Information security portrait-based early warning information pushing method and system

Abstract

This application discloses a method and system for pushing early warning information based on information security profiles, relating to the field of data security technology. It includes a database for collecting comparison and contrast information; the comparison information is user information, from which feature data is extracted; the contrast information is collected risk information; the feature data is compared with the risk information, and when a match is found between the feature data and the risk information, it is recorded as an anomaly; all feature data are compared to form a security profile of the target user, and early warning information is pushed based on the anomalies in the feature data. The feature data is partitioned and arranged, and anomalies are displayed. Based on the distribution of the feature data with anomalies, the target user's security vulnerability areas are identified, and early warning reminders are given based on fraud cases that have occurred in the same area. The early warning reminders are generated based on the target user's actions, thus having high credibility and effectively improving the target user's ability to prevent fraud scenarios.

Description

Technical Field

[0001] This application relates to the field of data security, specifically to a method and system for pushing early warning information based on information security profiles. Background Technology

[0002] With the widespread adoption of the internet and the rapid development of network technology, my country boasts the world's largest number of internet users. These users can enjoy the convenience of information exchange without leaving home, including online shopping and online investment involving asset transfers. However, the internet has also become a breeding ground for criminals and organizations to carry out telecommunications and internet fraud. Internet and telephone fraud methods are covert and diverse, posing a significant threat to public interests.

[0003] Currently, with increasing attention paid to telecommunications and internet fraud, many communities have intensified their efforts to combat such fraud, achieving some results. However, new fraud tactics are constantly emerging, making them difficult to guard against. Patent application CN113489749B discloses a method, device, equipment, and storage medium for generating a network asset security profile. This profile generates images of network assets in the internet through three dimensions: cyberspace, social space, and geographic space. It provides an understanding of assets from a third-party or hacker perspective, comprehensively and accurately reflecting asset security, thereby improving the security profile's ability to reflect security risks and achieving the goal of asset protection. However, this method of creating security profiles for network assets is more suitable for the asset protection of organizations and enterprises. In telecommunications and internet fraud cases, the fraud typically targets specific users, inducing them to voluntarily transfer assets to criminals. Therefore, existing technologies struggle to create security profiles of target users based on their information, behavior, and environment, making it difficult to analyze the situational characteristics that make target users susceptible to fraud. Consequently, it is difficult to promptly push early warning information when target users face security risks, effectively helping them identify fraudulent methods. Summary of the Invention

[0004] This application addresses the difficulty in creating security profiles of target users based on their information and behavior in existing technologies. It provides a method and system for pushing early warning information based on information security profiles. This method generates security profiles using target user information and behavior, and then pushes early warning information when the target user engages in potentially security-risk operations, thereby reducing losses to the public caused by telecommunications fraud. The specific technical solution is as follows:

[0005] In a first aspect of this application, a method for pushing early warning information based on information security profiles is provided, comprising:

[0006] A database is set up to collect comparison and control information;

[0007] The comparison information includes first information, second information, and third information. The first information is the user information of the target user, the second information is the user behavior of the target user, and the third information is the network environment of the target user. Feature data is obtained by extracting features from the data information in the first information, the second information, and the third information.

[0008] The comparison information is collected risk information, which includes risky phone numbers, IP addresses, website addresses, and text information;

[0009] The feature data in the security profile is compared with the risk information. If the feature data matches the risk information, it is recorded as an anomaly of the feature data.

[0010] By comparing all the aforementioned feature data, a security profile of the target user is formed, and warning information is pushed based on the anomalies in the feature data.

[0011] In one embodiment of this application, the step of pushing early warning information based on the abnormal situation in the feature data specifically includes:

[0012] Obtain the contact information of the target user and the contact information of the target user's first contact person from the first information. The first contact person includes the target user's relatives and / or friends.

[0013] The contact information of the second contact person of the target user is obtained from the third information. The second contact person is the local anti-fraud department obtained based on the geographical location of the target user's network environment.

[0014] The abnormal situations are categorized into three levels of risk, from low to high: Level 1, Level 2, and Level 3. When the abnormal situation is at Level 1 risk, a warning message is sent to the contact information of the target user. When the abnormal situation is at Level 2 risk, a warning message is sent to the contact information of the first contact person, in addition to the Level 1 risk level. When the abnormal situation is at Level 3 risk, a warning message is sent to the contact information of the second contact person, in addition to the Level 2 risk level.

[0015] In one embodiment of this application, the abnormal situation is accumulated within a preset unit time period. When the feature data matches the risk information, it is determined to be the first risk. After being determined to be the first risk, if the feature data matches the risk information again within the preset unit time period, it is upgraded to the second risk. After being determined to be the second risk, if the feature data matches the risk information again within the preset unit time period, it is upgraded to the third risk.

[0016] In one embodiment of this application, when the target user is at the level 2 risk or the level 3 risk, a verification window is sent to the current window browsed by the target user, and verification information is sent to the first contact. The verification window is used to cover the current browsing window of the target user, and the verification information is used to close the verification window.

[0017] In one embodiment of this application, the user behavior includes obtaining website and text information from the target user's browsing window, and forming the target user's behavior footprint based on the website and text information;

[0018] Extract feature data from the behavioral footprint, including the official website name and official seal in the window;

[0019] Obtain the official website URL and official seal through online platforms;

[0020] Obtain the URL and official seal of the official website displayed in the browser window of the target user, and compare them with the URL and official seal of the corresponding official website;

[0021] If, during the comparison process, the URL and official seal displayed in the target user's window are inconsistent with the URL and official seal of the corresponding official website, then the abnormal situation is recorded.

[0022] In one embodiment of this application, when the target user's network environment is affected by untrusted network connections, abnormal IP connections, viruses, or network hijacking, the abnormal situation is recorded.

[0023] In one embodiment of this application, the security profile is updated based on the abnormal situations recorded in the first information, the second information, and the third information. The risk behavior of the target user is predicted based on the abnormal situations recorded in the first information, the second information, and the third information in the security profile. The predicted warning information is then sent to the target user and / or the first contact person and / or the second contact person.

[0024] In one embodiment of this application, the step of predicting the risky behavior of the target user based on the abnormal situations recorded in the first information, the second information, and the third information in the security profile specifically includes:

[0025] If the recorded abnormal situation appears in the first information, the second information, and the third information, the frequency of the recorded abnormal situation will be recorded. The frequency is the number of times the abnormal situation occurs within a preset unit of time. When the frequency of the abnormal situation increases, the risk behavior of the target user will be predicted based on the feature data of the increased frequency.

[0026] In one embodiment of this application, the security profile includes recording the number of times the same feature data exhibits the abnormal situation, sorting the different feature data exhibiting the abnormal situation in chronological order, combining the security profiles of multiple target users to derive common abnormal situation occurrence paths, and when the feature data exhibits the abnormal situation, monitoring the subsequent possible abnormal situation paths and sending early warning information to the target user.

[0027] In a second aspect of this application, a system for pushing early warning information based on information security profiles is provided, comprising:

[0028] Database module: Sets up a database used to collect comparison and control information;

[0029] User information acquisition module: The comparison information includes first information, second information and third information, the first information is the user information of the target user, the second information is the user behavior of the target user, and the third information is the network environment of the target user; feature data is obtained by extracting features from the data information in the first information, the second information and the third information;

[0030] Risk information acquisition module: The comparison information is the collected risk information, which includes risky phone numbers, IP addresses, website addresses, and text information;

[0031] Feature comparison module: compares the feature data in the security profile with the risk information. When the feature data matches the risk information, it is recorded as an anomaly of the feature data.

[0032] Early warning push module: compares all the feature data, the feature data forms a security profile of the target user, and pushes early warning information based on the abnormal situations in the feature data.

[0033] In one embodiment of this application, the early warning push module further includes:

[0034] First information acquisition submodule: Obtains the contact information of the target user and the contact information of the target user's first contact person from the first information, wherein the first contact person includes the target user's relatives and / or friends;

[0035] The third information acquisition submodule: obtains the contact information of the second contact person of the target user from the third information. The second contact person is the local anti-fraud department obtained based on the geographical location of the network environment where the target user is located;

[0036] Risk Level Module: The abnormal situation is classified into three levels of risk, from low to high: Level 1, Level 2, and Level 3. When the abnormal situation is at Level 1 risk, a warning message is sent to the contact information of the target user; when the abnormal situation is at Level 2 risk, a warning message is sent to the contact information of the first contact person in addition to Level 1 risk; when the abnormal situation is at Level 3 risk, a warning message is sent to the contact information of the second contact person in addition to Level 2 risk.

[0037] In one embodiment of this application, the abnormal situation is accumulated within a preset unit time period. When the feature data matches the risk information, it is determined to be the first risk. After being determined to be the first risk, if the feature data matches the risk information again within the preset unit time period, it is upgraded to the second risk. After being determined to be the second risk, if the feature data matches the risk information again within the preset unit time period, it is upgraded to the third risk.

[0038] In one embodiment of this application, the risk level module further includes a verification submodule:

[0039] When the target user is at the level 2 risk or the level 3 risk, the verification submodule sends a verification window to the target user's current browsing window and sends verification information to the first contact. The verification window is used to cover the target user's current browsing window, and the verification information is used to close the verification window.

[0040] In one embodiment of this application, the user information acquisition module specifically includes:

[0041] Behavior Footprint Submodule: The user behavior includes obtaining website and text information from the target user's browsing window, and forming the target user's behavior footprint based on the website and text information;

[0042] Feature extraction submodule: Extracts feature data from the behavioral footprint, including the official website name and official seal in the window;

[0043] Web search submodule: Obtains the official website URL and official seal through the web platform;

[0044] The comparison submodule retrieves the URL and official seal of the official website displayed in the target user's browser window and compares them with the URL and official seal of the corresponding official website. If, during the comparison, the URL and official seal of the official website displayed in the target user's window do not match the URL and official seal of the corresponding official website, the abnormal situation is recorded.

[0045] In one embodiment of this application, when the target user's network environment is affected by untrusted network connections, abnormal IP connections, viruses, or network hijacking, the abnormal situation is recorded.

[0046] In one embodiment of this application, a prediction module is also included:

[0047] The security profile is updated based on the anomalies recorded in the first, second, and third information. The risk behaviors of the target user are predicted based on the anomalies recorded in the first, second, and third information in the security profile. The predicted warning information is then sent to the target user and / or the first contact and / or the second contact.

[0048] In one embodiment of this application, the prediction module specifically includes recording the frequency of the recorded abnormal situation when it appears in the first information, the second information and the third information. The frequency is the number of times the abnormal situation occurs per unit time. When the frequency of the abnormal situation increases, the risk behavior of the target user is predicted based on the feature data of the increased frequency.

[0049] In one embodiment of this application, the prediction module further includes a path monitoring submodule:

[0050] The path monitoring submodule in the security profile includes recording the number of times the same feature data occurs under the abnormal situation, sorting the time order of the occurrence of the abnormal situation under different feature data, combining the security profiles of multiple target users to obtain common paths where the abnormal situation occurs, and monitoring the paths where the abnormal situation may occur after the feature data occurs, and sending the warning information to the target user when the abnormal situation occurs.

[0051] This application has the following beneficial effects:

[0052] 1. Obtain the comparison information of the target user and the reference information for the risk information, and store them separately in the database. Extract features from the data in the comparison information and compare them one by one with the reference information to determine if the target user's data matches the reference information. Organize the feature data into partitions and display the feature data representing the abnormal situation to obtain the target user's security profile. Based on the distribution of the feature data representing the abnormal situation, identify the target user's security vulnerability areas. Issue warnings to the target user regarding fraud cases caused by these vulnerabilities. Because the warnings are generated based on the target user's own actions, they have high credibility and effectively improve the target user's ability to prevent fraud, thus reducing fraud cases. The following is an example of actual operation to help understand the technical solution: The target user's device is infected with malware due to browsing a risky website, resulting in the theft of personal information. In this process, browsing the risky website is the second piece of information; device infection... The stolen personal information is the third piece of information. At this point, the security profile shows that the target user's user behavior and network environment are at risk, and sends a warning message to remind the target user to browse safe websites and check the network environment and devices for virus intrusion. At the same time, it sends the target user cases of financial losses caused by device infection due to browsing risky websites. Subsequently, the target user receives multiple calls from risky numbers. During this process, talking to risky numbers is the first piece of information. At this point, the security profile shows that the target user's user information is at risk, and sends a warning message to remind the target user that there may be fraudsters in the contact and call records. At the same time, it sends the target user common fraudsters' talk and cases of financial losses caused by fraud. The above is an example. Furthermore, the first, second, and third pieces of information can be further subdivided according to the usage scenario and the user. For example, the second piece of information can be further subdivided into browsing web page information and text communication information. Further subdivision makes the risk area of ​​the security profile more accurate and the warning information more detailed.

[0053] 2. Anomalies appearing in the target user's characteristic data are classified into risk levels, from low to high. Correspondingly, warning messages are sent to different contacts based on the risk level. Specifically, for Level 1 risk, a warning message is sent to the target user themselves, reminding them to be aware of the risky operation. At this level, the target user needs to voluntarily stop the relevant risky operation. If the target user voluntarily stops the relevant risky operation, a warning message will not be sent to the first or second contact, avoiding multiple contacts being contacted by the first contact or increasing the workload of the second contact. For Level 2 risk, in addition to sending a warning message to the target user, a warning message is also sent to the first contact. Therefore, the first contact trusted by the target user warns the target user to prevent further deception and avoid the target user ignoring the warning message due to believing the fraudsters. If the target user stops the relevant risky operation, a warning message will not be sent to the second contact, avoiding increasing the workload of the second contact. For Level 3 risk, in addition to sending warning messages to the target user and the first contact, a warning message is also sent to the second contact. Therefore, a credible organization in the target user's region will send a warning message to the target user. The system alerts users to prevent them from being further scammed, avoiding situations where the target user ignores warning messages and reminders from the first contact person due to trusting the scammers. Furthermore, if an alert is sent to the target user at Level 1 risk, and anomalies in the target user's characteristics are detected again within a preset time, it indicates that the target user did not see or ignored the alert. In this case, the target user may be in a scam situation, requiring the first contact person trusted by the target user to contact them and even prevent further scamming. If anomalies in the target user's characteristics are detected again within a preset time at Level 2 risk, it indicates that the first contact person failed to stop the target user, escalating to Level 3 risk. In this case, a credible organization, such as the anti-fraud department of a police station, should dissuade the target user. Classifying the risk level of the target user helps prevent situations where, for example, the target user accidentally clicks on a webpage or has not communicated with the scammers multiple times. In such cases, only a reminder is needed, or if the target user no longer trusts the scammers after the reminder, there is no need to contact others, thus avoiding wasted resources.

[0054] 3. When the target user is at level 2 or level 3 risk, a verification window is sent. The verification window covers the target user's current browsing window, preventing the target user from obtaining further information or from performing operations such as transferring funds. The verification window only allows the input of verification information, which is then sent to the first contact person. The target user can only continue to the next step after obtaining the verification information through the first contact person and closing the verification window. This avoids situations where the first contact person does not see the warning information or is unable to prevent the target user from continuing to operate, resulting in failure to stop the target user's transfer or other behaviors and causing financial losses.

[0055] 4. Considering that in fraud scenarios, fraudsters may imitate official websites and forge official documents, exploiting the target's trust in official sources to defraud them. This type of fraud easily gains the target's trust. Therefore, in this embodiment, when extracting features, the official website name and official seal appearing on the current page viewed by the target user are extracted. The real website address of the official website name is then obtained through a network platform. By comparing the website address of the current page viewed by the target user with the real website address, it can be determined whether the target user is browsing a fake official website. Similarly, the information about the seal in the browsing window is extracted, and the real official seal is found and compared to determine whether the seal in the document viewed by the target user is forged. Furthermore, a search can be conducted on the real official website to see if the document viewed by the target user has been published, determining whether the document viewed by the target user is a forged document and alerting the target user. Furthermore, the forged website address is simultaneously synchronized to the comparison information, so subsequent browsing does not require website searching and comparison; the website address is directly used to determine if it is a risky website.

[0056] 5. Update the security profile based on the anomalies in the feature data. The security profile identifies the target user's security vulnerabilities, meaning areas where fraudsters are likely to exploit certain features to defraud the target user. For example, if several risky phone numbers are detected in the target user's contacts, this becomes the first security vulnerability; similarly, if multiple risky website addresses are detected in the target user's browsing history, this becomes the second security vulnerability. By analyzing these vulnerabilities, targeted reminders can be issued to the target user, raising their awareness of fraud prevention even when they are not in a fraudulent situation.

[0057] 6. If the target user is defrauded, there will usually be a process of increased contact frequency with the fraudsters in the fraud scenario. Therefore, in this embodiment, the frequency of abnormal situations is recorded when an abnormal situation occurs. If the frequency of abnormal situations does not increase within a unit of time, it means that the target user has not fallen into a fraud scenario. However, if the frequency of abnormal situations increases within a unit of time, it means that the target user may have fallen into a fraud scenario. At this time, the prediction of the risk behavior of the target user is used to remind the target user.

[0058] 7. By recording the number of times the same feature data exhibits the abnormal situation and sorting the time order of the abnormal situations of different feature data, the order of occurrence of the abnormal situations in the current fraud scenario is obtained, since the same feature data may exhibit multiple abnormalities. Combining multiple target users and multiple fraud scenarios, the order of occurrence of abnormal situations in various fraud scenarios is derived. When the feature data of a target user exhibits an abnormality, the stage of the fraud scenario that the target user may be in is analyzed, and subsequent fraud scenarios are predicted. The predicted subsequent scenarios are sent to the target user. When the target user finds that the subsequent scenario matches the scenario predicted in the warning information, it is easier for the target user to believe that they are in a fraud scenario, thereby escaping from the fraud scenario and avoiding financial loss. Attached Figure Description

[0059] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0060] Figure 1 This is a schematic diagram of the electronic device structure of the hardware operating environment involved in the embodiments of this application.

[0061] Figure 2 This is a schematic diagram of the system architecture involved in the embodiments of this application.

[0062] Figure 3 This is a flowchart illustrating the steps of a method for pushing early warning information based on information security profiles, as provided in an embodiment of this application.

[0063] Figure 4 This is a schematic diagram illustrating the effect of assigning different indicator types to different evaluation and value areas according to the embodiments of this application.

[0064] Figure 5 This is a schematic diagram of the functional modules of an information security profile-based push and early warning information system provided in an embodiment of this application. Detailed Implementation

[0065] To make the above-mentioned objectives, features, and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0066] The scheme of this application will be further described below with reference to the accompanying drawings.

[0067] Reference Figure 1 , Figure 1 This is a schematic diagram of the electronic device structure of the hardware operating environment involved in the embodiments of this application.

[0068] like Figure 1 As shown, the electronic device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen or an input unit such as a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be a high-speed random access memory (RAM) or a stable non-volatile memory (NVM), such as a disk drive. The memory 1005 may also optionally be a storage device independent of the aforementioned processor 1001.

[0069] Those skilled in the art will understand that Figure 1 The structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0070] like Figure 1 As shown, the memory 1005, which serves as a storage medium, may include an operating system, a data storage module, a network communication module, a user interface module, and electronic programs.

[0071] exist Figure 1In the electronic device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the electronic device of the present invention can be set in the electronic device, and the electronic device calls a method for pushing early warning information based on information security profile stored in the memory 1005 through the processor 1001, and executes the method for pushing early warning information based on information security profile provided in the embodiment of this application.

[0072] Reference Figure 2 The diagram illustrates the system architecture of an embodiment of this application. Figure 2 As shown, the system architecture may include a first device 201, a second device 202, a third device 203, a fourth device 204, and a network 205. The network 205 serves as a medium for providing communication links between the first device 201, the second device 202, the third device 203, and the fourth device 204. The network 205 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0073] In this embodiment, the first device 201, the second device 202, the third device 203, and the fourth device 204 can be hardware devices or software that support network connectivity to provide various network services. When the device is hardware, it can be various electronic devices, including but not limited to smartphones, tablets, laptops, desktop computers, and servers. In this case, as hardware, it can be implemented as a distributed device group consisting of multiple devices, or as a single device. When the device is software, it can be installed on the devices listed above. In this case, as software, it can be implemented as, for example, multiple software programs or software modules used to provide distributed services, or as a single software program or software module. No specific limitations are made here.

[0074] In practice, devices can provide network services by installing corresponding client or server applications. After installing a client application, the device can function as a client in network communication. Similarly, after installing a server application, it can function as a server in network communication.

[0075] As an example, in Figure 2In this embodiment, the first device 201 acts as the server, while the second device 202, third device 203, and fourth device 204 act as clients. Specifically, the second device 202, third device 203, and fourth device 204 can be clients with information browsing applications installed, and the first device 201 can be the backend server of the information browsing application. It should be noted that the method for pushing early warning information based on information security profiles provided in this application embodiment can be executed by the first device 201, second device 202, third device 203, and fourth device 204.

[0076] It should be understood that Figure 2 The number of networks and devices shown is merely illustrative. Any number of networks and devices can be included depending on implementation needs.

[0077] Reference Figure 3 Based on the aforementioned hardware operating environment, this application provides a method for pushing early warning information based on information security profiles, including:

[0078] A database is set up to collect comparison and control information;

[0079] It should be noted that the database can be regarded as an electronic filing cabinet, that is, a place to store electronic files. According to the preset program, the data in the files can be added, extracted, updated, deleted, etc. In this application, the database stores different categories of information data separately according to different definitions. It can also be said that the database also includes two smaller databases, one storing the comparison information and the other storing the comparison information. Furthermore, the smaller databases can be further divided to a smaller degree, so that all the collected data is stored in the database in an orderly manner, effectively saving the time of searching for data.

[0080] The comparison information includes first information, second information, and third information. The first information is the user information of the target user, the second information is the user behavior of the target user, and the third information is the network environment of the target user. Feature data is obtained by extracting features from the data information in the first information, the second information, and the third information.

[0081] It should be noted that the first information is the target user's user information, which includes various types of information, such as the target user, the target user's relatives and / or friends, the target user's recent call contact information, and information such as the user's age. The contact information of the target user and the target user's relatives and / or friends can be manually set, and the contact information of trusted relatives and / or friends can be added to more effectively dissuade the target user when they may be being scammed. At the same time, the target user can be a communication tool with data interaction capabilities, such as a mobile phone or iPad, or it can refer to all of a user's communication tools.

[0082] The comparison information is collected risk information, which includes risky phone numbers, IP addresses, website addresses, and text information;

[0083] It should be noted that the comparison information is risk information collected through the network, and the information in its own database is updated through the network, such as adding new website addresses and deleting deregistered website addresses;

[0084] The feature data in the security profile is compared with the risk information. If the feature data matches the risk information, it is recorded as an anomaly of the feature data.

[0085] By comparing all the aforementioned feature data, a security profile of the target user is formed, and warning information is pushed based on the anomalies in the feature data.

[0086] It should be noted that the abnormal situations recorded in the aforementioned feature data refer to information in the target user's feature data that is identical to the risk information. For example, if the target user has visited a phishing website, made a phone call to a fraudulent number, or the text message contains fraud-sensitive words, the target user may be in a fraudulent situation. By comparing all the target user's feature data, feature data that are in the first, second, or third information are placed in the same area. At the same time, based on the relevance and usage scenario of the feature data, feature data with higher relevance are placed closer together to obtain the final security profile. The security profile includes the extracted feature data and displays the feature data that shows the abnormal situation. By observing the distribution of the feature data with the abnormal situation in the security profile, the weaker areas in the target user's security profile can be revealed, and targeted warnings can be issued to the target user for fraudulent activities in these areas.

[0087] In this embodiment, the comparison information of the target user and the reference information for the risk information are first obtained and stored separately in the database. Features are extracted from the data in the comparison information and compared one by one with the reference information to determine whether the target user's data matches the reference information. The feature data is then partitioned and displayed as the feature data of the abnormal situation, resulting in the target user's security profile. Based on the distribution of the feature data of the abnormal situation, the target user's security vulnerability area is identified. A warning is issued to the target user based on fraud cases caused by this area. Because the warning is generated based on the target user's own actions, it has high credibility and effectively improves the target user's ability to prevent fraud scenarios, thus effectively reducing fraud cases. See [link to documentation]. Figure 4 As shown, the comparison information includes first information, second information, and third information. Each type of information includes multiple feature data. The comparison information is compared with several risk information in the control information. It is found that feature data 4 in the second information is consistent with the risk information in the control information. Therefore, in the resulting security profile, feature data 3 is highlighted, and the second information to which it belongs is also highlighted, indicating that there is a security risk in the second information area. The following is an example of actual operation to help understand the technical solution: The target user's device is infected with malware and personal information is stolen due to browsing a risky website. In this process, browsing the risky website is the second information; device infection and the theft of personal information is the third information. At this time, the security profile shows that the target user's user behavior and network environment are at risk, and sends a warning message to remind the target user to browse a safe website. The system checks the network environment and devices for virus intrusion and sends case studies of financial losses due to device infection from browsing risky websites to the target user. Subsequently, the target user receives multiple calls from risky numbers. During this process, the first piece of information is the call with the risky number. At this point, the security profile displays a risk in the target user's information and sends a warning message, reminding the target user that their contacts and call records may contain fraudsters. Simultaneously, the system sends the target user common fraudster tactics and case studies of financial losses due to fraud. This is just an example. Furthermore, the first, second, and third pieces of information can be further subdivided according to usage scenarios and users. For example, the second piece of information can be further divided into web browsing information and text communication information. This further subdivision makes the risk areas displayed in the security profile more accurate, and the warning messages more detailed.

[0088] In one embodiment of this application, the step of pushing early warning information based on the abnormal situation in the feature data specifically includes:

[0089] Obtain the contact information of the target user and the contact information of the target user's first contact person from the first information. The first contact person includes the target user's relatives and / or friends.

[0090] The contact information of the second contact person of the target user is obtained from the third information. The second contact person is the local anti-fraud department obtained based on the geographical location of the target user's network environment.

[0091] It should be noted that, based on the target user's third information and the geographical location left during data interaction, the anti-fraud department of that geographical location can be searched. If the local police station does not have an anti-fraud department or cannot find its contact information, the police station can be contacted directly. By using the geographical location of the network environment and the local anti-fraud department obtained from that geographical location, a rapid response can be made. In emergency situations, the target user can be found quickly, preventing the target user from contacting fraudsters.

[0092] The abnormal situations are categorized into three levels of risk, from low to high: Level 1, Level 2, and Level 3. When the abnormal situation is at Level 1 risk, a warning message is sent to the contact information of the target user. When the abnormal situation is at Level 2 risk, a warning message is sent to the contact information of the first contact person, in addition to the Level 1 risk level. When the abnormal situation is at Level 3 risk, a warning message is sent to the contact information of the second contact person, in addition to the Level 2 risk level.

[0093] In one embodiment of this application, the abnormal situation is accumulated within a preset unit time period. When the feature data matches the risk information, it is determined to be the first risk. After being determined to be the first risk, if the feature data matches the risk information again within the preset unit time period, it is upgraded to the second risk. After being determined to be the second risk, if the feature data matches the risk information again within the preset unit time period, it is upgraded to the third risk.

[0094] In this embodiment, anomalies in the target user's feature data are classified into risk levels, from low to high. Correspondingly, warning messages are sent to different contacts based on the risk level. Specifically, for Level 1 risk, a warning message is sent directly to the target user, reminding them to be aware of the risky operation. At this level, the target user needs to consciously stop the relevant risky operation. If the target user consciously stops the relevant risky operation, a warning message is not sent to the first or second contact, avoiding multiple contacts being contacted by the first contact or increasing the workload of the second contact. For Level 2 risk, in addition to sending a warning message to the target user, a warning message is also sent to the first contact. Therefore, the first contact trusted by the target user warns the target user, preventing further deception and avoiding the target user ignoring the warning message due to believing the fraudsters. If the target user stops the relevant risky operation, a warning message is not sent to the second contact, avoiding increasing the workload of the second contact. For Level 3 risk, in addition to sending warning messages to the target user and the first contact, a warning message is also sent to the second contact. Therefore, a credible organization in the target user's region sends a warning message to the second contact. The system aims to alert target users to prevent them from being further deceived and to avoid situations where they ignore warning messages and reminders from their primary contact due to trust in fraudsters. Furthermore, if an alert is sent to a target user at Level 1 risk, and anomalies in the user's characteristics are detected again within a preset time, it indicates that the user did not see or ignored the alert. In this case, the user may be in a scam situation, requiring their trusted primary contact to contact them and potentially prevent further fraud. If anomalies in the user's characteristics are detected again within a preset time at Level 2 risk, it indicates that the primary contact failed to prevent the user from being scammed, escalating to Level 3 risk. In this case, a credible organization, such as a police anti-fraud department, should advise the user against further fraud. This risk classification system helps prevent situations where, for example, a target user accidentally clicks on a webpage without multiple interactions with fraudsters. In such cases, only a reminder is needed, or if the user no longer trusts the fraudsters after the reminder, further contact is unnecessary, thus avoiding wasted resources.

[0095] In one embodiment of this application, when the target user is at the level 2 risk or the level 3 risk, a verification window is sent to the current window browsed by the target user, and verification information is sent to the first contact. The verification window is used to cover the current browsing window of the target user, and the verification information is used to close the verification window.

[0096] It should be noted that when the target user is at level two or three risk, it means that the target user has ignored or failed to see the warning information, which means that they may have fallen into a fraud scenario. At this time, the first or second contact person may need time to advise the target user, and during this time the target user may have already been defrauded of money. Therefore, an emergency stop function is needed to cover the target user's current browsing page to prevent the fraud from developing further, and even cover the transfer page to avoid financial loss at the last step.

[0097] In this embodiment, when the target user is at level two or three risk, a verification window is sent. This verification window covers the target user's current browsing window, preventing the target user from obtaining further information or performing operations such as transferring funds. The verification window only allows verification information to be entered, which is then sent to a first contact. The target user can only continue to the next step after obtaining the verification information from the first contact and closing the verification window. This avoids situations where the first contact does not see the warning information or is unable to prevent the target user from continuing to operate, thus failing to stop the target user's transfer activities and causing financial losses.

[0098] In one embodiment of this application, the user behavior includes obtaining website and text information from the target user's browsing window, and forming the target user's behavior footprint based on the website and text information;

[0099] Extract feature data from the behavioral footprint, including the official website name and official seal in the window;

[0100] Obtain the official website URL and official seal through online platforms;

[0101] Obtain the URL and official seal of the official website displayed in the browser window of the target user, and compare them with the URL and official seal of the corresponding official website;

[0102] If, during the comparison process, the URL and official seal displayed in the target user's window are inconsistent with the URL and official seal of the corresponding official website, then the abnormal situation is recorded.

[0103] In this embodiment, considering that in fraud scenarios, fraudsters may imitate official websites and forge official documents, exploiting the target's trust in official sources to defraud them, this method is designed to easily gain the target's trust. Therefore, in this embodiment, when extracting features, the official website name and official seal appearing on the current page viewed by the target user are extracted. The real website address of the official website name is then obtained through a network platform. By comparing the website address of the current page viewed by the target user with the real website address, it can be determined whether the target user is browsing a fake official website. Similarly, the information about the seal in the browsing window is extracted, and the real official seal is found for comparison to determine whether the seal in the document viewed by the target user is forged. Furthermore, the document viewed by the target user can also be searched on the real official website to determine whether the document viewed by the target user has been published, and the target user is alerted. Furthermore, the forged website address is simultaneously synchronized to the comparison information, so that subsequent browsing does not require website search and comparison; the website address can be directly used to determine if it is a risky website.

[0104] In one embodiment of this application, when the target user's network environment is affected by untrusted network connections, abnormal IP connections, viruses, or network hijacking, the abnormal situation is recorded.

[0105] It should be noted that the network hijacking refers to the abnormal modification and acquisition of the target user's data. In the fraud scenario, the fraudsters trick the target user into downloading software, which may contain viruses, allowing the fraudsters to obtain the target user's data.

[0106] In one embodiment of this application, the security profile is updated based on the abnormal situations recorded in the first information, the second information, and the third information. The risk behavior of the target user is predicted based on the abnormal situations recorded in the first information, the second information, and the third information in the security profile. The predicted warning information is then sent to the target user and / or the first contact person and / or the second contact person.

[0107] In this embodiment, the security profile is updated based on the anomalies in the feature data. The security profile identifies the target user's security vulnerabilities, meaning areas where fraudsters are likely to exploit certain feature data to defraud the target user. For example, if several risky phone numbers are detected among the target user's contacts, this becomes the first security vulnerability; similarly, if multiple risky website addresses are detected in the target user's browsing history, this becomes the second security vulnerability. By analyzing these vulnerabilities, targeted reminders can be issued to the target user, raising their awareness of fraud prevention even when they are not in a fraudulent situation.

[0108] In one embodiment of this application, the step of predicting the risky behavior of the target user based on the abnormal situations recorded in the first information, the second information, and the third information in the security profile specifically includes:

[0109] If the recorded abnormal situation appears in the first information, the second information, and the third information, the frequency of the recorded abnormal situation will be recorded. The frequency is the number of times the abnormal situation occurs within a preset unit of time. When the frequency of the abnormal situation increases, the risk behavior of the target user will be predicted based on the feature data of the increased frequency.

[0110] If the target user is defrauded, there will usually be a process of increased contact with the fraudsters in the fraud scenario. Therefore, in this embodiment, the frequency of abnormal situations is recorded when an abnormal situation occurs. If the frequency of abnormal situations does not increase within a unit of time, it means that the target user has not fallen into a fraud scenario. However, if the frequency of abnormal situations increases within a unit of time, it means that the target user may have fallen into a fraud scenario. At this time, the prediction of the target user's risky behavior is used to remind the target user.

[0111] In one embodiment of this application, the security profile includes recording the number of times the same feature data exhibits the abnormal situation, sorting the different feature data exhibiting the abnormal situation in chronological order, combining the security profiles of multiple target users to derive common abnormal situation occurrence paths, and when the feature data exhibits the abnormal situation, monitoring the subsequent possible abnormal situation paths and sending early warning information to the target user.

[0112] In this embodiment, by recording the number of times the same feature data exhibits anomalies and sorting the time sequence of the occurrence of anomalies in different feature data, the order in which the same feature data may exhibit anomalies multiple times is obtained. Combining multiple target users and multiple fraud scenarios, the order in which anomalies occur in various fraud scenarios is derived. When the feature data of a target user exhibits anomalies, the stage of the fraud scenario that the target user may be in is analyzed, and subsequent fraud scenarios are predicted. The predicted subsequent scenarios are sent to the target user. When the target user finds that the subsequent scenarios match the predicted scenarios in the warning information, it is easier for the target user to believe that they are in a fraud scenario, thereby extricating themselves from the fraud scenario and avoiding financial loss.

[0113] In the second aspect of this application, see Figure 5 As shown, a system for pushing early warning information based on information security profiles is provided, including:

[0114] Database module: Sets up a database used to collect comparison and control information;

[0115] User information acquisition module: The comparison information includes first information, second information and third information, the first information is the user information of the target user, the second information is the user behavior of the target user, and the third information is the network environment of the target user; feature data is obtained by extracting features from the data information in the first information, the second information and the third information;

[0116] Risk information acquisition module: The comparison information is the collected risk information, which includes risky phone numbers, IP addresses, website addresses, and text information;

[0117] Feature comparison module: compares the feature data in the security profile with the risk information. When the feature data matches the risk information, it is recorded as an anomaly of the feature data.

[0118] Early warning push module: compares all the feature data, the feature data forms a security profile of the target user, and pushes early warning information based on the abnormal situations in the feature data.

[0119] In one embodiment of this application, the early warning push module further includes:

[0120] First information acquisition submodule: Obtains the contact information of the target user and the contact information of the target user's first contact person from the first information, wherein the first contact person includes the target user's relatives and / or friends;

[0121] The third information acquisition submodule: obtains the contact information of the second contact person of the target user from the third information. The second contact person is the local anti-fraud department obtained based on the geographical location of the network environment where the target user is located;

[0122] Risk Level Module: The abnormal situation is classified into three levels of risk, from low to high: Level 1, Level 2, and Level 3. When the abnormal situation is at Level 1 risk, a warning message is sent to the contact information of the target user; when the abnormal situation is at Level 2 risk, a warning message is sent to the contact information of the first contact person in addition to Level 1 risk; when the abnormal situation is at Level 3 risk, a warning message is sent to the contact information of the second contact person in addition to Level 2 risk.

[0123] In one embodiment of this application, the abnormal situation is accumulated within a preset unit time period. When the feature data matches the risk information, it is determined to be the first risk. After being determined to be the first risk, if the feature data matches the risk information again within the preset unit time period, it is upgraded to the second risk. After being determined to be the second risk, if the feature data matches the risk information again within the preset unit time period, it is upgraded to the third risk.

[0124] In one embodiment of this application, the risk level module further includes a verification submodule:

[0125] When the target user is at the level 2 risk or the level 3 risk, the verification submodule sends a verification window to the target user's current browsing window and sends verification information to the first contact. The verification window is used to cover the target user's current browsing window, and the verification information is used to close the verification window.

[0126] In one embodiment of this application, the user information acquisition module specifically includes:

[0127] Behavior Footprint Submodule: The user behavior includes obtaining website and text information from the target user's browsing window, and forming the target user's behavior footprint based on the website and text information;

[0128] Feature extraction submodule: Extracts feature data from the behavioral footprint, including the official website name and official seal in the window;

[0129] Web search submodule: Obtains the official website URL and official seal through the web platform;

[0130] The comparison submodule retrieves the URL and official seal of the official website displayed in the target user's browser window and compares them with the URL and official seal of the corresponding official website. If, during the comparison, the URL and official seal of the official website displayed in the target user's window do not match the URL and official seal of the corresponding official website, the abnormal situation is recorded.

[0131] In one embodiment of this application, when the target user's network environment is affected by untrusted network connections, abnormal IP connections, viruses, or network hijacking, the abnormal situation is recorded.

[0132] In one embodiment of this application, a prediction module is also included:

[0133] The security profile is updated based on the anomalies recorded in the first, second, and third information. The risk behaviors of the target user are predicted based on the anomalies recorded in the first, second, and third information in the security profile. The predicted warning information is then sent to the target user and / or the first contact and / or the second contact.

[0134] In one embodiment of this application, the prediction module specifically includes recording the frequency of the recorded abnormal situation when it appears in the first information, the second information and the third information. The frequency is the number of times the abnormal situation occurs per unit time. When the frequency of the abnormal situation increases, the risk behavior of the target user is predicted based on the feature data of the increased frequency.

[0135] In one embodiment of this application, the prediction module further includes a path monitoring submodule:

[0136] The path monitoring submodule in the security profile includes recording the number of times the same feature data occurs under the abnormal situation, sorting the time order of the occurrence of the abnormal situation under different feature data, combining the security profiles of multiple target users to obtain common paths where the abnormal situation occurs, and monitoring the paths where the abnormal situation may occur after the feature data occurs, and sending the warning information to the target user when the abnormal situation occurs.

[0137] It should be noted that the specific implementation of the information security profile-based early warning information push system in this application refers to the specific implementation of the information security profile-based early warning information push method proposed in the first aspect of the aforementioned application, and will not be repeated here.

[0138] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that an article or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the article or device that includes that element.

[0139] The above provides a detailed description of a method for pushing early warning information based on information security profiles. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method for pushing early warning information based on information security profiles and its core ideas. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for pushing early warning information based on information security profiles, characterized in that, include: A database is set up to collect comparison and control information; The comparison information includes first information, second information, and third information. The first information is the user information of the target user, the second information is the user behavior of the target user, and the third information is the network environment of the target user. Feature data is obtained by extracting features from the data information in the first information, the second information, and the third information. The comparison information is collected risk information, which includes risky phone numbers, IP addresses, website addresses, and text information; By comparing all the aforementioned feature data, feature data that are in the same location as the first, second, or third information are placed in the same area. Furthermore, based on the relevance and usage scenario of the feature data, feature data with higher relevance are placed closer together. This feature data forms a security profile of the target user, which includes the extracted feature data. The feature data in the security profile is compared with the risk information. When a match is found between the feature data and the risk information, it is recorded as an anomaly for that feature data. Simultaneously, the feature data exhibiting the anomaly is displayed. By observing the distribution of the anomaly feature data in the security profile, weaker areas in the target user's security profile can be identified, and warning information can be pushed based on the anomalies in the feature data. The step of pushing early warning information based on the anomalies in the feature data specifically includes: Obtain the contact information of the target user and the contact information of the target user's first contact person from the first information. The first contact person includes the target user's relatives and / or friends. The contact information of the second contact person of the target user is obtained from the third information. The second contact person is the local anti-fraud department obtained based on the geographical location of the target user's network environment. The abnormal situations are categorized into three levels of risk, from low to high: Level 1, Level 2, and Level 3. When the abnormal situation is at Level 1 risk, a warning message is sent to the contact information of the target user. When the abnormal situation is at Level 2 risk, a warning message is sent to the contact information of the first contact person, in addition to the Level 1 risk level. When the abnormal situation is at Level 3 risk, a warning message is sent to the contact information of the second contact person, in addition to the Level 2 risk level. The security profile is updated based on the anomalies recorded in the first, second, and third information. The risk behaviors of the target user are predicted based on the anomalies recorded in the first, second, and third information in the security profile. The predicted warning information is then sent to the target user and / or the first contact and / or the second contact.

2. The method for pushing early warning information based on information security profiles according to claim 1, characterized in that, The abnormal situations are accumulated within a preset unit time period. When the feature data matches the risk information, it is determined as the first risk. After being determined as the first risk, if the feature data matches the risk information again within a preset unit time period, it is upgraded to the second-level risk. Once identified as the second risk, if the feature data matches the risk information again within a preset unit time, it is upgraded to the third risk.

3. The method for pushing early warning information based on information security profiles according to claim 2, characterized in that, When the target user is at the level 2 or level 3 risk, a verification window is sent to the target user's current browsing window, and verification information is sent to the first contact. The verification window is used to cover the target user's current browsing window, and the verification information is used to close the verification window.

4. The method for pushing early warning information based on information security profiles according to claim 1, characterized in that, The user behavior includes obtaining website and text information from the target user's browsing window, and forming the target user's behavior footprint based on the website and text information; Extract feature data from the behavioral footprint, including the official website name and official seal in the window; Obtain the official website URL and official seal through online platforms; Obtain the URL and official seal of the official website displayed in the browser window of the target user, and compare them with the URL and official seal of the corresponding official website; If, during the comparison process, the URL and official seal displayed in the target user's window are inconsistent with the URL and official seal of the corresponding official website, then the abnormal situation is recorded.

5. The method for pushing early warning information based on information security profiles according to claim 1, characterized in that, When the target user's network environment contains instances of connecting to untrusted networks, connecting to abnormal IPs, viruses, or network hijacking, the abnormal situation is recorded.

6. The method for pushing early warning information based on information security profiles according to claim 1, characterized in that, The step of predicting the risk behavior of the target user based on the abnormal situations recorded in the first information, the second information, and the third information in the security profile specifically includes: If the recorded abnormal situation appears in the first information, the second information, and the third information, the frequency of the recorded abnormal situation will be recorded. The frequency is the number of times the abnormal situation occurs within a preset unit of time. When the frequency of the abnormal situation increases, the risk behavior of the target user will be predicted based on the feature data of the increased frequency.

7. The method for pushing early warning information based on information security profiles according to claim 1, characterized in that, The security profile includes recording the number of times the same feature data exhibits the anomaly, sorting the different feature data exhibiting the anomaly in chronological order, combining the security profiles of multiple target users to derive common paths for the occurrence of the anomaly, and monitoring subsequent possible paths for the anomaly when the feature data exhibits the anomaly, and sending warning information to the target user.

8. A system for pushing early warning information based on information security profiles, characterized in that, include: Database module: Sets up a database used to collect comparison and control information; User information acquisition module: The comparison information includes first information, second information and third information, the first information is the user information of the target user, the second information is the user behavior of the target user, and the third information is the network environment of the target user; feature data is obtained by extracting features from the data information in the first information, the second information and the third information; Risk information acquisition module: The comparison information is the collected risk information, which includes risky phone numbers, IP addresses, website addresses, and text information; Warning push module: Compares all the feature data, places feature data that are in the same area as the first, second, or third information in the same region. Based on the relevance and usage scenario of the feature data, feature data with higher relevance are placed closer together. The feature data forms a security profile of the target user, which includes the extracted feature data. The feature data in the security profile is compared with the risk information. When a match is found between the feature data and the risk information, it is recorded as an anomaly for that feature data. Simultaneously, the feature data showing the anomaly is displayed. By observing the distribution of the anomaly feature data in the security profile, weaker areas in the target user's security profile can be identified, and warning information is pushed based on the anomalies in the feature data. Risk progression module: Obtain the contact information of the target user and the contact information of the target user's first contact person from the first information. The first contact person includes the target user's relatives and / or friends. The contact information of the second contact person of the target user is obtained from the third information. The second contact person is the local anti-fraud department obtained based on the geographical location of the target user's network environment. The abnormal situation is classified into three levels of risk, from low to high: Level 1 risk, Level 2 risk, and Level 3 risk. When the abnormal situation is at Level 1 risk, a warning message is sent to the contact information of the target user. When the abnormal situation is at level two risk, a warning message is sent to the contact information of the first contact person, based on the level one risk; when the abnormal situation is at level three risk, a warning message is sent to the contact information of the second contact person, based on the level two risk. Early warning update module: Updates the security profile based on the abnormal situations recorded in the first information, the second information and the third information; predicts the risk behavior of the target user based on the abnormal situations recorded in the first information, the second information and the third information in the security profile; and sends the predicted early warning information to the target user and / or the first contact person and / or the second contact person.

Images