A communication security monitoring system and method based on big data

Abstract

This invention relates to the field of communication security technology, specifically to a communication security monitoring system and method based on big data. The system includes: a monitoring and control module, a call interception module, a traffic replication module, a link forwarding module, and a risk restriction module. The monitoring and control module analyzes the risks of an application (APP); the call interception module monitors the APP's interface calls, intercepts its API functions, and redirects SEL pointers; the traffic replication module injects port-level collision detection code into traffic data packets and replicates the data packets; the link forwarding module forwards the two data packets to the server through different ports; and the risk restriction module identifies the APP's forwarding behavior and imposes restrictions. This invention can identify risky APPs, monitor their forwarding behavior, and solve the problem of APPs bypassing system monitoring through server forwarding.

Description

Technical Field

[0001] This invention relates to the field of communication security technology, specifically to a communication security monitoring system and method based on big data. Background Technology

[0002] With the development of the internet, the use of computer applications (Apps) has become an important part of people's daily lives. To protect user privacy and data security, most Apps use HTTPS technology to encrypt their transmitted data traffic. HTTPS technology obtains the public key by parsing the server certificate and uses the public key for encryption and the private key for decryption to ensure the security of communication.

[0003] Due to the high encryption of HTTPS technology, regulatory agencies have difficulty intercepting and deciphering this information, making regulatory actions extremely difficult.

[0004] Traditional solutions involve verifying server certificates, obtaining server IP information, determining whether the server is risky, and restricting communication between the app and the risky server. However, malicious apps can bypass computer system monitoring by forwarding requests, allowing signals to pass through legitimate servers and connect to risky servers, thus still posing a threat to user information security. Summary of the Invention

[0005] The purpose of this invention is to provide a communication security monitoring system and method based on big data to solve the problems mentioned in the background art.

[0006] To address the aforementioned technical problems, the present invention provides the following technical solution: a communication security monitoring system based on big data, comprising: a monitoring and control module, a call interception module, a traffic replication module, a link forwarding module, and a risk restriction module;

[0007] The monitoring and control module is used to analyze the risk level of each APP through big data and adjust the level of supervision accordingly.

[0008] The call interception module is used to monitor the interface calls between the APP and the network library, obtain and intercept the API functions called by the target APP, and swap the IMP pointed to by its SEL by hooking the OC method, so that SEL points to the IMP of the monitoring unit.

[0009] The traffic copying module is used to inject port-level collision detection code into the traffic data packets sent by the APP and make a copy of them;

[0010] The link forwarding module is used to mark two traffic data packets with the same timestamp, one of which is sent normally to the target server, and the other is handed over to the proxy server for forwarding to the target server.

[0011] The risk restriction module is used to determine whether the two returned data are the same, identify the APP's forwarding behavior, and impose restrictions on it.

[0012] Furthermore, the monitoring and control module includes: an application behavior unit, a user analysis unit, and a supervision unit;

[0013] The application behavior unit is used to obtain the installation time, average daily traffic, and number of violations for each APP;

[0014] The user analysis unit is used to obtain the user's APP usage records, download sources, and authorization levels;

[0015] The regulatory unit is used to centrally monitor APP data and calculate risk coefficients based on the risk level of each APP to determine the intensity of supervision.

[0016] Furthermore, the call interception module includes: a traffic packet capture unit and a function switching unit;

[0017] The traffic capture unit is used to acquire and intercept API functions called by the target APP;

[0018] The function swapping unit is used to swap the IMP pointed to by SEL in the API function, so that the corresponding SEL points to the IMP of the monitoring unit.

[0019] Furthermore, the traffic replication module includes: a code injection unit and a data packet replication unit;

[0020] The code injection unit is used to inject port-level collision detection code into the traffic data packets sent by the APP;

[0021] The data packet copying unit is used to copy traffic data packets.

[0022] Furthermore, the link forwarding module includes: a certificate identification unit, a time stamping unit, and a proxy forwarding unit;

[0023] The certificate identification unit is used to identify the certificate of the target server and refuse access to servers with incorrect certificates, expired certificates, or no certificates.

[0024] The time stamping unit is used to add a time stamp to the two traffic data packets;

[0025] The proxy forwarding unit is used to send two traffic data packets separately, one sent normally and the other forwarded by the proxy server.

[0026] Furthermore, the risk restriction module includes: a return comparison unit and an application restriction unit;

[0027] The return comparison unit is used to obtain the encrypted return data of two traffic data packets, compare the two return data, and confirm whether they are the same.

[0028] The application restriction unit is used to determine that the APP has a forwarding risk when it detects that the returned data is different, and to impose traffic restrictions on it.

[0029] A big data-based communication security monitoring method includes the following steps:

[0030] S100. Analyze the risk level of each APP based on its application information and user behavior, and determine the monitoring frequency of each APP based on the risk level;

[0031] S200. Perform APP supervision, monitor the interface calls between the APP and the network library, obtain and intercept the API functions called by the target APP, and exchange the IMP pointed to by its SEL by hooking the OC method, so that SEL points to the IMP of the supervision unit;

[0032] S300. Modify the monitoring system's IMP, inject port-level collision detection code into the traffic data packets sent by the APP, and copy the traffic data packets;

[0033] S400 verifies the target server's certificate. After successful verification, the monitoring unit adds the same timestamp to the two traffic data packets. One packet is sent to the target server normally, and the other is forwarded to the target server via the proxy server. When forwarding occurs, the two traffic data packets collide at the forwarding port of the target server, resulting in data discrepancies.

[0034] S500. After the traffic data packet is returned, the regulatory unit determines whether the two returned data are the same, thereby identifying the APP's forwarding behavior and taking risk control measures.

[0035] Furthermore, step S100 includes:

[0036] Step S101. Obtain application information for each APP from the logs. The application information includes: APP installation time, average daily traffic, and number of violations.

[0037] Step S102. Obtain user behavior information, including: APP usage records, download sources and authorization levels, and preset the risk coefficient for each download source in the system;

[0038] Step S103. Determine the risk coefficient N of the APP, which is calculated using the following formula:

[0039]

[0040] Where N is the risk coefficient of the APP, D is the risk coefficient of the download source, E is the total number of violations of the APP in the history, T is the number of days the APP has been installed on the phone, S is the average daily traffic of the APP, k is the total number of times the user uses the APP after downloading the application, and Vi is the usage time of the user when using the APP for the ith time in the record. All of the above parameters are greater than 0.

[0041] The monitoring frequency V of the monitoring unit is determined by the risk coefficient of the APP, where V = N·V0, and V0 is a monitoring constant representing the intensity of monitoring, which is preset by the system.

[0042] The regulatory unit will monitor each APP according to the monitoring frequency, and will execute steps S200-S500 in sequence during the monitoring process;

[0043] The above steps can determine the regulatory intensity of each APP based on its usage records, installation time, historical traffic, and access to system API functions, thereby reducing traffic consumption caused by information supervision, balancing user experience and information security, and achieving the goal of humanized supervision.

[0044] Furthermore, step S200 includes:

[0045] Step S201. Reverse engineer the application being tested to obtain its runtime calls to system functions, configure middleware and traffic analysis tools, monitor the interface calls between the target APP and the network library, and intercept the API functions called by the target APP at the interface. The API functions are functions in which the APP requests to call methods in the system library.

[0046] Step S202. Modify the return value of the API function, dequeue the individual API function to bypass the verification mechanism of the target application's two-way verification communication interface, and re-enqueue the API function after the API function is redirected.

[0047] Step S203. After the API function is dequeued, the API execution result is changed using API Hook technology. The execution of the system's API function is redirected, and the IMP pointed to by its SEL is changed so that the SEL points to the IMP of the monitoring unit. The SEL is the name of the method in the system library called in the API method function, and the IMP is the method address corresponding to the method name. The SEL is made to point to the IMP of the monitoring unit.

[0048] The above steps can monitor the interface calls between the APP and the network library, analyze the API functions called by the target APP, and then intercept the API functions called by the target application by hooking the Objective-C method, change the return value of the API function, swap the IMP pointed to by its SEL, and inject monitoring code into the traffic sent by the APP, thereby realizing the supervision of the APP's behavior.

[0049] Furthermore, step S300 includes:

[0050] Step S301. Set the IMP of the monitoring system so that the API function returns a port-level collision detection code after pointing to the IMP of the monitoring unit and injects it into the traffic data packet sent by the APP. When the same code is detected in the same communication port, the port-level collision detection code will change its own order.

[0051] Step S302. The target APP conducts network communication and encrypts the traffic data packets via HTTPS. After the monitoring unit obtains the encrypted traffic data packets, it makes a copy of them as is, resulting in two encrypted traffic data packets.

[0052] Furthermore, step S400 includes:

[0053] Step S401. Verify the certificate of the target server communicating with the APP. If the target server certificate is valid and trusted, proceed to step S402; otherwise, determine that the APP has violated regulations and proceed to step S502.

[0054] Step S402. The monitoring unit accesses the proxy server, sends a proxy request, and provides the domain name address of the target server. After receiving the request, it establishes a new access link from the proxy server to the target server.

[0055] Step S403. Add a timestamp to the two traffic data packets and send them separately. One traffic data packet is delivered to the target server normally, while the other traffic data packet is forwarded by the access link between the proxy server and the target server and delivered to the target server.

[0056] Step S404. Based on the timestamp on the traffic data packets, the target server will simultaneously decrypt the two traffic data packets. If there is no forwarding request in the traffic data packets, the server will obtain the data locally and transmit the returned data to the user's mobile phone and the proxy server respectively from the two communication ports. The port-level collision detection code is not activated, and the returned data is the same. If there is a forwarding request in the traffic data packets, the two data packets will be queued at the forwarding communication port, the port-level collision detection code will be activated, and the returned data will be different.

[0057] The above steps do not require decryption of the HTTPS signal. By analyzing the differences between the two returned signals, it is possible to monitor the APP's forwarding behavior and solve the problem of the APP bypassing the computer system's monitoring by forwarding requests.

[0058] Furthermore, step S500 includes:

[0059] Step S501. After receiving the return data packet from the target server and the return data packet from the proxy server, the monitoring unit compares the two data packets. If the contents of the two return data packets are the same, it is determined that the APP has no violations. If the contents of the two return data packets are different, it is determined that the APP has violations.

[0060] Step S502. After the APP commits a violation, the APP's traffic communication is suspended, and the APP's risk coefficient is re-determined according to the formula in step S103, denoted as N2. If N-N2>r, the APP's authorization level is reduced by one level, where r is the trust reduction threshold preset by the system, and both N2 and r are constants greater than 0.

[0061] Compared with the prior art, the beneficial effects achieved by the present invention are:

[0062] 1. This invention can monitor the interface calls between an APP and a network library, analyze the API functions called by the target APP, and then intercept the API functions called by the target application through the hook OC method, change the return value of the API function, swap the IMP pointed to by its SEL, and inject monitoring code into the traffic sent by the APP, thereby realizing the supervision of the APP's behavior in order to detect potential security issues and malicious activities.

[0063] 2. This invention injects port-level collision code into the signals sent by the app. After HTTPS encryption, the monitoring unit copies the encrypted traffic and sends it to a proxy server. The proxy server forwards it to the target server and sends the response data back to the monitoring unit. Since the two traffic streams contain the same content, a collision occurs during forwarding, causing the content to change. The monitoring unit compares the data returned by the proxy server and the target server to detect whether the app is engaging in malicious forwarding behavior. This invention does not require decryption of the HTTPS signal; by analyzing the differences between the two returned signals, it can monitor the app's forwarding behavior, solving the problem of apps bypassing computer system monitoring by forwarding requests.

[0064] 3. This invention can determine the regulatory intensity of each APP based on its usage records, installation time, historical traffic, and access to system API functions, thereby reducing traffic consumption caused by information regulation, balancing user experience and information security, and achieving the goal of humanized regulation. Attached Figure Description

[0065] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0066] Figure 1 This is a schematic diagram of the structure of a communication security monitoring system based on big data according to the present invention;

[0067] Figure 2 This is a schematic diagram illustrating the steps of a communication security monitoring method based on big data according to the present invention; Detailed Implementation

[0068] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0069] Please see Figure 1 The present invention provides a technical solution: a communication security monitoring system based on big data, comprising: a monitoring and control module, a call interception module, a traffic replication module, a link forwarding module, and a risk restriction module;

[0070] The monitoring and control module is used to analyze the risk level of each APP through big data and adjust the level of supervision accordingly.

[0071] The monitoring and control module includes: an application behavior unit, a user analysis unit, and a supervision unit;

[0072] The application behavior unit is used to obtain the installation time, average daily traffic, and number of violations for each APP;

[0073] The user analysis unit is used to obtain the user's APP usage records, download sources, and authorization levels;

[0074] The regulatory unit is used to centrally monitor APP data and calculate risk coefficients based on the risk level of each APP to determine the intensity of supervision.

[0075] The call interception module is used to monitor the interface calls between the APP and the network library, obtain and intercept the API functions called by the target APP, and swap the IMP pointed to by its SEL by hooking the OC method, so that SEL points to the IMP of the monitoring unit.

[0076] The call interception module includes: a traffic capture unit and a function switching unit;

[0077] The traffic capture unit is used to acquire and intercept API functions called by the target APP;

[0078] The function swapping unit is used to swap the IMP pointed to by SEL in the API function, so that the corresponding SEL points to the IMP of the monitoring unit.

[0079] The traffic copying module is used to inject port-level collision detection code into the traffic data packets sent by the APP and make a copy of them;

[0080] The traffic replication module includes: a code injection unit and a data packet replication unit;

[0081] The code injection unit is used to inject port-level collision detection code into the traffic data packets sent by the APP;

[0082] The data packet copying unit is used to copy traffic data packets.

[0083] The link forwarding module is used to mark two traffic data packets with the same timestamp, one of which is sent normally to the target server, and the other is handed over to the proxy server for forwarding to the target server.

[0084] The link forwarding module includes: a certificate identification unit, a time stamping unit, and a proxy forwarding unit;

[0085] The certificate identification unit is used to identify the certificate of the target server and refuse access to servers with incorrect certificates, expired certificates, or no certificates.

[0086] The time stamping unit is used to add a time stamp to the two traffic data packets;

[0087] The proxy forwarding unit is used to send two traffic data packets separately, one sent normally and the other forwarded by the proxy server.

[0088] The risk restriction module is used to determine whether the two returned data are the same, identify the APP's forwarding behavior, and impose restrictions on it.

[0089] The risk restriction module includes: a return comparison unit and an application restriction unit;

[0090] The return comparison unit is used to obtain the encrypted return data of two traffic data packets, compare the two return data, and confirm whether they are the same.

[0091] The application restriction unit is used to determine that the APP has a forwarding risk when it detects that the returned data is different, and to impose traffic restrictions on it.

[0092] like Figure 2 As shown, a communication security monitoring method based on big data includes the following steps:

[0093] S100. Analyze the risk level of each APP based on its application information and user behavior, and determine the monitoring frequency of each APP based on the risk level;

[0094] Step S100 includes:

[0095] Step S101. Obtain application information for each APP from the logs. The application information includes: APP installation time, average daily traffic, and number of violations.

[0096] Step S102. Obtain user behavior information, including: APP usage records, download source, and authorization level;

[0097] Step S103. Determine the risk coefficient N for each APP. The risk coefficient of the APP is calculated using the following formula:

[0098]

[0099] Where N is the risk coefficient of the APP, D is the risk coefficient of the download source, E is the total number of APP violations, T is the number of days the APP has been installed on the phone, S is the average daily traffic of the APP, k is the number of times the user uses the APP, i is the record number of the user's APP usage, and Vi is the usage time of the user's i-th APP usage in the record. All of the above parameters are greater than 0.

[0100] The monitoring frequency V of the monitoring unit is determined by the risk coefficient of the APP, where V = N·V0, and V0 is a monitoring constant preset by the system, with V rounded up.

[0101] The regulatory unit will monitor each APP according to the monitoring frequency, and will execute steps S200-S500 in sequence during the monitoring process.

[0102] S200. Perform APP supervision, monitor the interface calls between the APP and the network library, obtain and intercept the API functions called by the target APP, and exchange the IMP pointed to by its SEL by hooking the OC method, so that SEL points to the IMP of the supervision unit;

[0103] Step S200 includes:

[0104] Step S201. Reverse engineer the application being tested to obtain its runtime calls to system functions, configure middleware and traffic analysis tools, monitor the interface calls between the target APP and the network library, and intercept the API functions called by the target APP at the interface.

[0105] Step S202. Modify the return value of the API function, dequeue the individual API function to bypass the verification mechanism of the target application's two-way verification communication interface, and re-enqueue the API function after the API function is redirected.

[0106] Step S203. After the API function is dequeued, the API execution result is changed using API Hook technology. The execution of the system's API function is redirected, and the IMP pointed to by its SEL is changed so that the SEL points to the IMP of the regulatory unit.

[0107] S300. Modify the monitoring system's IMP, inject port-level collision detection code into the traffic data packets sent by the APP, and copy the traffic data packets;

[0108] Step S300 includes:

[0109] Step S301. Set the IMP of the monitoring system so that the API function returns a port-level collision detection code after pointing to the IMP of the monitoring unit, and injects it into the traffic data packet sent by the APP;

[0110] Step S302. The target APP conducts network communication and encrypts the traffic data packets via HTTPS. After the monitoring unit obtains the encrypted traffic data packets, it makes a copy of them as is, resulting in two encrypted traffic data packets.

[0111] S400 verifies the target server's certificate. After successful verification, the monitoring unit adds the same timestamp to the two traffic data packets. One packet is sent to the target server normally, and the other is forwarded to the target server via the proxy server. When forwarding occurs, the two traffic data packets collide at the forwarding port of the target server, resulting in data discrepancies.

[0112] Step S400 includes:

[0113] Step S401. Verify the certificate of the target server communicating with the APP. If the target server certificate is valid and trusted, proceed to step S402; otherwise, determine that the APP has violated regulations and proceed to step S502.

[0114] Step S402. The monitoring unit accesses the proxy server, sends a proxy request, and provides the domain name address of the target server. After receiving the request, it establishes a new access link from the proxy server to the target server.

[0115] Step S403. Add a timestamp to the two traffic data packets and send them separately. One traffic data packet is delivered to the target server normally, while the other traffic data packet is forwarded by the access link between the proxy server and the target server and delivered to the target server.

[0116] Step S404. Based on the timestamp on the traffic data packet, the target server will simultaneously decrypt the two traffic data packets. If there is no forwarding request in the traffic data packet, the server will obtain the data locally and transmit the returned data to the user's mobile phone and the proxy server respectively from the two communication ports. The port-level collision detection code is not activated, and the returned data is the same. If there is a forwarding request in the traffic data packet, the two data packets will be queued at the forwarding communication port, the port-level collision detection code will be activated, and the returned data will be different.

[0117] S500. After the traffic data packet is returned, the regulatory unit determines whether the two returned data are the same, thereby identifying the APP's forwarding behavior and taking risk control measures.

[0118] Step S500 includes:

[0119] Step S501. After receiving the return data packet from the target server and the return data packet from the proxy server, the monitoring unit compares the two data packets. If the contents of the two return data packets are the same, it is determined that the APP has no violations. If the contents of the two return data packets are different, it is determined that the APP has violations.

[0120] Step S502. After the APP commits a violation, the APP's traffic communication is suspended, and the APP's risk coefficient is re-determined according to the formula in step S103, denoted as N2. If N-N2>r, the APP's authorization level is reduced by one level, where r is the trust reduction threshold preset by the system, and both N2 and r are constants greater than 0. Example

[0121] An app, denoted as application A, exists on a user's phone. The system detected that application A was downloaded 20 days ago, with an average daily data usage of 0.5Gb. The user used the app for a total of 24 hours. The risk coefficient of the download source is 0.1, and there were 2 violations. What is its risk coefficient? =0.2, regulatory constant V0=200, then regulatory frequency V=40 times / day.

[0122] The monitoring unit monitors application A, observes the interface calls between the APP and the network library, obtains the browsing history API called by application A in the system library, modifies the return value of the API function so that the SEL in the API function points to the monitoring unit's IMP, and injects port-level collision code into the traffic data packets sent to application A.

[0123] The supervisory unit verifies whether the server communicating with application A is trusted. After completing the certificate verification, it copies the traffic data packets sent by application A into two copies. One traffic data packet is delivered to the target server normally, and the other traffic data packet is forwarded by the access link between the proxy server and the target server and delivered to the target server.

[0124] The monitoring unit receives the returned data from the target server and the proxy server, compares the two sets of returned data, finds a discrepancy, and determines that application A has engaged in illegal forwarding behavior. Therefore, it suspends the traffic communication of application A and recalculates the risk coefficient of application A, obtaining a new risk coefficient N2=0.25. Since r=0.4, the authorization level of the APP is reduced by one level.

[0125] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0126] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A communication security monitoring method based on big data, characterized in that, The method includes the following steps: S100. Analyze the risk level of each APP based on its application information and user behavior, and determine the monitoring frequency of each APP based on the risk level; S200. Perform APP supervision, monitor the interface calls between the APP and the network library, obtain and intercept the API functions called by the target APP, and exchange the IMP pointed to by its SEL by hooking the OC method, so that SEL points to the IMP of the supervision unit; S300. Modify the IMP of the monitoring unit, inject port-level collision detection code into the traffic data packets sent by the APP, and copy the traffic data packets; S400 verifies the target server's certificate. After successful verification, the monitoring unit adds the same timestamp to the two traffic data packets. One packet is sent to the target server normally, and the other is forwarded to the target server via the proxy server. When forwarding occurs, the two traffic data packets collide at the forwarding port of the target server, resulting in data discrepancies. S500. After the traffic data packet is returned, the monitoring unit determines whether the two returned data are the same, thereby identifying the APP's forwarding behavior and taking risk control measures against it; Step S200 includes: Step S201. Reverse engineer the application being tested to obtain its runtime calls to system functions, configure middleware and traffic analysis tools, monitor the interface calls between the target APP and the network library, and intercept the API functions called by the target APP at the interface. Step S202. Modify the return value of the API function, dequeue the individual API function to bypass the verification mechanism of the target application's two-way verification communication interface, and re-enqueue the API function after the API function is redirected. Step S203. After the API function is dequeued, the API execution result is changed using API Hook technology. The execution of the system's API function is redirected, and the IMP pointed to by its SEL is changed so that SEL points to the IMP of the regulatory unit. Step S300 includes: Step S301. Set the IMP of the monitoring unit so that the API function returns a port-level collision detection code after pointing to the IMP of the monitoring unit and injects it into the traffic data packet sent by the APP. When the same code is detected in the same communication port, the port-level collision detection code will change its own order. Step S302. The target APP conducts network communication and encrypts the traffic data packets via HTTPS. After the monitoring unit obtains the encrypted traffic data packets, it makes a copy of them as is, resulting in two encrypted traffic data packets.

2. The communication security monitoring method based on big data according to claim 1, characterized in that: Step S100 includes: Step S101. Obtain application information for each APP from the logs. The application information includes: APP installation time, average daily traffic, and number of violations. Step S102. Obtain user behavior information, including: APP usage records, download sources and authorization levels, and preset the risk coefficient for each download source in the system; Step S103. Determine the risk coefficient N of the APP, which is calculated using the following formula: ； Where N is the risk coefficient of the APP, D is the risk coefficient of the download source, E is the total number of violations of the APP in the history, T is the number of days the APP has been installed on the phone, S is the average daily traffic of the APP, k is the total number of times the user uses the APP after downloading the application, and Vi is the usage time of the user when using the APP for the ith time in the record. All of the above parameters are greater than 0. The monitoring frequency V is determined by the risk coefficient of the APP, where V = N·V0, and V0 is a monitoring constant representing the monitoring intensity preset by the system. The monitoring unit will monitor each APP according to the monitoring frequency. During the monitoring process, steps S200-S500 will be executed sequentially. The monitoring unit is a monitoring program in the mobile phone system, which is used to realize centralized monitoring of APP data.

3. The communication security monitoring method based on big data according to claim 2, characterized in that: Step S400 includes: Step S401. Verify the certificate of the target server communicating with the APP. If the target server certificate is valid and trusted, proceed to step S402; otherwise, determine that the APP has violated regulations and proceed to step S502. Step S402. The monitoring unit accesses the proxy server, sends a proxy request, and provides the domain name address of the target server. After receiving the request, it establishes a new access link from the proxy server to the target server. Step S403. Add a timestamp to the two traffic data packets and send them separately. One traffic data packet is delivered to the target server normally, while the other traffic data packet is forwarded by the access link between the proxy server and the target server and delivered to the target server. Step S404. Based on the timestamp on the traffic data packets, the target server will simultaneously decrypt both traffic data packets; If there is no forwarding request in the traffic data packet, the server will obtain the data locally and transmit the returned data to the user's mobile phone and the proxy server respectively from two communication ports. The port-level collision detection code is not activated, and the returned data is the same. If there is a forwarding request in the traffic data packet, the two data packets will be queued at the forwarding communication port, the port-level collision detection code will be activated, and the returned data will be different.

4. The communication security monitoring method based on big data according to claim 3, characterized in that: Step S500 includes: Step S501. After receiving the return data packet from the target server and the return data packet from the proxy server, the monitoring unit compares the two data packets. If the contents of the two return data packets are the same, it is determined that the APP has no violations. If the contents of the two return data packets are different, it is determined that the APP has violations. Step S502. After the APP commits a violation, the APP's traffic communication is suspended, and the APP's risk coefficient is re-determined according to the formula in step S103, denoted as N2. If N-N2>r, the APP's authorization level is reduced by one level, where r is the trust reduction threshold preset by the system, and both N2 and r are constants greater than 0.

5. A communication security monitoring system based on big data, characterized in that, The system includes the following modules: a monitoring and control module, a call interception module, a traffic replication module, a link forwarding module, and a risk restriction module; The monitoring and control module is used to analyze the risk level of each APP through big data and adjust the level of supervision accordingly. The call interception module is used to monitor the interface calls between the APP and the network library, obtain and intercept the API functions called by the target APP, and swap the IMP pointed to by its SEL by hooking the OC method, so that SEL points to the IMP of the monitoring unit. The traffic copying module is used to inject port-level collision detection code into the traffic data packets sent by the APP and make a copy of them; The link forwarding module is used to mark two traffic data packets with the same timestamp, one of which is sent normally to the target server, and the other is handed over to the proxy server for forwarding to the target server. The risk restriction module is used to determine whether the two returned data are the same, identify the APP's forwarding behavior, and restrict it. The traffic replication module includes: a code injection unit and a data packet replication unit; The code injection unit is used to inject port-level collision detection code into the traffic data packets sent by the APP; The data packet copying unit is used to copy traffic data packets; The link forwarding module includes: a certificate identification unit, a time stamping unit, and a proxy forwarding unit; The certificate identification unit is used to identify the certificate of the target server and refuse access to servers with incorrect certificates, expired certificates, or no certificates. The time stamping unit is used to add a time stamp to the two traffic data packets; The proxy forwarding unit is used to send two traffic data packets separately: one is sent normally, and the other is forwarded by the proxy server.

6. The communication security monitoring system based on big data according to claim 5, characterized in that: The monitoring and control module includes: an application behavior unit, a user analysis unit, and a supervision unit; The application behavior unit is used to obtain the installation time, average daily traffic, and number of violations for each APP; The user analysis unit is used to obtain the user's APP usage records, download sources, and authorization levels; The regulatory unit is used to centrally monitor APP data and calculate risk coefficients based on the risk level of each APP to determine the intensity of supervision.

7. A communication security monitoring system based on big data according to claim 6, characterized in that: The call interception module includes: a traffic capture unit and a function switching unit; The traffic capture unit is used to acquire and intercept API functions called by the target APP; The function swapping unit is used to swap the IMP pointed to by SEL in the API function, so that the corresponding SEL points to the IMP of the monitoring unit.

8. A communication security monitoring system based on big data according to claim 7, characterized in that: The risk restriction module includes: a return comparison unit and an application restriction unit; The return comparison unit is used to obtain the encrypted return data of two traffic data packets, compare the two return data, and confirm whether they are the same. The application restriction unit is used to determine that the APP has a forwarding risk when it detects that the returned data is different, and to impose traffic restrictions on it.

Images