Software Security Risk Management Method Based on Multi-Dimensional Behavior Analysis

Abstract

The present application provides a software security risk management method based on multi-dimensional behavior analysis, which relates to the technical field of software risk management and includes: obtaining a set of software historical request information; identifying a set of authorized request information; receiving first real-time request information; performing request collaborative behavior analysis on the first real-time request information to obtain a set of collaborative requests; inputting the first real-time request information and the set of collaborative requests into a software security risk assessment model to obtain a set of collaborative risk coefficients; fusing the set of collaborative risk coefficients and outputting a comprehensive collaborative risk coefficient; and the software making an authorization decision on the first real-time request information according to the comprehensive collaborative risk coefficient. Through the present application, the technical problem in the prior art that risk assessment is inaccurate due to the fact that most software security risk management is based on the comparison and risk analysis of single requests can be solved, the technical goal of multi-dimensional collaborative behavior analysis can be achieved, and the technical effect of effectively improving the accuracy and effectiveness of risk assessment can be achieved.

Description

Technical Field

[0001] This application relates to the technical field of software risk management, and in particular to a software security risk management method based on multi-dimensional behavior analysis. Background Art

[0002] Software security risk management refers to the process of identifying, assessing, mitigating, and controlling potential security risks in software systems, ensuring the security of software systems, preventing malicious attacks and data leaks, and protecting user information and system resources.

[0003] Currently, most existing software security risk management methods do not consider software risks generated under the multi-dimensional synergy, cannot comprehensively evaluate the risks of requests, and are prone to missing potential threats. And it is difficult to identify attacks and respond in a timely manner, resulting in the expansion of attacks, and it is difficult to adapt to changes in software environments and attack technologies, resulting in the failure of security policies. Therefore, there is a need for a method to solve the above problems.

[0004] In summary, there are technical problems in the prior art that due to most software security risk management being based on the comparison and risk analysis of a single request, the risk assessment is inaccurate, the early warning ability is insufficient, the security policy fails, and further security vulnerabilities are generated. Summary of the Invention

[0005] The purpose of this application is to provide a software security risk management method based on multi-dimensional behavior analysis to solve the technical problems in the prior art that due to most software security risk management being based on the comparison and risk analysis of a single request, the risk assessment is inaccurate, the early warning ability is insufficient, the security policy fails, and further security vulnerabilities are generated.

[0006] In view of the above problems, this application provides a software security risk management method based on multi-dimensional behavior analysis.

[0007] The present application provides a software security risk management method based on multi-dimensional behavior analysis, including: obtaining a set of historical request information of the software within a preset effective period; partitioning the set of historical request information to identify a set of authorized request information; receiving first real-time request information, where the first real-time request information includes a request purpose, a request address, a request information source, and a data packet type; performing request collaborative behavior analysis on the first real-time request information in the set of authorized request information to obtain a set of collaborative requests of the set of authorized request information, where a collaborative request is a request information having a collaborative behavior with the first real-time request information; inputting the first real-time request information and the set of collaborative requests into a software security risk assessment model to obtain a set of collaborative risk coefficients; fusing the set of collaborative risk coefficients to output a comprehensive collaborative risk coefficient corresponding to the first real-time request information; and the software making an authorization decision on the first real-time request information according to the comprehensive collaborative risk coefficient.

[0008] One or more technical solutions provided in the present application have at least the following technical effects or advantages:

[0009] By obtaining a set of historical request information of the software within a preset effective period; partitioning the set of historical request information to identify a set of authorized request information; receiving first real-time request information, where the first real-time request information includes a request purpose, a request address, a request information source, and a data packet type; performing request collaborative behavior analysis on the first real-time request information in the set of authorized request information to obtain a set of collaborative requests of the set of authorized request information, where a collaborative request is a request information having a collaborative behavior with the first real-time request information; inputting the first real-time request information and the set of collaborative requests into a software security risk assessment model to obtain a set of collaborative risk coefficients; fusing the set of collaborative risk coefficients to output a comprehensive collaborative risk coefficient corresponding to the first real-time request information; and the software making an authorization decision on the first real-time request information according to the comprehensive collaborative risk coefficient, the technical goal of multi-dimensional collaborative behavior analysis is achieved, and the technical effects of effectively improving the accuracy of risk assessment, enhancing the early warning ability, preventing security vulnerabilities, and ensuring the effectiveness of security policies are achieved.

[0010] The above description is only an overview of the technical solutions of the present application. In order to be able to understand the technical means of the present application more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features, and advantages of the present application more obvious and understandable, the following specifically describes the embodiments of the present application. It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present application, nor is it used to limit the scope of the present application. Other features of the present application will become easily understood through the following description. Description of the Drawings

[0011] To more clearly illustrate the technical solutions in the present application or the prior art, the following will briefly introduce the accompanying drawings required for use in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only exemplary. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can also be obtained based on the provided drawings.

[0012] Figure 1 It is a schematic flowchart of the software security risk management method based on multi-dimensional behavior analysis of the present application;

[0013] Figure 2 It is a schematic flowchart of the software in the software security risk management method based on multi-dimensional behavior analysis of the present application for making an authorization decision on the first real-time request information according to the comprehensive collaborative risk coefficient. Detailed implementation manners

[0014] By providing a software security risk management method based on multi-dimensional behavior analysis, the present application solves the technical problems in the prior art that due to most software security risk management being based on the comparison and risk analysis of single requests, the risk assessment is inaccurate, the early warning ability is insufficient, the security policy fails, and further security vulnerabilities are generated. The technical goal of realizing multi-dimensional collaborative behavior analysis is achieved, and the technical effects of effectively improving the accuracy of risk assessment, enhancing the early warning ability, preventing security vulnerabilities, and ensuring the effectiveness of security policies are achieved.

[0015] Next, the technical solutions in the present application will be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. It should be understood that the present application is not limited by the example embodiments described herein. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts belong to the scope of protection of the present application. Additionally, it should be noted that for the sake of description, only the parts related to the present application are shown in the accompanying drawings rather than all.

[0016] Embodiment, please refer to the attached Figure 1 , the present application provides a software security risk management method based on multi-dimensional behavior analysis, which specifically includes the following steps:

[0017] Step 1: Obtain the historical request information set of the software within a preset valid period.

[0018] Specifically, collect all the historical request information of the software within a preset valid period, including the detailed records of all requests initiated by the software in a previous period of time. Summarize the records into a set for subsequent analysis and processing.

[0019] Step 2: Divide the historical request information set to identify the authorized request information set.

[0020] Specifically, analyze and divide the historical request information set to identify the requests that have been authorized, that is, normal and permitted requests. The authorized request information will be marked as the benchmark for subsequent security risk assessment.

[0021] Step 3: Receive the first real-time request information, where the first real-time request information includes the request purpose, request address, request information source, and data packet type.

[0022] Specifically, when a new real-time request, that is, the first real-time request information, is received, process the first real-time request information. The first real-time request information includes the purpose of the request, the address of the request, the source of the request, and the type of the data packet, which is used to determine whether the request is secure.

[0023] Step 4: Conduct a request collaboration behavior analysis on the first real-time request information in the authorized request information set to obtain the collaboration request set of the authorized request information set, where the collaboration request is the request information that has a collaboration behavior with the first real-time request information.

[0024] Specifically, conduct a request collaboration behavior analysis on the first real-time request information to find the request information with similar characteristics to the first real-time request in the authorized request information set. Evaluate each record in the authorized request information set to determine whether there is a match with the first real-time request information in at least one collaboration behavior analysis dimension. The collaboration behavior analysis dimensions include aspects such as time, content, user, purpose, and device. If in any dimension, the authorized request information shows similarity or consistency with the first real-time request information, then the authorized request information will be identified as a collaboration request. Extract the collaboration request set from the authorized request information set, which contains all the request information that has a collaboration behavior with the first real-time request information in at least one analysis dimension. The collaboration request set provides important reference information for risk management, identifying the authorized requests with similar behaviors to the real-time request in historical data, thereby determining whether the real-time request conforms to the expected behavior pattern and whether it may pose a security risk.

[0025] Step 5: Input the first real-time request information and the collaboration request set into the software security risk assessment model to obtain the collaboration risk coefficient set.

[0026] Specifically, the first real-time request information and the collaborative request set are input into a software security risk assessment model to evaluate the potential risks posed by the request information to software security. The assessment model is a trained machine learning model that can predict risks based on the input request information features. After processing the input, the model outputs a collaborative risk coefficient set, which contains the risk assessment results for each request information, that is, the collaborative risk coefficient, quantifying the degree of risk brought by each request information to software security.

[0027] Step Six: Integrate the collaborative risk coefficient set and output the comprehensive collaborative risk coefficient corresponding to the first real-time request information.

[0028] Specifically, perform an integration process on the collaborative risk coefficients, synthesize multiple risk coefficients to obtain the comprehensive collaborative risk coefficient, which characterizes the overall risk corresponding to the first real-time request information. In the integration process, weight assignment for different risk types, statistical summary of risk coefficients, and comprehensive risk coefficient are considered.

[0029] Step Seven: The software makes an authorization decision on the first real-time request information based on the comprehensive collaborative risk coefficient.

[0030] Specifically, make an authorization decision based on the comprehensive collaborative risk coefficient. If the comprehensive collaborative risk coefficient is within the acceptable risk range, that is, less than or equal to the preset collaborative risk coefficient threshold, authorize the first real-time request information and allow the request to continue execution, indicating that the request is considered to conform to the normal behavior pattern and will not pose a major threat to software security. On the contrary, if the comprehensive collaborative risk coefficient is higher than the preset collaborative risk coefficient threshold, reject the authorization of the first real-time request information and block the execution of the request, indicating that the request may be abnormal or have potential security risks and is therefore not allowed to execute.

[0031] The software security risk management method based on multi-dimensional behavior analysis can achieve the technical goal of multi-dimensional collaborative behavior analysis, and achieve the technical effects of effectively improving the accuracy of risk assessment, enhancing the early warning ability, preventing security vulnerabilities, and ensuring the effectiveness of security policies.

[0032] Further, please refer to the appendix Figure 2 , this application also includes:

[0033] If the comprehensive collaborative risk coefficient is greater than the preset collaborative risk coefficient, the authorization of the first real-time request information passes; if the comprehensive collaborative risk coefficient is less than the preset collaborative risk coefficient, the authorization of the first real-time request information fails.

[0034] Specifically, when deciding whether to authorize the first real-time request information, the comprehensive collaborative risk coefficient is compared with the preset collaborative risk coefficient. The preset collaborative risk coefficient is a threshold value pre-set by the security manager according to the security policy and risk management strategy of the software, representing an acceptable risk level. If the comprehensive collaborative risk coefficient is greater than the preset collaborative risk coefficient, it means that the risk assessed by the request information exceeds the acceptable range, and the first real-time request information is not authorized. Rejecting the request triggers a security alarm.

[0035] On the contrary, if the comprehensive collaborative risk coefficient is less than or equal to the preset collaborative risk coefficient, it indicates that the risk assessed by the request information is within an acceptable range, and the first real-time request information is authorized. This means that there will be no threat to software security, and the request is allowed to continue.

[0036] By making authorization decisions, we ensure that risk-controlled requests are allowed to execute, thereby protecting the security and stability of the software system.

[0037] Furthermore, the present application also includes:

[0038] If any risk coefficient in the collaborative risk coefficient set is greater than the preset collaborative risk coefficient, the first real-time request information authorization is rejected.

[0039] Specifically, when deciding whether to authorize the first real-time request information, each risk factor in the collaborative risk factor set is checked. If any risk factor in the set is greater than the preset collaborative risk factor, it means that the risk assessed by the request information exceeds the acceptable range in at least one risk dimension, and then the first real-time request information is not authorized, that is, the request is rejected to trigger a security alarm to prevent potential security threats.

[0040] This provides a higher level of protection for software security by ensuring that only requests that are within acceptable ranges on all risk dimensions are allowed to execute.

[0041] Furthermore, the present application also includes:

[0042] Perform request collaborative behavior analysis on the first real-time request information and the authorized request information set respectively, wherein the factors of the collaborative behavior analysis include time collaborative analysis, content collaborative analysis, user collaborative analysis, purpose collaborative analysis and device collaborative analysis; obtain collaborative behavior analysis groups corresponding to the first real-time request information and the authorized request information set respectively; identify the collaborative behavior analysis groups and output a collaborative request set.

[0043] Specifically, in order to more accurately evaluate the security of the first real-time request information, collaborative behavior analysis is performed with the authorized request information set, including time collaborative analysis, content collaborative analysis, user collaborative analysis, purpose collaborative analysis, and device collaborative analysis. Among them, through time collaborative analysis, the timestamp of the first real-time request information is compared with the time pattern of the requests in the authorized request information set to determine whether the request occurs within the expected time range. Through content collaborative analysis, the content of the first real-time request information (such as request data) is compared with the content in the authorized request information set to determine whether the request has similar or consistent characteristics. Through user collaborative analysis, the relevance between the user identity of the first real-time request information and the users in the authorized request information set is analyzed to confirm whether the request comes from the same user or user group. Through purpose collaborative analysis, the similarity between the purpose of the first real-time request information and the purposes of the requests in the authorized request information set is evaluated to determine whether the request has the same or related goals. Through device collaborative analysis, the source device of the first real-time request information is compared with the device information of the requests in the authorized request information set to determine whether the request comes from the same device or device type.

[0044] Then, through the evaluation of the collaborative behavior analysis factors, a collaborative behavior analysis group between the first real-time request information and the authorized request information set is constructed, including the corresponding relationships between the real-time requests and the historical requests in each analysis dimension.

[0045] Finally, the collaborative behavior analysis group is identified to output a set of collaborative requests. The set of collaborative requests refers to the set of real-time request information that matches the authorized request information set in multiple analysis dimensions.

[0046] By outputting the set of collaborative requests, a basis is provided for further security risk assessment, further determining whether the real-time request conforms to the expected behavior pattern, thereby providing decision support for software security risk management.

[0047] Furthermore, this application also includes:

[0048] Identifying the collaborative behavior analysis group to output a set of collaborative requests; wherein, the set of collaborative requests is a set of request information that is associated with the first real-time request information in at least one or more collaborative behavior analysis dimensions.

[0049] Specifically, in the software security risk management method based on multi-dimensional behavior analysis, the collaborative behavior analysis group is identified to determine the real-time requests that are similar or relevant to the authorized historical requests in specific dimensions. The first real-time request information is compared with the records in the authorized request information set to find the requests that are associated in at least one collaborative behavior analysis dimension.

[0050] The collaborative behavior analysis dimensions include but are not limited to time, content, user, purpose, and device. If the first real-time request information and the records in the authorized request information set show consistent or comparable characteristics in any dimension, then the request information will be classified as part of the collaborative request set. The output of the collaborative request set includes all authorized request information that matches the first real-time request information in at least one analysis dimension, identifying requests that conform to known normal behavior patterns, thereby helping to distinguish normal behavior from potential abnormal or malicious behavior.

[0051] By outputting a set of collaborative requests, normal behavior can be distinguished from potential abnormal or malicious behavior.

[0052] Furthermore, the present application also includes:

[0053] Perform risk assessment on subsequent effects of the software based on the collaborative request set, and obtain a set of behavioral risk coefficients corresponding to the collaborative request set; perform feedback optimization on the collaborative risk coefficient set based on the behavioral risk coefficient set, and output an optimized collaborative risk coefficient set.

[0054] Specifically, for each collaborative request, the behavioral risk coefficient is calculated based on the characteristics of the request, such as time, content, user, purpose, and device, and the similarity with known security threats or abnormal patterns. The behavioral risk coefficient represents the degree of risk that a specific request poses to software security. The behavioral risk coefficients are aggregated to form a behavioral risk coefficient set, which serves as the basis for evaluating the software security status.

[0055] Subsequently, the collaborative risk coefficient set is optimized based on the behavioral risk coefficient set. The information in the behavioral risk coefficient set is used to adjust and improve the collaborative risk coefficient set to more accurately reflect the current security risk of the software, including adjusting the calculation method of the risk coefficient, updating the risk threshold, or introducing a new analysis dimension.

[0056] The output optimized collaborative risk coefficient set provides a more accurate and reliable assessment tool for software security risk management, improving the efficiency of identifying and responding to potential security threats.

[0057] Furthermore, the present application also includes:

[0058] Perform a risk assessment on the subsequent effects of the software based on the collaborative request set, including the technical compatibility risk, technical security risk and business change risk corresponding to each collaborative request; train a fully connected neural network with the technical compatibility risk, the technical security risk and the business change risk as well as label information identifying the degree of risk to obtain an authorized risk assessment model; obtain an authorized risk coefficient set corresponding to the authorized request information set based on the authorized risk assessment model.

[0059] Specifically, a risk assessment is performed on the collaborative request set, that is, an assessment of various risk types that the software may face, including technology compatibility risks, technology security risks, and business change risks. Technology compatibility risks refer to the compatibility issues between the authorized request information set and the software's existing technology stack, such as data structures, API interfaces, etc., which may lead to unstable software operation, data loss, or abnormal functions. Technology security risks refer to the fact that the authorized request information contains sensitive data, such as user privacy, transaction details, etc., which may cause security risks if not properly handled. Business change risks refer to the changes in the business requirements of the authorized request information set, such as the launch of new functions, the adjustment of business rules, etc., which may cause new risks.

[0060] Then, in order to quantify the risks, a fully connected neural network is used. During the training process, a data set containing technology compatibility risks, technology security risks, and business change risks, as well as label information indicating the degree of risk, is used to guide the neural network to learn how to predict risks from the input data. Through training, an authorized risk assessment model is obtained. According to the input collaborative request information, a risk coefficient is output, that is, an authorized risk coefficient set, which provides a risk assessment for each authorized request and indicates the degree of risk that the request may bring.

[0061] By outputting the authorized risk coefficient set, it helps the software security risk management to identify and prioritize the requests with higher risks, thus ensuring the security and stability of the software system.

[0062] Furthermore, this application also includes:

[0063] Obtain the model computing power index of the software security risk assessment model; perform conversion according to the model computing power index, and output the quantity constraint condition of the collaborative request set; constrain the quantity of the collaborative request set input to the software security risk assessment model according to the quantity constraint condition.

[0064] Specifically, obtain the model computing power index of the software security risk assessment model. The model computing power index includes the time required to process requests, memory usage, the utilization rate of the processor or processors, etc., which is used to ensure the efficient operation of the model.

[0065] Then, perform conversion according to the model computing power index to output the quantity constraint condition of the collaborative request set. The quantity constraint condition refers to the limit set on the size or quantity of the collaborative request set input to the model in order to ensure the model runs at an acceptable performance level. For example, if the computing power index of the model shows that the performance will significantly decline when processing more than a certain number of requests, then the quantity constraint condition may limit the maximum number of requests input to the model each time.

[0066] Finally, the number of collaborative request sets input into the software security risk assessment model is constrained according to the quantity constraint condition, which means that in practical applications, only when the number of collaborative request sets meets the quantity constraint condition, the request set is input into the model for risk assessment, which helps to maintain the performance and reliability of the model and ensure that the risk assessment process will not have an adverse impact on the system due to overload.

[0067] Through the quantity constraint condition, the stable and secure operation of the software is further ensured.

[0068] In summary, the software security risk management method based on multi-dimensional behavior analysis provided by this application has the following technical effects:

[0069] By obtaining the historical request information set of the software within the preset valid period; dividing the historical request information set to identify the authorized request information set; receiving the first real-time request information, where the first real-time request information includes the request purpose, request address, request information source, and data packet type; performing request collaboration behavior analysis on the first real-time request information in the authorized request information set to obtain the collaborative request set of the authorized request information set, where the collaborative request is the request information that has a collaborative behavior with the first real-time request information; inputting the first real-time request information and the collaborative request set into the software security risk assessment model to obtain the collaborative risk coefficient set; fusing the collaborative risk coefficient set and outputting the comprehensive collaborative risk coefficient corresponding to the first real-time request information; the software makes an authorization decision on the first real-time request information according to the comprehensive collaborative risk coefficient, achieving the technical goal of multi-dimensional collaborative behavior analysis and obtaining the technical effects of effectively improving the accuracy of risk assessment, enhancing the early warning ability, preventing security vulnerabilities, and ensuring the effectiveness of security policies.

[0070] The above description of the disclosed embodiments enables those skilled in the art to implement or use this application. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application will not be limited to the embodiments shown herein, but rather will be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0071] Obviously, those skilled in the art can make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of this application and its equivalent technologies, this application is also intended to include these changes and modifications.

Claims

1. A software security risk management method based on multi-dimensional behavior analysis, characterized in that: include: Obtain a collection of historical request information of the software within a preset effective period; Dividing the historical request information set to identify the authorized request information set; Receiving first real-time request information, wherein the first real-time request information includes a request purpose, a request address, a request information source, and a data packet type; Performing request coordination behavior analysis on the first real-time request information in the authorized request information set to obtain a coordination request set of the authorized request information set, wherein the coordination request is request information that has coordination behavior with the first real-time request information; Inputting the first real-time request information and the collaborative request set into a software security risk assessment model to obtain a collaborative risk coefficient set; The collaborative risk coefficient set is integrated to output a comprehensive collaborative risk coefficient corresponding to the first real-time request information; The software makes an authorization decision on the first real-time request information according to the comprehensive collaborative risk coefficient; Performing request coordination behavior analysis on the first real-time request information in the authorized request information set includes: Performing request collaborative behavior analysis on the first real-time request information and the authorized request information set respectively, wherein the factors of collaborative behavior analysis include time collaborative analysis, content collaborative analysis, user collaborative analysis, purpose collaborative analysis and device collaborative analysis; Acquire a collaborative behavior analysis group corresponding to each of the first real-time request information and the authorized request information set; Identify the collaborative behavior analysis group and output a collaborative request set; After obtaining the collaborative risk coefficient set, it also includes: Performing a risk assessment on subsequent effects of the software according to the collaborative request set, and obtaining a set of behavior risk coefficients corresponding to the collaborative request set; Feedback optimization is performed on the collaborative risk coefficient set according to the behavioral risk coefficient set, and an optimized collaborative risk coefficient set is output.

2. The software security risk management method based on multi-dimensional behavior analysis as claimed in claim 1, characterized in that: The software makes an authorization decision on the first real-time request information according to the comprehensive collaborative risk coefficient, including: If the comprehensive collaborative risk coefficient is greater than the preset collaborative risk coefficient, the first real-time request information is authorized; If the comprehensive collaborative risk coefficient is less than the preset collaborative risk coefficient, the first real-time request information authorization is rejected.

3. The software security risk management method based on multi-dimensional behavior analysis as claimed in claim 2, characterized in that: If any risk coefficient in the collaborative risk coefficient set is greater than the preset collaborative risk coefficient, the first real-time request information authorization is rejected.

4. The software security risk management method based on multi-dimensional behavior analysis as claimed in claim 1, characterized in that: Identify the collaborative behavior analysis group and output a collaborative request set; The collaborative request set is a set of request information that is associated with at least the first real-time request information in one or more collaborative behavior analysis dimensions.

5. The software security risk management method based on multi-dimensional behavior analysis as claimed in claim 1, characterized in that: Conducting a risk assessment on subsequent effects of the software based on the collaboration request set, including technical compatibility risk, technical security risk, and business change risk corresponding to each collaboration request; Training a fully connected neural network with the technical compatibility risk, the technical security risk, the business change risk, and label information identifying the degree of risk to obtain an authorized risk assessment model; According to the authorized risk assessment model, an authorized risk coefficient set corresponding to the authorized request information set is obtained.

6. The software security risk management method based on multi-dimensional behavior analysis as claimed in claim 1, characterized in that: Also includes: Obtaining a model computing power indicator of the software security risk assessment model; Convert according to the computing power index of the model and output the quantity constraint condition of the collaborative request set; The quantity of the collaborative request set input into the software security risk assessment model is constrained according to the quantity constraint condition.

Images