Security state evaluation model construction and evaluation method, device, medium and equipment

Abstract

The application discloses a kind of safety state evaluation model construction and evaluation method, device, medium and equipment, the construction method includes: based on state monitoring index system extraction multiple electric power mobile terminal in each shop mobile terminal in normal operating state monitoring index data and abnormal operating state monitoring index data;Respectively quantifying monitoring index data, obtain positive sample set and negative sample set;Based on positive sample set and negative sample set training AdaBoost algorithm corresponding classification framework obtains electric power mobile terminal safety state evaluation model.Through implementation of the application, while considering physical class, system class, data class, application class, network class and other general mobile terminal safety indexes, environmental class and historical reliability index are added, and on this basis, electric power mobile terminal safety state evaluation model is established by combining AdaBoost algorithm, and the online safety state evaluation of electric power mobile terminal is realized.

Description

Technical Field

[0001] The present invention relates to the field of power mobile terminal safety technology, and in particular to a safety status assessment model construction and assessment method, device, medium and equipment. Background Art

[0002] With the advancement of State Grid Corporation of China's energy internet and digital transformation initiatives, the rapid development of power mobile interconnection services has led to widespread access to various smart mobile terminals. Simultaneously, a variety of methods targeting mobile terminals have emerged, making mobile security protection for the power system increasingly complex. Therefore, strengthening mobile terminal security will help improve the security of the power system.

[0003] Existing mobile terminal security assessment solutions have problems such as incomplete consideration of indicators, lack of assessment capabilities for dynamic changes in mobile terminals, reliance on expert judgment during the assessment process, and inability to implement automated online security assessments, making them unable to be effectively applied in actual environments. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a security status assessment model construction and assessment method, device, medium and equipment to solve the technical problem in the prior art that indicators are not fully considered and automated online security assessment cannot be achieved.

[0005] The technical solutions proposed by the present invention are as follows:

[0006] A first aspect of an embodiment of the present invention provides a method for constructing a safety status assessment model for a power mobile terminal, comprising: extracting monitoring indicator data of a normal operating state and monitoring indicator data of an abnormal operating state for each of a plurality of power mobile terminals based on a status monitoring indicator system, wherein the monitoring indicator data include monitoring indicator data extracted from a physical system, a system system, a data system, an application system, a network system, an environmental system, and a historical reliability system; quantifying the monitoring indicator data of the normal operating state and the monitoring indicator data of the abnormal operating state respectively to obtain a positive sample set and a negative sample set; and training a classification framework corresponding to an AdaBoost algorithm based on the positive sample set and the negative sample set to obtain a safety status assessment model for a power mobile terminal.

[0007] Optionally, based on the physical class, the monitoring index data of the physical class of the power mobile terminal is extracted, wherein the monitoring index data of the physical class includes the monitoring index data of the power mobile terminal in key component security, startup authentication security, local interface security, dust and water resistance, and physical security protection capability; based on the system class, the monitoring index data of the system class of the power mobile terminal is extracted, wherein the monitoring index data of the system class includes the monitoring index data of the power mobile terminal in resource occupation security, running process security, system version security, system permission security, system file security, and system security protection capability; based on the data class, the monitoring index data of the data class of the power mobile terminal is extracted, wherein the monitoring index data of the data class includes the monitoring index data of the data security protection capability of the power mobile terminal; based on the application class, the monitoring index data of the application class of the power mobile terminal is extracted Monitoring indicator data of the power mobile terminal network class is extracted based on the network class, wherein the monitoring indicator data of the network class includes the monitoring indicator data of the power mobile terminal in communication status security, network flow security and network security protection capability; monitoring indicator data of the power mobile terminal environment class is extracted based on the environment class, wherein the monitoring indicator data of the environment class includes the monitoring indicator data of the power mobile terminal in temperature security and humidity security; monitoring indicator data of the historical reliability of the power mobile terminal is extracted based on the historical reliability, wherein the monitoring indicator data of the historical reliability includes the monitoring indicator data of the power mobile terminal in historical security score.

[0008] Optionally, the monitoring indicator data for the security of key components include the SIM card, secure TF card, and digital certificate of the power mobile terminal; the monitoring indicator data for the security of startup authentication include the power-on authentication and biometric identification of the power mobile terminal; the monitoring indicator data for the security of the local interface include the local interface status of the power mobile terminal; the monitoring indicator data for the dust and water resistance include the protection level of the power mobile terminal; the monitoring indicator data for the physical security protection capability include the remote anti-theft and security lock mode of the power mobile terminal;

[0009] The monitoring indicator data of resource occupation security includes the CPU occupation rate, memory occupation rate and disk occupation rate of the electric mobile terminal; the monitoring indicator data of running process security includes the process list of the electric mobile terminal; the monitoring indicator data of system version security includes the current version number of the electric mobile terminal; the monitoring indicator data of system permission security includes the root status of the electric mobile terminal; the monitoring indicator data of system file security includes the files and file permissions of the electric mobile terminal; the monitoring indicator data of system security protection capability includes the system automatic update status of the electric mobile terminal, the installation status of security control software and virus detection software;

[0010] The monitoring indicator data of the data security protection capability includes data storage encryption, important data backup and virtual identity protection of the power mobile terminal;

[0011] The monitoring indicator data of application source security includes the application security list and application signature information of the power mobile terminal; the monitoring indicator data of application permission security includes the sensitive permissions in the power mobile terminal application; the monitoring indicator data of application behavior security includes the illegal behavior of the power application terminal; the monitoring indicator data of application security protection capability includes the power business application of the power mobile terminal;

[0012] The monitoring indicator data of the communication status security includes the network port and network connection status of the power mobile terminal; the monitoring indicator data of the network traffic security includes the real-time sending rate, real-time receiving rate, TCP traffic percentage, UDP traffic percentage and business traffic percentage of the power mobile terminal; the monitoring indicator data of the network security protection capability includes the dedicated network channel, automatic joining network and pseudo base station protection of the power mobile terminal;

[0013] The monitoring index data of temperature safety includes the ambient temperature of the power mobile terminal; the monitoring index data of humidity safety includes the ambient humidity of the power mobile terminal;

[0014] The monitoring indicator data of the historical safety score includes the recent safety status assessment results of the electric mobile terminal.

[0015] Optionally, the monitoring indicator data of normal operating status and the monitoring indicator data of abnormal operating status are quantified separately, including: comparing the quantitative indicator data obtained from each aspect of the physical, system, data, application, network, and environmental historical reliability classes with pre-stored normal monitoring indicator data or with safety standards to obtain quantitative results for each aspect.

[0016] Optionally, a classification framework corresponding to the AdaBoost algorithm is trained based on the positive sample set and the negative sample set to obtain a power mobile terminal safety status assessment model, including: initializing the weight of each sample in the positive sample set and the negative sample set; training a weak classifier based on a preset number of iterations; and combining the trained weak classifiers into a strong classifier to obtain a power mobile terminal safety status assessment model.

[0017] The second aspect of an embodiment of the present invention provides a method for assessing the safety status of a power mobile terminal, comprising: obtaining current monitoring index data of the power mobile terminal; quantifying the acquired monitoring index data and inputting it into a power mobile terminal safety status assessment model constructed based on the first aspect of the embodiment of the present invention and the power mobile terminal safety status assessment model construction method described in any one of the first aspects, to obtain a current safety status assessment result of the power mobile terminal.

[0018] A third aspect of an embodiment of the present invention provides a device for constructing a safety status assessment model for a power mobile terminal, comprising: a sample data acquisition module for extracting monitoring index data of a normal operating state and monitoring index data of an abnormal operating state for each of a plurality of power mobile terminals based on a status monitoring index system, wherein the monitoring index data include monitoring index data extracted from a physical system, a system system, a data system, an application system, a network system, an environmental system and a historical reliability system; a sample set construction module for quantifying the monitoring index data of a normal operating state and the monitoring index data of an abnormal operating state respectively to obtain a positive sample set and a negative sample set; a model construction module for training a classification framework corresponding to an AdaBoost algorithm based on the positive sample set and the negative sample set to obtain a safety status assessment model for a power mobile terminal.

[0019] The fourth aspect of an embodiment of the present invention provides a power mobile terminal safety status assessment device, including: a real-time data acquisition module for acquiring the current monitoring index data of the power mobile terminal; an assessment module for quantifying the acquired monitoring index data and inputting it into a power mobile terminal safety status assessment model constructed based on the first aspect of the embodiment of the present invention and the power mobile terminal safety status assessment model construction method described in any one of the first aspects, to obtain the current safety status assessment result of the power mobile terminal.

[0020] The fifth aspect of the embodiments of the present invention provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the method for constructing a power mobile terminal safety status assessment model as described in the first aspect of the embodiments of the present invention and any one of the first aspects, and the method for assessing the safety status of the power mobile terminal as described in the second aspect.

[0021] A sixth aspect of an embodiment of the present invention provides an electronic device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to execute the method for constructing a power mobile terminal safety status assessment model as described in the first aspect of the embodiment of the present invention and any one of the first aspects, and the method for assessing the safety status of a power mobile terminal as described in the second aspect.

[0022] The technical solution provided by the present invention has the following effects:

[0023] The method, device and storage medium for constructing a power mobile terminal safety status assessment model provided by the embodiments of the present invention, while considering general mobile terminal safety indicators such as physical, system, data, application, and network, add environmental and historical reliability indicators in order to be able to conduct a more comprehensive safety assessment of the power mobile terminal in combination with the surrounding environment and the historical safety status of the terminal. Monitoring indicator data are extracted from the physical system, system system, data system, application system, network system, environmental system and historical reliability system, and on this basis, the power mobile terminal safety status assessment model is established in combination with the AdaBoost algorithm, thereby realizing online safety status assessment of the power mobile terminal.

[0024] The power mobile terminal safety status assessment method and device provided in embodiments of the present invention enable online safety status assessment of power mobile terminals by quantifying acquired monitoring indicator data and inputting it into a pre-built power mobile terminal safety status assessment model. This method can effectively and comprehensively assess the real-time status of power mobile terminals, promptly identifying potential safety risks, addressing security deficiencies at the mobile terminal level, and improving the overall safety protection capabilities of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0026] Figure 1 is a flowchart of a method for constructing a safety status assessment model for a power mobile terminal according to an embodiment of the present invention;

[0027] Figure 2 and Figure 3 2. It is a structural block diagram of a state monitoring indicator system in a power mobile terminal safety state assessment model method according to an embodiment of the present invention;

[0028] Figure 4 is a schematic diagram of the accuracy of the training set and the test set at different numbers of iterations according to an embodiment of the present invention;

[0029] Figure 5 is a schematic diagram of evaluating the accuracy of a model under different training set and test set division ratios according to an embodiment of the present invention;

[0030] Figure 6 is a flowchart of a method for assessing the safety status of a power mobile terminal according to an embodiment of the present invention;

[0031] Figure 7 2 is a structural block diagram of a device for constructing a safety status assessment model for a power mobile terminal according to an embodiment of the present invention;

[0032] Figure 8 is a structural block diagram of a device for evaluating the safety status of a power mobile terminal according to an embodiment of the present invention;

[0033] Figure 9 is a schematic diagram of the structure of a computer-readable storage medium provided according to an embodiment of the present invention;

[0034] Figure 10 is a schematic structural diagram of an electronic device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0036] The terms "first," "second," "third," "fourth," and the like in the specification and claims of the present invention and in the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0037] According to an embodiment of the present invention, a method for constructing a safety status assessment model for a power mobile terminal is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0038] In this embodiment, a method for constructing a safety status assessment model for a power mobile terminal is provided, which can be used for electronic devices such as computers, mobile phones, tablet computers, etc. Figure 1 FIG. 1 is a flow chart of a method for constructing a safety status assessment model for a power mobile terminal according to an embodiment of the present invention. Figure 1 As shown, the method includes the following steps:

[0039] Step S101: Extract monitoring indicator data for each of the multiple power mobile terminals in normal operating state and abnormal operating state based on a state monitoring indicator system. The state monitoring indicator system includes physical, system, data, application, network, environment, and historical reliability categories. The monitoring indicator data can be acquired from a mobile terminal database using currently available data collection tools. For example, a total of 500 sets of monitoring indicator data can be extracted for each of ten power mobile terminal devices in normal operating state and abnormal operating state, including 300 sets of monitoring indicator data for normal operating state and 200 sets of monitoring indicator data for abnormal operating state. Abnormal operating state may include power mobile terminal operating states in situations such as terminal virus infection, terminal flooding attack, terminal SIM card replacement, terminal installation of repackaged applications, and malicious applications.

[0040] Specifically, for the status monitoring indicator system adopted in this embodiment: among them, physical indicators mainly reflect the hardware status and hardware protection capabilities of the power mobile terminal; system indicators mainly reflect the system operation status and system protection capabilities of the power mobile terminal; data indicators mainly reflect the power mobile terminal's ability to ensure data integrity, availability and confidentiality, that is, data security protection capabilities; application indicators mainly reflect the security and security protection capabilities of the application software installed on the power mobile terminal; network indicators mainly reflect the security of the real-time network status of the power mobile terminal and network security protection capabilities; environmental indicators mainly reflect the security of the basic environment of the current location of the power mobile terminal; historical reliability indicators mainly consider the recent security status assessment results of the power mobile terminal.

[0041] Step S102: Quantify the monitoring indicator data of the normal operating state and the monitoring indicator data of the abnormal operating state respectively to obtain a positive sample set and a negative sample set. Specifically, since the state monitoring indicator system includes multiple categories of monitoring indicator data, and the monitoring indicator data of each category has different forms, in order to achieve the uniformity of the data constituting the sample set, the acquired monitoring indicator data is quantized to form a sample set. For example, the acquired monitoring indicator data can be analyzed and quantized into values ​​within the interval [0, 1]. Among them, the positive sample set is composed of the monitoring indicator data of the normal operating state, and the negative sample set is composed of the monitoring indicator data of the abnormal operating state.

[0042] Step S103: Based on the positive sample set and the negative sample set, the classification framework corresponding to the AdaBoost algorithm is trained to obtain the power mobile terminal safety status assessment model. Among them, the AdaBoost algorithm is an iterative boosting algorithm. Its core idea is to train different weak classifiers for the same training set, and then integrate these weak classifiers into a strong classifier, that is, to improve the classification effect of the classifier through iterative training. The adaptability of the AdaBoost algorithm is reflected in the fact that the weights of the samples can be automatically adjusted during the iteration process to generate a weak classifier with good results. Compared with traditional machine learning algorithms, the classifier implemented by the AdaBoost algorithm can achieve higher classification accuracy and has higher generalization ability, and is not prone to overfitting. In this embodiment, the AdaBoost Classifier framework provided by scikit-learn is used as the basic model training framework, and the model training is performed based on the positive sample set and the negative sample set composed of quantized data to obtain the power mobile terminal safety status assessment model.

[0043] The method for constructing a power mobile terminal safety status assessment model provided by an embodiment of the present invention, while considering general mobile terminal safety indicators such as physical, system, data, application, and network, adds environmental and historical reliability indicators in order to conduct a more comprehensive safety assessment of the power mobile terminal in combination with the surrounding environment and the terminal's historical safety status. Monitoring indicator data is extracted from the physical system, system system, data system, application system, network system, environmental system, and historical reliability system, and on this basis, the power mobile terminal safety status assessment model is established in combination with the AdaBoost algorithm, thereby realizing online safety status assessment of the power mobile terminal.

[0044] In one embodiment, if Figure 2 and Figure 3As shown, based on the state monitoring indicator system, the monitoring indicator data of the electric mobile terminal in the normal operating state and the monitoring indicator data of the abnormal operating state are extracted, including: based on the physical class, the monitoring indicator data of the physical class of the electric mobile terminal are extracted, wherein the monitoring indicator data of the physical class include the monitoring indicator data of the key component security, startup authentication security, local interface security, dust and water resistance and physical security protection capability of the electric mobile terminal; based on the system class, the monitoring indicator data of the system class of the electric mobile terminal are extracted, wherein the monitoring indicator data of the system class include the monitoring indicator data of the resource occupation security, running process security, system version security, system permission security, system file security and system security protection capability of the electric mobile terminal; based on the data class, the monitoring indicator data of the data class of the electric mobile terminal are extracted, wherein the monitoring indicator data of the data class include the monitoring indicator data of the data security protection capability of the electric mobile terminal Extract monitoring indicator data of power for mobile terminals; extract monitoring indicator data of application class for mobile terminals based on application class, wherein the monitoring indicator data of application class include monitoring indicator data of application source security, application permission security, application behavior security and application security protection capability of mobile terminals; extract monitoring indicator data of network class for mobile terminals based on network class, wherein the monitoring indicator data of network class include monitoring indicator data of communication status security, network flow security and network security protection capability of mobile terminals; extract monitoring indicator data of environment class for mobile terminals based on environment class, wherein the monitoring indicator data of environment class include monitoring indicator data of temperature safety and humidity safety of mobile terminals; extract monitoring indicator data of historical reliability for mobile terminals based on historical reliability, wherein the monitoring indicator data of historical reliability include monitoring indicator data of historical security score of mobile terminals.

[0045] It should be noted that when extracting the monitoring indicator data involved in each aspect based on physical class, system class, data class, application class, network class, environment class and historical reliability, it is necessary to extract the monitoring indicator data involved in each aspect corresponding to the normal operating state and the monitoring indicator data involved in each aspect corresponding to the abnormal operating state respectively.

[0046] In one embodiment, if Figure 2 and Figure 3 As shown, the monitoring indicator data of normal operating status and the monitoring indicator data of abnormal operating status are quantified respectively, including:

[0047] The monitoring indicator data for the security of key components include the SIM card, security TF card and digital certificate of the power mobile terminal, and the quantitative indicators of the security of key components are determined based on whether the SIM card, security TF card and digital certificate of the power mobile terminal have been changed; the monitoring indicator data for the security of startup authentication include the power-on authentication and biometric identification of the power mobile terminal, and the quantitative indicators of the security of startup authentication are determined based on whether the power mobile terminal has turned on the power-on authentication and biometric identification; the monitoring indicator data for the security of the local interface include the local interface status of the power mobile terminal, and the quantitative indicators of the local interface security are determined based on the local interface status of the power mobile terminal; the monitoring indicator data for the dustproof and waterproof capability include the protection level of the power mobile terminal, and the quantitative indicators of the dustproof and waterproof capability are determined based on the protection level of the power mobile terminal; the monitoring indicator data for the physical security protection capability include the remote anti-theft and security lock mode of the power mobile terminal, and the quantitative indicators of the physical security protection capability are determined based on the remote anti-theft and security lock mode of the power mobile terminal;

[0048] The monitoring indicator data of resource occupation security includes the CPU occupation rate, memory occupation rate and disk occupation rate of the electric mobile terminal, and the quantitative index of resource occupation security is determined according to whether the CPU occupation rate, memory occupation rate and disk occupation rate of the electric mobile terminal exceed the normal range; the monitoring indicator data of running process security includes the process list of the electric mobile terminal, and the quantitative index of running process security is determined according to whether there is an unknown process in the process list of the electric mobile terminal; the monitoring indicator data of system version security includes the current version number of the electric mobile terminal, and the quantitative index of system version security is determined according to whether the current version number of the electric mobile terminal is lower than the minimum version requirement; system authority The monitoring indicator data for limited security includes the root status of the electric mobile terminal, and the quantitative indicators of system permission security are determined based on whether the electric mobile terminal has been rooted; the monitoring indicator data for system file security includes the files and file permissions of the electric mobile terminal, and the quantitative indicators of system file security are determined based on whether the files of the electric mobile terminal have been modified and whether the file permissions have been changed; the monitoring indicator data for system security protection capability includes the system automatic update status, security control software and virus detection software installation status of the electric mobile terminal, and the quantitative indicators of system security protection capability are determined based on whether the electric mobile terminal has set the system automatic update and whether the security control software and virus detection software are installed;

[0049] The monitoring indicator data of the data security protection capability includes data storage encryption, important data backup and virtual identity protection of the power mobile terminal. The quantitative indicators of the data security protection capability are determined based on whether the power mobile terminal has data storage encryption technology, whether important data is backed up and whether virtual identity protection is enabled;

[0050] The monitoring indicator data for application source security includes the application security list and application signature information of the power mobile terminal, and the quantitative indicator of application source security is determined based on whether there are unknown applications in the application installation list of the power mobile terminal and whether the application signature information has changed; the monitoring indicator data for application permission security includes sensitive permissions in the power mobile terminal application, and the quantitative indicator of application permission security is determined based on whether the power mobile terminal application has applied for non-essential sensitive permissions; the monitoring indicator data for application behavior security includes violations of the power application terminal, and the quantitative indicator of application behavior security is determined based on whether the power mobile terminal has violations including application chain startup; the monitoring indicator data for application security protection capability includes power business applications of the power mobile terminal, and the quantitative indicator of application security protection capability is determined based on whether the power business application of the power mobile terminal has an application lock enabled;

[0051] The monitoring indicator data of the communication status security include the network port and network connection status of the power mobile terminal, and the quantitative indicator of the communication status security is determined according to whether the power mobile terminal opens a new network port and whether a network connection is established with an unknown IP address; the monitoring indicator data of the network traffic security include the real-time sending rate, real-time receiving rate, TCP traffic percentage, UDP traffic percentage and business traffic percentage of the power mobile terminal, and the quantitative indicator of the network traffic security is determined according to whether the real-time sending rate, real-time receiving rate, TCP traffic percentage, UDP traffic percentage and business traffic percentage of the power mobile terminal exceed the normal range; the monitoring indicator data of the network security protection capability include the dedicated network channel, automatic network joining and pseudo base station protection of the power mobile terminal, and the quantitative indicator of the network security protection capability is determined according to whether the power mobile terminal is bound to a dedicated network channel, automatic network joining is disabled and pseudo base station protection is enabled;

[0052] The monitoring index data for temperature safety includes the ambient temperature of the power mobile terminal, and the quantitative index of temperature safety is determined based on whether the ambient temperature of the power mobile terminal exceeds a specified range; the monitoring index data for humidity safety includes the ambient humidity of the power mobile terminal, and the quantitative index of humidity safety is determined based on whether the ambient humidity of the power mobile terminal exceeds a specified range;

[0053] The monitoring index data of the historical safety score includes the recent safety status assessment results of the electric mobile terminal, and the quantitative indicators of the historical safety score are determined based on the recent safety status assessment results of the electric mobile terminal.

[0054] In one embodiment, the monitoring indicator data of the normal operating state and the monitoring indicator data of the abnormal operating state are quantified respectively, and the method also includes: comparing the quantitative indicator data obtained from each aspect of the physical, system, data, application, network, and environmental historical reliability categories with the pre-stored normal monitoring indicator data or with the safety standards to obtain the quantitative results of each aspect.

[0055] Specifically, the pre-stored normal monitoring indicator data specifically include specific monitoring indicator data of the power mobile terminal under normal operating conditions (such as the normal range of CPU occupancy, application signature information, etc.), and pre-set whitelists (such as application whitelists, IP address whitelists, etc.). When compared with the pre-stored normal monitoring indicator data or with the safety standards, it can be specifically checked whether the quantitative indicator data is the same as the normal monitoring indicator data or the safety standards. When they are the same, it is assigned a value of 1, and when they are not the same, it is assigned a value of 0. Among them, the quantitative indicator data is specifically the monitoring indicator data specifically obtained in each aspect. For example, the quantitative indicator data for the security of key components is whether the SIM card, security TF card and digital certificate of the device have changed.

[0056] Based on the above quantitative methods, we will explain in detail how to determine the quantitative results for each aspect:

[0057] The obtained SIM card, security TF card and digital certificate of the device are compared with the normal monitoring indicator data. If they are the same, the quantitative result of the key component security is 1, if they are not the same, the quantitative result is 0; for startup authentication security, if the power-on authentication and biometric recognition are turned on, the value is assigned to 1, if not turned on, the value is assigned to 0. Therefore, the startup authentication security uses the average of the two values ​​as the quantitative result. For example, if the current terminal is set to power-on authentication but not to biometric recognition, the quantitative result is (1+0) / 2=0.5; for local interface security, if the local interface status is in debugging mode, the quantitative result is 1, otherwise it is 0; for dust and water resistance, it can be judged whether the protection level meets the preset safety standard. If it meets the quantitative result, the quantitative result is 1, and if it does not meet the quantitative result, the quantitative result is 0; for physical security protection capability, it is the same as startup authentication security. The quantitative result is obtained by calculating the average value based on the assigned results of whether remote anti-theft and security lock mode are turned on.

[0058] For resource usage security, if the CPU usage, memory usage, and disk usage exceed the normal range, the quantification result is 0, and if they do not exceed the normal range, the quantification result is 1; for running process security, if there is an unknown process in the system's process list, the quantification result is 0, otherwise the quantification result is 1; for system version security, if the current system version number is lower than the minimum version requirement, the quantification result is 0, otherwise the quantification result is 1; for system permission security, if it is rooted, the quantification result is 0, otherwise the quantification result is 1; the quantification method for system file security, system security protection capability, data security protection capability, application source security, communication status security, and network security protection capability is the same as the quantification method for physical security protection capability, and will not be repeated here. The quantification method for application permission security, application behavior security, and application security protection capability is the same as the quantification method for running process security, and will not be repeated here. The quantification method for network traffic security, temperature security, and humidity security is the same as the quantification method for resource usage security, and will not be repeated here.

[0059] The quantification of the historical safety score is expressed using the following formula:

[0060]

[0061] Among them, C 22 Refers to the quantitative results of historical safety scores, Result i (i=1,2,...,n) represents the i-th evaluation result in the most recent n (the size of n can be set according to the actual situation) safety status evaluation records of the electric mobile terminal and Result i ∈[0,1],Result i The closer it is to 1, the safer the power mobile Internet terminal is at that time.

[0062] Using the aforementioned quantification method, the quantitative indicator data for each aspect is quantified, resulting in 22 quantitative results within the interval [0, 1]. 0 represents an unsafe state, meaning a safety incident has occurred or safety standards have not been met, and 1 represents a safe state, meaning no safety risks or incidents have been identified. The closer the quantitative indicator result approaches 1, the safer it is. The 22 quantitative results are combined to form a 22-dimensional indicator vector. Thus, the positive and negative sample sets each contain multiple 22-dimensional indicator vectors.

[0063] The classification framework corresponding to the AdaBoost algorithm is trained based on positive sample sets and negative sample sets to obtain a power mobile terminal safety status assessment model, including: initializing the weights of the positive sample sets and the negative sample sets; training weak classifiers based on a preset number of iterations; and combining the trained weak classifiers into a strong classifier to obtain a power mobile terminal safety status assessment model.

[0064] Specifically, during training, a basic model training framework is built based on the Python sklearn library. First, the sample weights are initialized, and then the weak learners are trained for the evaluation index dataset within a specified number of iterations. The sample weights are updated and normalized in each round of iteration. After reaching the specified number of iterations, all weak classifiers are integrated to obtain a strong classifier, that is, the target power mobile terminal safety status assessment model is obtained. In this embodiment, the base classifier is set to a CART decision tree with a depth of 2, the classification algorithm is set to "SAMME", the maximum number of iterations of the weak classifier is set to 200, and the weight reduction coefficient of each weak learner is set to 0.5.

[0065] In order to obtain the optimal training parameters, we first set different numbers of iterations under a fixed ratio of training set to test set and trained the model. The results showed that when the number of iterations was 200, the classification accuracy of the model for both the training set and the test set could reach more than 95% and the difference between the two was less than 1% (for details, see Figure 4 Then, different training set and test set division ratios were set with 200 iterations and the model was trained. The results showed that the model had the highest accuracy of 96.25% when the division ratio was 4:1 (as shown in the figure). Figure 5 shown).

[0066] The embodiment of the present invention also provides a method for evaluating the safety status of a power mobile terminal. Figure 6 As shown, the following steps are included:

[0067] Step S201: Obtain the current monitoring index data of the power mobile terminal; wherein, the monitoring index data and the index data obtained in the above-mentioned model building method, namely, monitoring index data of each aspect including physical, system, data, application, network, environment and historical reliability.

[0068] Step S202: Quantify the acquired monitoring indicator data and input it into the power mobile terminal safety status assessment model constructed based on the power mobile terminal safety status assessment model construction method described in the above embodiment, to obtain the current safety status assessment result of the power mobile terminal. For the specific quantization method, refer to the quantization method used in the above model construction method. After quantizing the acquired monitoring indicator data, a 22-dimensional indicator vector can be obtained. This vector is input into the constructed model to obtain the current safety status assessment result.

[0069] The power mobile terminal security status assessment method provided by the embodiments of the present invention quantifies acquired monitoring indicator data and inputs it into a pre-built power mobile terminal security status assessment model, enabling online security status assessment of power mobile terminals. This method can effectively and comprehensively assess the real-time status of power mobile terminals, promptly identifying potential security risks, addressing security deficiencies at the mobile terminal level, and improving the overall security protection capabilities of the system.

[0070] The embodiment of the present invention also provides a device for constructing a safety status assessment model for a power mobile terminal. Figure 7 Shown, including:

[0071] A sample data acquisition module is used to extract monitoring indicator data of each electric mobile terminal in a normal operating state and monitoring indicator data of an abnormal operating state in a plurality of electric mobile terminals based on a state monitoring indicator system. The monitoring indicator data includes monitoring indicator data extracted from a physical system, a system system, a data system, an application system, a network system, an environmental system and a historical reliability system. For specific content, please refer to the corresponding part of the above method embodiment and will not be repeated here.

[0072] The sample set construction module is used to quantify the monitoring index data of normal operating status and the monitoring index data of abnormal operating status respectively to obtain positive sample sets and negative sample sets; the specific content can be found in the corresponding part of the above method embodiment, which will not be repeated here.

[0073] The model building module is used to train the classification framework corresponding to the AdaBoost algorithm based on the positive sample set and the negative sample set to obtain the power mobile terminal safety status assessment model. For details, please refer to the corresponding part of the above method embodiment and will not be repeated here.

[0074] The power mobile terminal safety status assessment model construction device provided by the embodiment of the present invention, while considering general mobile terminal safety indicators such as physical, system, data, application, and network, adds environmental and historical reliability indicators in order to be able to conduct a more comprehensive safety assessment of the power mobile terminal in combination with the surrounding environment and the terminal's historical safety status. Monitoring indicator data is extracted from the physical system, system system, data system, application system, network system, environmental system, and historical reliability system, and on this basis, combined with the AdaBoost algorithm, a power mobile terminal safety status assessment model is established, thereby realizing online safety status assessment of the power mobile terminal.

[0075] For a detailed description of the functions of the apparatus for constructing a safety status assessment model for a power mobile terminal provided in an embodiment of the present invention, please refer to the description of the method for constructing a safety status assessment model for a power mobile terminal in the above embodiment.

[0076] The embodiment of the present invention also provides a device for evaluating the safety status of a power mobile terminal, such as Figure 8 As shown, the device includes:

[0077] The real-time data acquisition module is used to obtain the current monitoring index data of the power mobile terminal; the specific content can be found in the corresponding part of the above method embodiment, which will not be repeated here.

[0078] The evaluation module is configured to quantify the acquired monitoring indicator data and input it into a power mobile terminal safety status assessment model constructed based on the power mobile terminal safety status assessment model construction method described in the above embodiment, thereby obtaining an assessment result of the current safety status of the power mobile terminal. For details, please refer to the corresponding section of the above method embodiment and will not be repeated here.

[0079] The power mobile terminal safety status assessment device provided by the embodiments of the present invention quantifies acquired monitoring indicator data and inputs it into a pre-built power mobile terminal safety status assessment model, enabling online safety status assessment of power mobile terminals. This device can effectively and comprehensively assess the real-time status of power mobile terminals, promptly identifying potential safety risks, addressing security deficiencies at the mobile terminal level, and improving the overall safety protection capabilities of the system.

[0080] For a detailed description of the functions of the power mobile terminal safety status assessment device provided in the embodiment of the present invention, please refer to the description of the power mobile terminal safety status assessment method in the above embodiment.

[0081] The embodiment of the present invention also provides a storage medium, such as Figure 9 As shown, a computer program 601 is stored thereon, and when the instructions are executed by the processor, the steps of the method for constructing a power mobile terminal safety status assessment model and the power mobile terminal safety status assessment method in the above-mentioned embodiment are implemented. The storage medium also stores audio and video stream data, feature frame data, interaction request signaling, encrypted data, and preset data size, etc. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk drive (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0082] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD). The storage medium can also include a combination of the above-mentioned types of memory.

[0083] The embodiment of the present invention further provides an electronic device, such as Figure 10 As shown, the electronic device may include a processor 51 and a memory 52, wherein the processor 51 and the memory 52 may be connected via a bus or other means. Figure 10 The bus connection is taken as an example.

[0084] The processor 51 may be a central processing unit (CPU). The processor 51 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0085] Memory 52, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs, and modules, such as the corresponding program instructions / modules in the embodiments of the present invention. Processor 51 executes the non-transitory software programs, instructions, and modules stored in memory 52 to perform various processor functions and data processing, thereby implementing the power mobile terminal safety status assessment model construction method and power mobile terminal safety status assessment method in the above-mentioned method embodiment.

[0086] The memory 52 may include a program storage area and a data storage area, wherein the program storage area may store applications required for operating the device and at least one function; the data storage area may store data created by the processor 51, etc. In addition, the memory 52 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 52 may optionally include a memory remotely located relative to the processor 51, and these remote memories may be connected to the processor 51 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0087] The one or more modules are stored in the memory 52 and when executed by the processor 51, perform the following steps: Figure 1 -6 shows a method for constructing a power mobile terminal safety status assessment model and a method for assessing the safety status of a power mobile terminal.

[0088] For details of the above electronic equipment, please refer to Figures 1 to 6 The corresponding descriptions and effects in the embodiments shown are understood, and the method for evaluating the safety status of a power mobile terminal will not be repeated here.

[0089] Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention. Such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for constructing a safety status assessment model for a power mobile terminal, characterized in that: include: Extracting monitoring indicator data of each of the plurality of electric mobile terminals in a normal operating state and monitoring indicator data of an abnormal operating state based on a state monitoring indicator system, wherein the monitoring indicator data includes monitoring indicator data extracted from a physical system, a system system, a data system, an application system, a network system, an environmental system, and a historical reliability system; The monitoring indicator data of normal operation status and abnormal operation status are quantified respectively to obtain positive sample sets and negative sample sets; The classification framework corresponding to the AdaBoost algorithm is trained based on the positive sample set and the negative sample set to obtain the power mobile terminal safety status assessment model; Among them, based on the state monitoring indicator system, the monitoring indicator data of the power mobile terminal in normal operation state and the monitoring indicator data of abnormal operation state are extracted, including: Extract monitoring indicator data of the physical category of the power mobile terminal based on the physical category, where the monitoring indicator data of the physical category includes monitoring indicator data of the power mobile terminal in key component security, startup authentication security, local interface security, dust and water resistance, and physical security protection capability; Extract monitoring indicator data of the power mobile terminal system class based on the system class, where the monitoring indicator data of the system class includes monitoring indicator data of the power mobile terminal in terms of resource occupation security, operation process security, system version security, system permission security, system file security, and system security protection capability; Extracting monitoring indicator data of the power mobile terminal data class based on the data class, wherein the monitoring indicator data of the data class includes monitoring indicator data of the power mobile terminal in terms of data security protection capability; Extract monitoring indicator data of the power mobile terminal application class based on the application class, wherein the monitoring indicator data of the application class includes monitoring indicator data of the power mobile terminal in application source security, application permission security, application behavior security and application security protection capability; Extract monitoring indicator data of the power mobile terminal network class based on the network class, where the monitoring indicator data of the network class includes monitoring indicator data of the power mobile terminal in communication status security, network traffic security and network security protection capability; Extracting monitoring indicator data of the power mobile terminal environment based on the environment category, wherein the monitoring indicator data of the environment category includes monitoring indicator data of the power mobile terminal in temperature safety and humidity safety; The monitoring index data of the historical reliability of the electric mobile terminal is extracted based on the historical reliability, wherein the monitoring index data of the historical reliability includes the monitoring index data of the historical safety score of the electric mobile terminal.

2. The method for constructing a safety status assessment model for a power mobile terminal according to claim 1, characterized in that: The monitoring indicator data for the security of key components include the SIM card, secure TF card, and digital certificate of the power mobile terminal; the monitoring indicator data for the security of startup authentication include the power-on authentication and biometric identification of the power mobile terminal; the monitoring indicator data for the security of local interfaces include the status of the local interfaces of the power mobile terminal; the monitoring indicator data for the dust and water resistance include the protection level of the power mobile terminal; the monitoring indicator data for the physical security protection capability include the remote anti-theft and security lock mode of the power mobile terminal; The monitoring indicator data of resource occupation security includes the CPU occupation rate, memory occupation rate and disk occupation rate of the electric mobile terminal; the monitoring indicator data of running process security includes the process list of the electric mobile terminal; the monitoring indicator data of system version security includes the current version number of the electric mobile terminal; the monitoring indicator data of system permission security includes the root status of the electric mobile terminal; the monitoring indicator data of system file security includes the files and file permissions of the electric mobile terminal; the monitoring indicator data of system security protection capability includes the system automatic update status of the electric mobile terminal, the installation status of security control software and virus detection software; The monitoring indicator data of the data security protection capability includes data storage encryption, important data backup and virtual identity protection of the power mobile terminal; The monitoring indicator data of the application source security includes the application security list and application signature information of the power mobile terminal; The monitoring indicator data of application permission security includes sensitive permissions in power mobile terminal applications; the monitoring indicator data of application behavior security includes illegal behaviors of power mobile terminals; the monitoring indicator data of application security protection capabilities includes power business applications of power mobile terminals; The monitoring indicator data of the communication status security includes the network port and network connection status of the power mobile terminal; The monitoring indicator data of network traffic security includes the real-time sending rate, real-time receiving rate, TCP traffic percentage, UDP traffic percentage and business traffic percentage of the power mobile terminal; the monitoring indicator data of network security protection capability includes the dedicated network channel, automatic joining network and pseudo base station protection of the power mobile terminal; The monitoring index data of temperature safety includes the ambient temperature of the power mobile terminal; the monitoring index data of humidity safety includes the ambient humidity of the power mobile terminal; The monitoring indicator data of the historical safety score includes the recent safety status assessment results of the electric mobile terminal.

3. The method for constructing a safety status assessment model for a power mobile terminal according to claim 1, characterized in that: The monitoring indicator data of normal operation status and abnormal operation status are quantified separately, including: The quantitative indicator data obtained for each aspect of the physical, system, data, application, network, and environmental historical reliability categories are compared with the pre-stored normal monitoring indicator data or with the safety standards to obtain the quantitative results for each aspect.

4. The method for constructing a safety status assessment model for a power mobile terminal according to claim 1, characterized in that: The classification framework corresponding to the AdaBoost algorithm is trained based on the positive sample set and the negative sample set to obtain the power mobile terminal safety status assessment model, including: Initialize the weight of each sample in the positive sample set and the negative sample set; Train the weak classifier based on a preset number of iterations; The trained weak classifiers are combined into a strong classifier to obtain the power mobile terminal safety status assessment model.

5. A method for assessing the safety status of a power mobile terminal, characterized in that: include: Obtain current monitoring indicator data of the power mobile terminal; The acquired monitoring indicator data is quantified and input into the power mobile terminal safety status assessment model constructed based on the power mobile terminal safety status assessment model construction method according to any one of claims 1 to 4 to obtain the current safety status assessment result of the power mobile terminal.

6. A device for constructing a safety status assessment model for a power mobile terminal, characterized in that: include: a sample data acquisition module for extracting monitoring indicator data of each of the plurality of electric mobile terminals in a normal operating state and monitoring indicator data of an abnormal operating state based on a state monitoring indicator system, wherein the monitoring indicator data includes monitoring indicator data extracted from a physical system, a system system, a data system, an application system, a network system, an environmental system, and a historical reliability system; The sample set construction module is used to quantify the monitoring indicator data of normal operation status and the monitoring indicator data of abnormal operation status respectively to obtain positive sample sets and negative sample sets; A model building module is used to train the classification framework corresponding to the AdaBoost algorithm based on the positive sample set and the negative sample set to obtain a power mobile terminal safety status assessment model; Among them, based on the state monitoring indicator system, the monitoring indicator data of the power mobile terminal in normal operation state and the monitoring indicator data of abnormal operation state are extracted, including: Extract monitoring indicator data of the physical category of the power mobile terminal based on the physical category, where the monitoring indicator data of the physical category includes monitoring indicator data of the power mobile terminal in key component security, startup authentication security, local interface security, dust and water resistance, and physical security protection capability; Extract monitoring indicator data of the power mobile terminal system class based on the system class, where the monitoring indicator data of the system class includes monitoring indicator data of the power mobile terminal in terms of resource occupation security, operation process security, system version security, system permission security, system file security, and system security protection capability; Extracting monitoring indicator data of the power mobile terminal data class based on the data class, wherein the monitoring indicator data of the data class includes monitoring indicator data of the power mobile terminal in terms of data security protection capability; Extract monitoring indicator data of the power mobile terminal application class based on the application class, wherein the monitoring indicator data of the application class includes monitoring indicator data of the power mobile terminal in application source security, application permission security, application behavior security and application security protection capability; Extract monitoring indicator data of the power mobile terminal network class based on the network class, where the monitoring indicator data of the network class includes monitoring indicator data of the power mobile terminal in communication status security, network traffic security and network security protection capability; Extracting monitoring indicator data of the power mobile terminal environment based on the environment category, wherein the monitoring indicator data of the environment category includes monitoring indicator data of the power mobile terminal in temperature safety and humidity safety; The monitoring index data of the historical reliability of the electric mobile terminal is extracted based on the historical reliability, wherein the monitoring index data of the historical reliability includes the monitoring index data of the historical safety score of the electric mobile terminal.

7. A device for evaluating the safety status of a power mobile terminal, characterized in that: include: Real-time data acquisition module, used to obtain the current monitoring index data of the power mobile terminal; An evaluation module is used to quantify the acquired monitoring indicator data and input it into the power mobile terminal safety status evaluation model constructed based on the power mobile terminal safety status evaluation model construction method described in any one of claims 1-4 to obtain the current safety status evaluation result of the power mobile terminal.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the power mobile terminal safety status assessment model construction method according to any one of claims 1 to 4 or the power mobile terminal safety status assessment method according to claim 5.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for constructing a power mobile terminal safety status assessment model according to any one of claims 1 to 4 or the method for assessing the safety status of a power mobile terminal according to claim 5 by executing the computer instructions.

Images