A system and method for risk detection and assessment based on intelligent terminal

Abstract

The present invention belongs to the field of smart terminal technology, and specifically relates to a system and method for risk detection and assessment based on smart terminals. The invention can realize real-time monitoring and risk detection of smart terminals, timely discover potential security issues, and avoid losses. Through multi-dimensional data analysis and parameter calculation, the security risks of smart terminals can be more accurately assessed. Through multi-level data collection and analysis, the potential risks of smart terminals can be more accurately identified, and the false alarm rate can be reduced. Combined with application software data, user behavior data, and system log data for comprehensive analysis, it can fully understand the source of risks and influencing factors. Different risk levels correspond to different protective measures, and personalized security suggestions and solutions can be provided to users. Through early detection and handling of risks, the overall security of smart terminals can be significantly improved, and user privacy and data security can be protected.

Description

Technical Field

[0001] The present invention belongs to the technical field of intelligent terminals, and in particular relates to a system and method for risk detection and assessment based on intelligent terminals. Background Art

[0002] With the rapid development of information technology, smart terminal devices such as smart phones, tablet computers, and car terminals have been widely used in people's daily lives and work. These smart terminal devices provide people with convenient communication, entertainment, payment and other functions, and also carry important data such as users' personal information and property. However, at the same time, the large amount of local operation data generated by smart terminals during daily use also brings potential security risks. These operation data include system performance data, application usage data, network connection data, etc. These data may hide security risks such as system anomalies, application risks, and abnormal user behavior.

[0003] The existing technologies for security risk assessment of smart terminals are often too simple and one-sided, lacking comprehensive processing and in-depth mining of multi-dimensional data, and only based on certain single indicators or parameters for judgment, ignoring the complexity and diversity of smart terminal security risks. This simple risk assessment method not only fails to accurately reflect the real security status of smart terminals, but may also lead to users' lack of understanding of security risks, thereby increasing the risk of smart terminals being attacked or data leaked. Summary of the invention

[0004] The purpose of the present invention is to provide a risk detection and assessment method based on smart terminals, which can provide a comprehensive and effective security risk detection and assessment mechanism for smart terminals through systematic data collection, analysis and evaluation, thereby helping to improve the overall security of smart terminals.

[0005] The technical solution adopted by the present invention is as follows:

[0006] A method for risk detection and assessment based on an intelligent terminal, comprising:

[0007] Acquire local operation data of the smart terminal, and extract system operation data each time the smart terminal is operated from the local operation data;

[0008] Determine whether the system operation data is within the standard system operation evaluation range. If not, mark it as abnormal system operation data.

[0009] Obtain similar system operation parameters based on abnormal system operation data;

[0010] Determine whether the system operation similarity parameters are within the standard system operation similarity assessment range. If not, mark it as a risky intelligent terminal;

[0011] Obtain application software data, user behavior data, and system log data corresponding to abnormal system operation data in risk intelligent terminals;

[0012] Calculate deviation-related parameters based on application software data, user behavior data, and system log data;

[0013] The security risk level of the smart terminal is determined based on deviation-related parameters and similar system operation parameters.

[0014] In a preferred solution, the step of obtaining local operation data of the smart terminal and extracting system operation data each time the smart terminal is operated from the local operation data includes:

[0015] Get the data collection frequency of the smart terminal;

[0016] Determine the collection interval according to the data collection frequency, and establish multiple collection nodes according to the collection interval;

[0017] Collect local operation data in each collection node;

[0018] Extract the system operation data of each intelligent terminal operation from the local operation data.

[0019] In a preferred solution, the step of determining whether the system operation data is within the standard system operation evaluation interval, and if not, marking it as abnormal system operation data, comprises:

[0020] Obtain the standard system operation evaluation interval;

[0021] Determine whether the system operation data is within the standard system operation evaluation range;

[0022] If the system operation data is within the standard system operation evaluation range, it means that the system operation data is normal;

[0023] If the system operation data is not within the standard system operation evaluation range, it indicates that the system operation data is abnormal and is marked as abnormal system operation data.

[0024] In a preferred embodiment, the step of obtaining system operation similar parameters according to abnormal system operation data includes:

[0025] Obtaining system operation data from local operation data corresponding to abnormal system operation data, and marking it as local system data;

[0026] Obtaining system operation data in the cloud operation data corresponding to the abnormal system operation data, and marking it as cloud system data;

[0027] Get the system to run similar functions;

[0028] Obtain corresponding local system parameters according to local system data;

[0029] Obtain corresponding cloud system parameters based on cloud operation data;

[0030] The local system parameters and the cloud system parameters are input into the system operation similarity function, and the output results are marked as the system operation similarity parameters.

[0031] In a preferred solution, the step of determining whether the system operation similarity parameter is within the standard system operation similarity evaluation interval, and if not, marking it as a risky intelligent terminal, comprises:

[0032] Obtain similar evaluation intervals for standard system operation;

[0033] Determine whether the system operation similarity parameters are within the standard system operation similarity evaluation range;

[0034] If the system operation similarity parameters are within the standard system operation similarity assessment range, the smart terminal is determined to be safe;

[0035] If the system operation similarity parameters are not within the standard system operation similarity assessment range, the smart terminal is judged to have a security risk and is marked as a risky smart terminal.

[0036] In a preferred embodiment, the step of calculating deviation-related parameters based on application software data, user behavior data and system log data includes:

[0037] Build a computing cycle;

[0038] Obtain the time length of parameter collection according to the calculation cycle;

[0039] According to the time length, application software parameters, user behavior parameters and system log parameters are obtained from the application software data, user behavior data and system log data respectively;

[0040] Get the deviation correlation function;

[0041] Application software parameters, user behavior parameters, and system log parameters are input into the deviation-related function, and the output results are marked as deviation-related parameters.

[0042] In a preferred solution, the step of determining the security risk level of the smart terminal according to the deviation-related parameters and the system operation similarity parameters includes:

[0043] Calculate safety risk parameters based on deviation-related parameters and system operation similarity parameters;

[0044] Obtaining a security risk level table, wherein the security risk level table includes a plurality of security risk intervals and a security risk level corresponding to each security risk interval;

[0045] Obtain the corresponding target security risk interval according to the security risk parameters;

[0046] Obtain the corresponding security risk level from the security risk level table according to the target security risk range.

[0047] In a preferred embodiment, the step of calculating the safety risk parameter based on the deviation-related parameter and the system operation similarity parameter comprises:

[0048] Obtain security risk function;

[0049] Deviation-related parameters and system operation-similar parameters are input into the safety risk function, and the output results are marked as safety risk parameters.

[0050] The present invention also provides a system for risk detection and assessment based on a smart terminal, which is used in the above-mentioned method for risk detection and assessment based on a smart terminal, comprising:

[0051] A data collection module is used to obtain local operation data of the smart terminal and extract system operation data each time the smart terminal is operated from the local operation data;

[0052] The abnormality judgment module is used to judge whether the system operation data is within the standard system operation evaluation range. If not, it is marked as abnormal system operation data;

[0053] A similar module is used to obtain system operation similar parameters based on abnormal system operation data;

[0054] The risk judgment module is used to judge whether the system operation similarity parameters are within the standard system operation similarity assessment range. If not, it is marked as a risk intelligent terminal;

[0055] The risk data module is used to obtain application software data, user behavior data and system log data corresponding to abnormal system operation data in the risk intelligent terminal;

[0056] Deviation module, used to calculate deviation-related parameters based on application software data, user behavior data and system log data;

[0057] The risk assessment module is used to determine the security risk level of the smart terminal based on deviation-related parameters and system operation similar parameters.

[0058] And, a terminal for risk detection and assessment based on an intelligent terminal, comprising:

[0059] one or more processors;

[0060] a storage device having one or more programs stored thereon;

[0061] When the one or more programs are executed by the one or more processors, the one or more processors implement the risk detection and assessment method based on the smart terminal.

[0062] The technical effects achieved by the present invention are:

[0063] The present invention can realize real-time monitoring and risk detection of smart terminals, timely discover potential security issues and avoid losses. Through multi-dimensional data analysis and parameter calculation, the security risks of smart terminals can be evaluated more accurately. Through multi-level data collection and analysis, the potential risks of smart terminals can be identified more accurately and the false alarm rate can be reduced. Comprehensive analysis based on application software data, user behavior data and system log data can fully understand the sources of risks and influencing factors. Different risk levels correspond to different protective measures, and personalized security suggestions and solutions can be provided to users. By discovering and handling risks at an early stage, the overall security of smart terminals can be significantly improved, and user privacy and data security can be protected. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 is a flow chart of the method provided by the present invention;

[0065] Figure 2 It is a system module diagram provided by the present invention. DETAILED DESCRIPTION

[0066] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0067] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0068] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure or characteristic that may be included in at least one implementation of the present invention. The phrase "in a preferred embodiment" that appears in different places in this specification does not refer to the same embodiment, nor is it a separate or selective embodiment that is mutually exclusive with other embodiments.

[0069] Secondly, the present invention is described in detail in conjunction with schematic diagrams. When describing the embodiments of the present invention in detail, for the convenience of explanation, the schematic diagrams are only examples and should not limit the scope of protection of the present invention.

[0070] Please refer to the attached Figure 1 As shown, a method for risk detection and assessment based on an intelligent terminal is provided, comprising:

[0071] S1. Obtain local operation data of the smart terminal, and extract system operation data each time the smart terminal is running from the local operation data;

[0072] S2, determining whether the system operation data is within the standard system operation evaluation range, and if not, marking it as abnormal system operation data;

[0073] S3. Acquire similar system operation parameters according to abnormal system operation data;

[0074] S4. Determine whether the system operation similarity parameters are within the standard system operation similarity assessment range. If not, mark it as a risk intelligent terminal;

[0075] S5. Obtain application software data, user behavior data, and system log data corresponding to abnormal system operation data in the risk intelligent terminal;

[0076] S6. Calculate deviation-related parameters based on application software data, user behavior data, and system log data;

[0077] S7. Determine the security risk level of the smart terminal based on the deviation-related parameters and system operation similar parameters.

[0078] As in the above steps S1 to S7, a large amount of local operation data will be generated by the smart terminal during daily use, including system performance data, application usage data, network connection data, etc. By extracting the system operation data each time the smart terminal is running, a data set can be formed for subsequent analysis, and the obtained system operation data is compared with a pre-set standard interval. If the data is not within the normal range, it is marked as abnormal data. For example, when the CPU usage rate, memory usage rate, etc. exceed a certain threshold, it can be considered as an abnormal situation. Some key parameters are extracted from the abnormal system operation data. These parameters can reflect the characteristics of the system operation. For example, the specific application and network request characteristics when the abnormal situation occurs are extracted, and the extracted system operation data are used as the basis for the analysis. The similar parameters of the line are compared with the standard evaluation interval. If they are not within the normal range, they are marked as risky intelligent terminals. For example, if a specific application frequently changes its network access in a short period of time, it may indicate that the application is risky. More detailed operation data, including the specific behavior of the application, such as the accessed API interface, user operation records, system logs, etc., are collected for more in-depth analysis. Deviation-related parameters of various data are calculated. These parameters can help identify abnormal patterns in system operation. For example, sudden changes in user behavior, such as frequent installation and uninstallation of applications, may indicate that the terminal has security risks. Combined with all the collected data, the security risk level of the intelligent terminal is calculated through an algorithm. Different risk levels can correspond to different security measures. Risk levels can be divided into low, medium, and high levels to indicate the security status of the terminal. For example, based on the risk level, users can be advised to update the system, uninstall suspicious applications, or even reset the system. Suppose a smartphone has an abnormality during operation, and the system operation data (such as CPU usage) exceeds the normal range and is marked as abnormal data. The system operation parameters similar to the abnormal situation are extracted (such as an abnormal network request of an application). It is found that the parameter is also not within the normal range. The smartphone is further marked as a risky smart terminal. The detailed data of the terminal is obtained, including the access records of the application, the user's operation behavior and the system log, and the deviation-related parameters are calculated (such as the user frequently downloads multiple applications in a short period of time, and these Applications have similar abnormal behaviors), and all parameters are combined to determine that the risk level of the terminal is high. Users are advised to update the system and uninstall risky applications. This can achieve real-time monitoring and risk detection of smart terminals, timely discover potential security issues and avoid losses. Through multi-dimensional data analysis and parameter calculation, the security risks of smart terminals can be more accurately assessed. Through multi-level data collection and analysis, the potential risks of smart terminals can be more accurately identified and the false alarm rate can be reduced. Combined with application software data, user behavior data and system log data for comprehensive analysis, we can fully understand the source of risks and influencing factors. Different risk levels correspond to different protection measures, and can provide users with personalized security suggestions and solutions.By discovering and handling risks early, the overall security of smart terminals can be significantly improved, protecting user privacy and data security.

[0079] The step of obtaining local operation data of the smart terminal and extracting system operation data each time the smart terminal is running from the local operation data includes:

[0080] S101, obtaining the data collection frequency of the smart terminal;

[0081] S102, determining a collection interval according to a data collection frequency, and establishing a plurality of collection nodes according to the collection interval;

[0082] S103, collecting local operation data in each collection node;

[0083] S104: Extracting system operation data each time the smart terminal is operated from the local operation data.

[0084] As in the above steps S101 to S104, the data collection frequency of the smart terminal is determined, that is, how often data is collected. The data collection frequency can be configured according to system requirements and resource conditions, such as once per second, once per minute, etc. According to the determined data collection frequency, the time interval for data collection is calculated. During the entire operation cycle, multiple data collection nodes are established according to the calculated collection interval. Each collection node is a predetermined time point for timing triggering the data collection process. At each collection node, local operation data of the smart terminal is collected. The local operation data includes system performance indicators (such as CPU usage, memory usage), hardware status (such as battery power), network activity, etc. The system operation data of each time the smart terminal is running is extracted from the collected local operation data. These system operation data reflect the specific operation status of the smart terminal at each collection node. Subsequent risk detection and assessment can fine-tune the monitoring of the operating status of smart terminals by setting a reasonable data collection frequency and interval. Frequent collection can provide more fine-grained data to help identify abnormal situations more accurately. Regular data collection can monitor the terminal status in real time and respond promptly when abnormalities occur. This real-time nature helps to quickly discover and deal with security risks and reduce potential hazards. Reasonable data collection frequency and interval can reduce the occupation of system resources while ensuring monitoring effects, help balance the relationship between the comprehensiveness of data collection and system performance, and avoid excessive burden on the system due to excessive collection. By establishing multiple collection nodes, the continuity and integrity of data collection can be ensured. Complete operating data can more comprehensively reflect the operating status of the system and improve the accuracy of risk assessment. The collected and extracted system operation data provides basic data support for subsequent risk detection and assessment.

[0085] The step of determining whether the system operation data is within the standard system operation evaluation interval, and if not, marking it as abnormal system operation data, comprises:

[0086] S201, obtaining a standard system operation evaluation interval;

[0087] S202, determining whether the system operation data is within the standard system operation evaluation range;

[0088] If the system operation data is within the standard system operation evaluation range, it means that the system operation data is normal;

[0089] If the system operation data is not within the standard system operation evaluation range, it indicates that the system operation data is abnormal and is marked as abnormal system operation data.

[0090] As in the above steps S201 to S202, the evaluation standard interval of system operation is obtained from a predefined standard library or through historical data analysis. The interval is usually set based on the operating indicator range of the intelligent terminal system under normal circumstances, such as CPU usage between 10%-50%, memory usage between 20%-70%, etc. The current system operation data is compared with the standard system operation evaluation interval. If the system operation data is within this interval, it is considered that the system is operating normally. If the system operation data exceeds this interval, it is considered that the system is operating abnormally. The system operation data judged to be abnormal is marked for subsequent processing. The marked data will be recorded for further analysis and processing. The predefined standard system operation evaluation interval can effectively distinguish Normal and abnormal system operation status, the standard interval is set based on historical data and experience values ​​to ensure the accuracy and reliability of the evaluation. Through simple interval comparison, the normal or abnormal state of the system operation data can be quickly judged, which simplifies the complexity of anomaly detection, improves detection efficiency, and judges the system operation data in real time. It can mark and process abnormal situations immediately when they occur, improves the response speed to potential risks, and reduces safety hazards. The marked abnormal system operation data provides a basis for subsequent analysis, which can be used to further analyze the causes of abnormalities, take corrective measures, and optimize system operation. The standard system operation evaluation interval can be dynamically adjusted according to actual conditions and historical data, so that the evaluation standards can adapt to the system operation conditions under different environments and conditions, and improve applicability.

[0091] The step of obtaining system operation similar parameters according to abnormal system operation data includes:

[0092] S301, obtaining system operation data in local operation data corresponding to abnormal system operation data, and marking it as local system data;

[0093] S302, obtaining system operation data in the cloud operation data corresponding to the abnormal system operation data, and marking it as cloud system data;

[0094] S303, obtaining a system running similar function;

[0095] S304, acquiring corresponding local system parameters according to local system data;

[0096] S305, obtaining corresponding cloud system parameters according to cloud operation data;

[0097] S306: Input the local system parameters and the cloud system parameters into the system operation similarity function, and mark the output result as the system operation similarity parameter.

[0098] As in the above steps S301 to S306, system operation data corresponding to the abnormal system operation data is extracted from the local operation data and marked as local system data. These data include the specific operation status of the smart terminal when the abnormal event occurs, such as CPU usage, memory usage, etc. System operation data corresponding to the abnormal system operation data is extracted from the data stored in the cloud and marked as cloud system data. The cloud system data may include system operation data of similar devices or similar environments collected through the cloud monitoring and analysis platform. A system operation similarity function is defined to calculate the similarity between the local system data and the cloud system data. The similarity function can be based on a variety of algorithms, such as Euclidean distance, cosine similarity, etc. The expression of the system operation similarity function is: In the formula, S represents the system operation similarity parameter, i represents the number of local operation parameters and the number of cloud operation parameters, n represents the total number of local operation parameters and the total number of cloud operation parameters, L i Represented as the i-th local operation parameter, C iIt is expressed as the i-th cloud operation parameter. According to the local system data, the corresponding system parameters are extracted. These parameters reflect the operation characteristics of the local system. For example, specific indicators such as CPU usage, memory usage, and network traffic when an abnormal event occurs. According to the cloud system data, the corresponding system parameters are extracted. These parameters reflect the operation characteristics of the cloud system. The cloud system parameters can be operation characteristic data extracted from similar devices or environments. The local system parameters and the cloud system parameters are input into the system operation similarity function. The system operation similarity function calculates the similarity between the two parameter sets and marks the output results as system operation similarity parameters. By combining local and cloud data, a more comprehensive system operation status evaluation is provided. This comprehensive evaluation can be more accurate. Accurately reflect the actual cause and impact of abnormal situations. By using the system to run similar functions, the similarity between local system data and cloud system data can be quantified. Accurate similarity calculation helps to identify abnormal patterns and improve detection accuracy. The combination of local and cloud data enables the smart terminal system to conduct more extensive data comparison and analysis. This comparative analysis helps to discover hidden system problems and potential risks. By analyzing similar parameters, the system parts that need to be adjusted and optimized can be identified, and the system configuration and strategy can be dynamically adjusted to help improve overall stability and performance. Based on the analysis of similar parameters, potential system failures and problems of smart terminals can be predicted, and measures can be taken in advance to reduce the risk of system downtime and data loss of smart terminals.

[0099] The step of judging whether the system operation similarity parameter is within the standard system operation similarity evaluation interval, and if not, marking it as a risk intelligent terminal, comprises:

[0100] S401, obtaining a similarity evaluation interval for standard system operation;

[0101] S402, determining whether the system operation similarity parameter is within the standard system operation similarity evaluation range;

[0102] If the system operation similarity parameters are within the standard system operation similarity assessment range, the smart terminal is determined to be safe;

[0103] If the system operation similarity parameters are not within the standard system operation similarity assessment range, the smart terminal is judged to have a security risk and is marked as a risky smart terminal.

[0104] As in the above steps S401 to S402, a standard system operation similarity assessment interval is obtained from historical data, industry standards or preset safety standards. The interval defines the normal range of system operation similarity parameters, which is usually set based on statistical analysis and actual experience. The calculated system operation similarity parameters are compared with the standard system operation similarity assessment interval. If the system operation similarity parameters are within this standard interval, it means that the operating state of the smart terminal is similar to expectations and it is determined to be safe. If the system operation similarity parameters exceed this standard interval, it means that the operating state of the smart terminal is abnormal and there is a potential safety risk. The smart terminal judged to be unsafe is marked and the relevant information is recorded for subsequent processing and analysis. The marked terminal may require further safety inspections, troubleshooting and treatment measures. Standard The system runs a similar evaluation interval, which can accurately determine whether the operating status of the smart terminal is normal, effectively distinguish normal fluctuations from abnormal situations, and improve the accuracy of detection. By real-time judgment and marking of abnormal terminals, potential security risks can be quickly identified. Rapid response helps to take timely measures to reduce security risks and losses. The use of standard system operation similar evaluation intervals provides a standardized risk assessment method that can be applied to different types of smart terminals and has a wide range of applicability. Through automated evaluation and marking processes, it reduces manual intervention, improves management efficiency, and can handle the security status of a large number of smart terminals more promptly and accurately. The standard interval can be dynamically adjusted and optimized according to actual operating conditions and historical data. By continuously optimizing the evaluation standards, the accuracy of risk detection and assessment can be improved.

[0105] The step of calculating deviation-related parameters based on application software data, user behavior data, and system log data includes:

[0106] S601, constructing a calculation cycle;

[0107] S602, obtaining the time length of parameter collection according to the calculation cycle;

[0108] S603, obtaining application software parameters, user behavior parameters and system log parameters from the application software data, user behavior data and system log data respectively according to the time length;

[0109] S604, obtaining a deviation-related function;

[0110] S605: Input application software parameters, user behavior parameters, and system log parameters into a deviation-related function, and mark the output result as a deviation-related parameter.

[0111] As in the above steps S601 to S605, a calculation cycle is determined for periodically evaluating and calculating deviation-related parameters. The length of the calculation cycle can be set according to specific application requirements and characteristics of the intelligent terminal system, such as every day, every hour or every minute. According to the determined calculation cycle, the time length of each data collection is defined. The time length determines the time range for collecting data within a cycle. For example, a one-hour calculation cycle corresponds to a one-hour data collection length. According to the time length, corresponding parameters are extracted from application software data, user behavior data and system log data. Application software parameters include application usage frequency, resource usage, abnormal crash records, etc. User behavior parameters include user operation records, accessed network resources, input and output behaviors, etc. System log parameters include system event logs, error logs, security logs, etc. A deviation-related function is defined to calculate the deviation between application software parameters, user behavior parameters and system log parameters. The deviation-related function can be based on statistical methods, machine learning algorithms, etc., and is used to quantify the degree of abnormality. The expression of the deviation-related function is: Where G represents the deviation-related parameter, a represents the number of application software parameters, user behavior parameters, and system log parameters, m represents the total number of application software parameters, user behavior parameters, and system log parameters, and X a Represented as the ath application software parameter, Y a Represented as the ath user behavior parameter, Z a It is represented as the ath system log parameter. The obtained application software parameters, user behavior parameters and system log parameters are input into the deviation-related function. The deviation-related function processes these inputs and marks the output results as deviation-related parameters for subsequent risk assessment and decision-making. By combining application software data, user behavior data and system log data, it provides multi-dimensional information coverage, which can more accurately reflect the actual operation status of the smart terminal. The deviation-related function can effectively detect abnormal deviations between parameters and identify potential security risks, which is helpful to timely discover and handle abnormal situations and improve the security of the smart terminal system. The calculation cycle and parameter collection time length can be dynamically adjusted according to actual needs to adapt to different application scenarios, so that the smart terminal system can flexibly respond to various changes and improve the robustness of the smart terminal system. Regular calculation and analysis of deviation-related parameters can help identify performance bottlenecks and optimization directions of the smart terminal system, improve user experience, and reduce resource waste. Based on the analysis of deviation-related parameters, predictive maintenance can be performed to identify and solve potential problems in advance, which can reduce smart terminal system failures and downtime and improve the stability of the smart terminal system.

[0112] The step of determining the security risk level of the smart terminal according to the deviation-related parameters and the system operation similar parameters includes:

[0113] S701. Calculate safety risk parameters based on deviation-related parameters and system operation similarity parameters;

[0114] S702, obtaining a security risk level table, wherein the security risk level table includes a plurality of security risk intervals and a security risk level corresponding to each security risk interval;

[0115] S703, obtaining a corresponding target security risk interval according to the security risk parameter;

[0116] S704. Obtain the corresponding security risk level from the security risk level table according to the target security risk range.

[0117] As in the above steps S701 to S704, the security risk parameter is calculated by combining the deviation-related parameters and the system operation similar parameters through a predefined formula or algorithm. The parameter comprehensively reflects the current security status of the smart terminal. Multiple security risk intervals and their corresponding security risk levels are obtained from a pre-set security risk level table. The security risk level table can be set based on historical data, industry standards or expert experience, covering multiple levels from low risk to high risk. The calculated security risk parameter is matched with the interval in the security risk level table to determine the interval where the security risk parameter is located, that is, the target security risk interval. According to the target security risk interval, the corresponding security risk level is extracted from the security risk level table. The security risk level is used to finally evaluate the security status of the smart terminal and determine whether further Security measures, combined with deviation-related parameters and system operation similar parameters, provide a comprehensive security risk assessment method that can more accurately reflect the actual security status of smart terminals. By using a preset security risk level table, standardization and systematization of risk assessment is achieved, which helps to make consistent risk judgments across different scenarios and devices. According to the security risk level table, risks can be clearly classified and clear risk assessment results can be provided, which helps to make quick decisions and take corresponding security measures. The security risk level table can be dynamically adjusted according to actual conditions and data analysis results, which can improve the flexibility and accuracy of the assessment method and adapt to the ever-changing security environment. Through automated calculation and matching, human intervention can be reduced, and automated security risk management of smart terminals can be achieved, which improves work efficiency and reduces human errors.

[0118] The step of calculating the safety risk parameter according to the deviation related parameter and the system operation similar parameter comprises:

[0119] S7011. Obtain security risk function;

[0120] S7012. Input the deviation-related parameters and system operation similar parameters into the safety risk function, and mark the output results as safety risk parameters.

[0121] As in the above steps S7011 to S7012, a security risk function is defined or obtained, and the function is used to combine deviation-related parameters and system operation similar parameters to calculate the overall security risk. The security risk function can be designed based on a variety of methods, such as linear combination, weighted average, machine learning model, etc. The expression of the security risk function is F=S / G, where F represents the security risk parameter. The deviation-related parameters and system operation similar parameters are input into the security risk function for calculation, and the calculation result is marked as the security risk parameter for use in subsequent steps. The security risk function combines the deviation-related parameters and system operation similar parameters to comprehensively consider risk factors in multiple dimensions, and can more comprehensively reflect the security status of the smart terminal and avoid the limitations of a single parameter evaluation. The security risk function can be customized and adjusted according to specific application requirements and actual conditions, allowing different application scenarios to use different function models to adapt to specific security assessment requirements. By using a reasonably designed security risk function, the accuracy of security risk assessment can be improved, potential security risks can be more accurately identified, the probability of misjudgment and missed judgment can be reduced, and the overall assessment efficiency can be improved.

[0122] Please refer to the attached Figure 2 As shown, the present invention also provides a system for risk detection and assessment based on a smart terminal, which is used for the above-mentioned method for risk detection and assessment based on a smart terminal, comprising:

[0123] A data collection module is used to obtain local operation data of the smart terminal and extract system operation data each time the smart terminal is operated from the local operation data;

[0124] The abnormality judgment module is used to judge whether the system operation data is within the standard system operation evaluation range. If not, it is marked as abnormal system operation data;

[0125] A similar module is used to obtain system operation similar parameters based on abnormal system operation data;

[0126] The risk judgment module is used to judge whether the system operation similarity parameters are within the standard system operation similarity assessment range. If not, it is marked as a risk intelligent terminal;

[0127] The risk data module is used to obtain application software data, user behavior data and system log data corresponding to abnormal system operation data in the risk intelligent terminal;

[0128] Deviation module, used to calculate deviation-related parameters based on application software data, user behavior data and system log data;

[0129] The risk assessment module is used to determine the security risk level of the smart terminal based on deviation-related parameters and system operation similar parameters.

[0130] As mentioned above, the data collection module establishes multiple collection nodes by setting the collection frequency and collection interval, so as to regularly collect the system operation data of each smart terminal operation. The abnormal judgment module compares the collected system operation data with the pre-set standard system operation evaluation interval. If the system operation data is not within the standard interval, it is marked as abnormal system operation data and recorded for subsequent processing. The similarity module extracts relevant local system data and cloud system data based on the abnormal system operation data, and evaluates the similarity between the abnormal system data and the normal system data by calculating the system operation similarity parameters. The risk judgment module compares the system operation similarity parameters with the standard system operation similarity evaluation interval. If the similarity parameters are not within the standard interval, the smart terminal is marked as a risk smart terminal. The risk data module collects the corresponding abnormal system operation data in the risk smart terminal and obtains the relevant application software data, user behavior data and system log data. The deviation module calculates the deviation related parameters based on the collected application software data, user behavior data and system log data. The deviation related parameters are used to quantify the abnormality of the smart terminal in different dimensions. The risk assessment module combines the deviation related parameters and the system operation similarity parameters and uses the security risk function to calculate the whole The system uses the security risk parameters of the system to determine the security risk level of the smart terminal according to the pre-set security risk level table, realizes the comprehensive collection of various types of data of the smart terminal, ensures the integrity and accuracy of the basic data for risk assessment, and covers multiple dimensions of data (system operation data, application software data, user behavior data, system log data) to make risk assessment more comprehensive. It realizes accurate detection of abnormal data through the standard system operation evaluation interval, quickly identifies abnormal data, and marks and processes it in time, effectively improving the security of the system. It uses the similarity between the system operation similar parameters to evaluate the similarity between data, identifies potential abnormal patterns, improves the accuracy of detection, effectively reduces false positives and false negatives, can dynamically judge the risk status of the smart terminal, and timely discover and mark the risk terminal, improving the real-time response capability and security management efficiency of the system. Through in-depth analysis of abnormal data and calculation of deviation-related parameters, it provides a detailed analysis of the security status of the smart terminal, which helps to locate specific security issues and guide subsequent security measures. By combining deviation-related parameters and system operation similar parameters, it comprehensively evaluates the security risks of smart terminals. Using security risk functions and risk level tables, it realizes standardized and systematic risk assessment and ensures the accuracy and consistency of the assessment results.

[0131] And, a terminal for risk detection and assessment based on an intelligent terminal, comprising:

[0132] one or more processors;

[0133] a storage device having one or more programs stored thereon;

[0134] When the one or more programs are executed by the one or more processors, the one or more processors implement the risk detection and assessment method based on the smart terminal.

[0135] The above is only a preferred embodiment of the present invention. It should be noted that, for those skilled in the art, several improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications should also be considered as the protection scope of the present invention. The structures, devices and operating methods not specifically described and explained in the present invention shall be implemented according to the conventional means in the art unless otherwise specified and limited.

Claims

1. A method for risk detection and assessment based on intelligent terminals, characterized in that: include: Acquire local operation data of the smart terminal, and extract system operation data each time the smart terminal is operated from the local operation data; Determine whether the system operation data is within the standard system operation evaluation range. If not, mark it as abnormal system operation data. Obtain similar system operation parameters based on abnormal system operation data; Determine whether the system operation similarity parameters are within the standard system operation similarity assessment range. If not, mark it as a risky intelligent terminal; Obtain application software data, user behavior data, and system log data corresponding to abnormal system operation data in risk intelligent terminals; Calculate deviation-related parameters based on application software data, user behavior data, and system log data; Determine the security risk level of the smart terminal based on deviation-related parameters and system operation similar parameters; The step of obtaining system operation similar parameters according to abnormal system operation data includes: Obtaining system operation data from local operation data corresponding to abnormal system operation data, and marking it as local system data; Obtain the system operation data in the cloud operation data corresponding to the abnormal system operation data, and mark it as cloud system data. The cloud system data includes the system operation data of the same type of equipment or in a similar environment collected through the cloud monitoring and analysis platform; Get the system to run similar functions; Obtain corresponding local system parameters according to local system data; Obtain corresponding cloud system parameters based on cloud system data; Input the local system parameters and the cloud system parameters into the system operation similarity function, and mark the output results as the system operation similarity parameters; The step of calculating deviation-related parameters based on application software data, user behavior data, and system log data includes: Build a computing cycle; Obtain the time length of parameter collection according to the calculation cycle; According to the time length, application software parameters, user behavior parameters and system log parameters are obtained from the application software data, user behavior data and system log data respectively; Get the deviation correlation function. The expression of the deviation correlation function is Where G represents the deviation-related parameter, a represents the number of application software parameters, user behavior parameters, and system log parameters, m represents the total number of application software parameters, user behavior parameters, and system log parameters, and X a Represented as the ath application software parameter, Y a Represented as the ath user behavior parameter, Z a Represented as the ath system log parameter; Application software parameters, user behavior parameters, and system log parameters are input into the deviation-related function, and the output results are marked as deviation-related parameters.

2. The method for risk detection and assessment based on intelligent terminals according to claim 1 is characterized in that: The step of obtaining local operation data of the smart terminal and extracting system operation data each time the smart terminal is running from the local operation data includes: Get the data collection frequency of the smart terminal; Determine the collection interval according to the data collection frequency, and establish multiple collection nodes according to the collection interval; Collect local operation data in each collection node; Extract the system operation data of each intelligent terminal operation from the local operation data.

3. The method for risk detection and assessment based on intelligent terminals according to claim 1 is characterized in that: The step of determining whether the system operation data is within the standard system operation evaluation interval, and if not, marking it as abnormal system operation data, comprises: Obtain the standard system operation evaluation interval; Determine whether the system operation data is within the standard system operation evaluation range; If the system operation data is within the standard system operation evaluation range, it means that the system operation data is normal; If the system operation data is not within the standard system operation evaluation range, it indicates that the system operation data is abnormal and is marked as abnormal system operation data.

4. The method for risk detection and assessment based on intelligent terminals according to claim 1, characterized in that: The step of judging whether the system operation similarity parameter is within the standard system operation similarity evaluation interval, and if not, marking it as a risk intelligent terminal, comprises: Obtain similar evaluation intervals for standard system operation; Determine whether the system operation similarity parameters are within the standard system operation similarity evaluation range; If the system operation similarity parameters are within the standard system operation similarity assessment range, the smart terminal is determined to be safe; If the system operation similarity parameters are not within the standard system operation similarity assessment range, the smart terminal is judged to have a security risk and is marked as a risky smart terminal.

5. The method for risk detection and assessment based on intelligent terminals according to claim 1, characterized in that: The step of determining the security risk level of the smart terminal according to the deviation-related parameters and the system operation similar parameters includes: Calculate safety risk parameters based on deviation-related parameters and system operation similarity parameters; Obtaining a security risk level table, wherein the security risk level table includes a plurality of security risk intervals and a security risk level corresponding to each security risk interval; Obtain the corresponding target security risk interval according to the security risk parameters; Obtain the corresponding security risk level from the security risk level table according to the target security risk range.

6. The method for risk detection and assessment based on intelligent terminals according to claim 5 is characterized in that: The step of calculating the safety risk parameter according to the deviation related parameter and the system operation similar parameter comprises: Obtain security risk function; Deviation-related parameters and system operation-similar parameters are input into the safety risk function, and the output results are marked as safety risk parameters.

7. A system for risk detection and assessment based on smart terminals, applied to the method for risk detection and assessment based on smart terminals according to any one of claims 1 to 6, characterized in that: include: A data collection module is used to obtain local operation data of the smart terminal and extract system operation data each time the smart terminal is operated from the local operation data; The abnormality judgment module is used to judge whether the system operation data is within the standard system operation evaluation range. If not, it is marked as abnormal system operation data; A similar module is used to obtain system operation similar parameters based on abnormal system operation data; The risk judgment module is used to judge whether the system operation similarity parameters are within the standard system operation similarity assessment range. If not, it is marked as a risk intelligent terminal; The risk data module is used to obtain application software data, user behavior data and system log data corresponding to abnormal system operation data in the risk intelligent terminal; Deviation module, used to calculate deviation-related parameters based on application software data, user behavior data and system log data; The risk assessment module is used to determine the security risk level of the smart terminal based on deviation-related parameters and system operation similar parameters.

8. A terminal for risk detection and assessment based on an intelligent terminal, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method for risk detection and assessment based on a smart terminal as described in any one of claims 1 to 6.

Images