comparing the monitoring rules of each risk point in the smart terminal with the data of the risk evidence item to determine a trigger monitoring rule, wherein the monitoring rule includes a discrimination condition and an initial trust level of the attack behavior corresponding to each risk point, and the trigger monitoring rule is a monitoring rule whose discrimination condition matches the data of the risk evidence item, wherein the initial trust level of the attack behavior is determined based on the risk level of the risk point corresponding to the monitoring rule and the threat level of the attack behavior, and the risk level is obtained based on the following method: for any risk point, the risk point is evaluated in turn according to the evaluation factors to obtain the weight of the risk point at each of the evaluation factors, and the risk level of the risk point is calculated based on the weight of the risk point at each of the evaluation factors, and the evaluation factors include at least one of potential destructiveness, reproducibility, exploitability, affected users, and discoverability; The attack behavior monitoring module is used to determine the attack behavior against the smart terminal according to the initial trust level of the attack behavior in the trigger monitoring rule.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium is used to store a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

9. An electronic device, characterized in that: The electronic device includes a processor and a memory, wherein the memory is used to store a computer program, and when the computer program is executed by the processor, the method according to any one of claims 1 to 6 is implemented.

Images