A smart terminal security risk assessment system and method

Abstract

The present invention belongs to the field of intelligent terminal technology, and specifically relates to an intelligent terminal security risk assessment system and method. The invention provides a comprehensive security assessment perspective by combining data from multiple aspects such as network traffic, system logs, user operations, and network delays, and can more accurately identify abnormal behaviors and potential threats. By real-time collection and analysis of current network traffic data and application behaviors, new security threats can be discovered and responded to in a timely manner, and the security protection capabilities of intelligent terminals can be enhanced. By setting the evaluation interval of normal behavior, abnormal behaviors beyond the normal range can be effectively identified, the false alarm rate can be reduced, and the accuracy of the assessment can be improved. By using historical network traffic data for comparative analysis, the abnormality of the current behavior can be better understood, providing an important reference for security assessment, and the evaluation criteria and parameters can be dynamically adjusted according to different intelligent terminals and application scenarios, improving the adaptability and flexibility of the assessment.

Description

Technical Field

[0001] The present invention belongs to the technical field of smart terminals, and in particular relates to a smart terminal security risk assessment system and method. Background Art

[0002] With the rapid development and popularization of information technology, smart terminal devices have penetrated into all aspects of people's lives, such as smart phones, tablet computers, and in-vehicle smart terminals, which have been widely used in people's daily lives and work. These devices carry a large amount of personal and corporate information. While providing convenient services to people, their increasingly complex functions and increased interactions with the external environment also face increasingly serious security threats and risks. Since smart terminal devices are highly interconnected and complex, their security vulnerabilities and hidden dangers, once maliciously exploited, may lead to a series of serious consequences such as user data leakage, device control, and network attacks.

[0003] As an important means of ensuring information security, intelligent terminal security risk assessment has attracted widespread attention from the industry and academia. Traditional terminal security risk assessment methods often focus on the assessment of a single component or function, lacking a comprehensive consideration of the overall security of the system, making the assessment results often inaccurate and incomplete, and making it difficult to effectively identify potential security threats. Summary of the invention

[0004] The purpose of the present invention is to provide a smart terminal security risk assessment method, which can effectively improve the ability to identify and respond to potential security risks of smart terminals through comprehensive and multi-dimensional data analysis, and provide strong technical support for the security protection of smart terminals.

[0005] The technical solution adopted by the present invention is as follows:

[0006] A smart terminal security risk assessment method, comprising:

[0007] Collect application behavior of smart terminals;

[0008] Determine whether the application behavior is within a preset application behavior evaluation interval. If not, mark it as an application behavior to be evaluated.

[0009] Collecting network traffic data corresponding to the behavior of the application to be evaluated, wherein the network traffic data includes historical network traffic data and current network traffic data;

[0010] Calculate network traffic fluctuation parameters based on historical network traffic data and current network traffic data corresponding to the behavior of the application to be evaluated;

[0011] Obtain the system log corresponding to the network data to be evaluated, and obtain the behavior deviation parameters of the user operation records and application behavior based on the system log;

[0012] Obtain the abnormal frequency of the application behavior to be evaluated;

[0013] Obtain network delay data of the application behavior to be evaluated, and obtain network delay fluctuation parameters based on the network delay data;

[0014] The security risks of smart terminals are determined based on network traffic fluctuation parameters, behavior deviation parameters, abnormal frequency, and network delay fluctuation parameters.

[0015] In a preferred solution, the step of determining whether the application behavior is within a preset application behavior evaluation interval, and if not, marking the application behavior as an application behavior to be evaluated, includes:

[0016] Get the standard application behavior evaluation interval;

[0017] Determine whether the application behavior is within the standard application behavior evaluation range;

[0018] If the application behavior is within the standard application behavior evaluation range, the application behavior of the smart terminal is determined to be normal;

[0019] If the application behavior is not within the standard application behavior evaluation range, the application behavior of the smart terminal is determined to be abnormal and marked as application behavior to be evaluated.

[0020] In a preferred solution, the step of calculating the network traffic fluctuation parameter based on the historical network traffic data and the current network traffic data corresponding to the application behavior to be evaluated includes:

[0021] Obtain historical network traffic parameters according to historical network traffic data corresponding to the behavior of the application to be evaluated;

[0022] Obtain current network traffic parameters according to current network traffic data corresponding to the behavior of the application to be evaluated;

[0023] Get the network traffic fluctuation function;

[0024] The historical network traffic parameters and the current network traffic parameters are input into the network traffic fluctuation function, and the output result is marked as the network traffic fluctuation parameter.

[0025] In a preferred solution, the step of obtaining the abnormal frequency of the behavior of the application to be evaluated includes:

[0026] Obtain the number of times that the application behavior of the smart terminal is marked as the application behavior to be evaluated;

[0027] Get the duration of each evaluation of application behavior;

[0028] The abnormal frequency of the application behavior to be evaluated is obtained based on the number of times the application behavior is marked as to be evaluated and the duration.

[0029] In a preferred solution, the step of obtaining network delay data of the application behavior to be evaluated and obtaining a network delay fluctuation parameter according to the network delay data includes:

[0030] Obtain network latency data for the application behavior to be evaluated;

[0031] Obtain multiple network delay parameters according to network delay data;

[0032] Get the network delay fluctuation function;

[0033] A plurality of network delay parameters are input into a network delay fluctuation function, and an output result is marked as a network delay fluctuation parameter.

[0034] In a preferred solution, the step of judging the security risk of the smart terminal according to the network traffic fluctuation parameter, the behavior deviation parameter, the abnormal frequency and the network delay fluctuation parameter includes:

[0035] Calculate security risk parameters based on network traffic fluctuation parameters, behavior deviation parameters, abnormal frequency, and network delay fluctuation parameters;

[0036] Obtain standard security risk thresholds;

[0037] Determine whether the security risk parameter exceeds the standard security risk threshold;

[0038] If the security risk parameter exceeds the standard security risk threshold, it is determined that the smart terminal has a security risk;

[0039] If the security risk parameter does not exceed the standard security risk threshold, the smart terminal is judged to be safe.

[0040] In a preferred embodiment, the step of calculating the security risk parameter according to the network traffic fluctuation parameter, the behavior deviation parameter, the abnormal frequency and the network delay fluctuation parameter comprises:

[0041] Obtaining security risk function;

[0042] The network traffic fluctuation parameters, behavior deviation parameters, abnormal frequency and network delay fluctuation parameters are input into the security risk function, and the output results are marked as security risk parameters.

[0043] In a preferred embodiment, after the step of determining whether the security risk parameter exceeds the standard security risk threshold, the method further includes:

[0044] Obtaining a security risk level table, wherein the security risk level table includes a plurality of security risk assessment intervals and a security risk level corresponding to each security risk assessment interval;

[0045] Obtaining a target security risk assessment interval based on security risk parameters exceeding a standard security risk threshold;

[0046] Obtain the corresponding security risk level from the security risk level table according to the target security risk assessment interval.

[0047] The present invention also provides a smart terminal security risk assessment system, which is used in the smart terminal security risk assessment method, comprising:

[0048] Behavior module, used to collect application behavior of smart terminals;

[0049] A judgment module, used to judge whether the application behavior is within a preset application behavior evaluation interval, and if not, mark it as an application behavior to be evaluated;

[0050] A network traffic module, used to collect network traffic data corresponding to the behavior of the application program to be evaluated, wherein the network traffic data includes historical network traffic data and current network traffic data;

[0051] A traffic fluctuation module, used to calculate network traffic fluctuation parameters based on historical network traffic data and current network traffic data corresponding to the behavior of the application to be evaluated;

[0052] Deviation module, used to obtain the system log corresponding to the network data to be evaluated, and obtain the behavior deviation parameters of the user operation record and the application behavior according to the system log;

[0053] The frequency module is used to obtain the abnormal frequency of the application behavior to be evaluated;

[0054] A network delay module is used to obtain network delay data of the application behavior to be evaluated, and obtain network delay fluctuation parameters based on the network delay data;

[0055] The risk determination module is used to determine the security risk of the smart terminal based on network traffic fluctuation parameters, behavior deviation parameters, abnormal frequency and network delay fluctuation parameters.

[0056] And, a smart terminal security risk assessment terminal, comprising:

[0057] one or more processors;

[0058] a storage device having one or more programs stored thereon;

[0059] When the one or more programs are executed by the one or more processors, the one or more processors implement the smart terminal security risk assessment method.

[0060] The technical effects achieved by the present invention are:

[0061] The present invention provides a comprehensive security assessment perspective by combining data from multiple aspects such as network traffic, system logs, user operations and network delays, and can more accurately identify abnormal behaviors and potential threats. By real-time collection and analysis of current network traffic data and application behaviors, new security threats can be discovered and responded to in a timely manner, thereby enhancing the security protection capabilities of smart terminals. By setting an evaluation interval for normal behavior, abnormal behaviors that exceed the normal range can be effectively identified, the false alarm rate can be reduced, and the accuracy of the assessment can be improved. By using historical network traffic data for comparative analysis, the abnormality of current behavior can be better understood, providing an important reference basis for security assessment. Evaluation criteria and parameters can be dynamically adjusted according to different smart terminals and application scenarios, thereby improving the adaptability and flexibility of the assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 is a flow chart of the method provided by the present invention;

[0063] Figure 2 It is a system module diagram provided by the present invention. DETAILED DESCRIPTION

[0064] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0065] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0066] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure or characteristic that may be included in at least one implementation of the present invention. The phrase "in a preferred embodiment" that appears in different places in this specification does not refer to the same embodiment, nor is it a separate or selective embodiment that is mutually exclusive with other embodiments.

[0067] Secondly, the present invention is described in detail in conjunction with schematic diagrams. When describing the embodiments of the present invention in detail, for the convenience of explanation, the schematic diagrams are only examples and should not limit the scope of protection of the present invention.

[0068] Please see attached Figure 1As shown, a smart terminal security risk assessment method is provided, including:

[0069] S1. Collect application behaviors of smart terminals;

[0070] S2. Determine whether the application behavior is within a preset application behavior evaluation interval. If not, mark it as an application behavior to be evaluated.

[0071] S3, collecting network traffic data corresponding to the behavior of the application to be evaluated, wherein the network traffic data includes historical network traffic data and current network traffic data;

[0072] S4, calculating a network traffic fluctuation parameter based on historical network traffic data and current network traffic data corresponding to the behavior of the application to be evaluated;

[0073] S5. Obtain the system log corresponding to the network data to be evaluated, and obtain the behavior deviation parameters of the user operation record and the application behavior according to the system log;

[0074] S6. Obtain the abnormal frequency of the behavior of the application to be evaluated;

[0075] S7, obtaining network delay data of the application behavior to be evaluated, and obtaining a network delay fluctuation parameter according to the network delay data;

[0076] S8. Determine the security risk of the smart terminal based on network traffic fluctuation parameters, behavior deviation parameters, abnormal frequency, and network delay fluctuation parameters.

[0077] As in the above steps S1 to S8, the behavior data of all applications on the smart terminal are collected. These data may include application startup, shutdown, resources accessed, requested permissions, etc. The collected application behaviors are compared with the preset evaluation criteria. If a behavior exceeds the preset normal behavior range, it is marked as the application behavior to be evaluated. By setting a reasonable behavior range, potential abnormal behaviors are filtered out. Network traffic data related to the application behavior to be evaluated is collected. These data include historical network traffic data and current network traffic data. The changes in network traffic in different time periods are analyzed and calculated to generate network traffic fluctuation parameters, which can help identify abnormal network activities, such as data leakage or malicious communication. User operation records are obtained through system logs and compared with application behavior. Behavior deviation parameters are calculated to detect abnormal differences between user behavior and application behavior, revealing potential risk behaviors. The abnormal frequency of the application behavior to be evaluated is counted. If an abnormal behavior occurs frequently, it indicates a high security risk. Network delay data is collected and its fluctuation is calculated. Abnormal fluctuations in network delay may indicate network attacks or other abnormal situations. Combined with network traffic fluctuation parameters, behavior deviation parameters, abnormal frequency and network delay fluctuation parameters, the security risk of the smart terminal is comprehensively evaluated. Data analysis can more accurately identify potential security threats. For example, if the behavior of an application on a smart terminal is marked as a behavior to be evaluated, by analyzing its network traffic data, it is found that it frequently communicates with a foreign server during non-working hours, and the network traffic of these communications fluctuates greatly. At the same time, the system log shows that the user has not authorized the corresponding operation. The abnormal frequency of the application's behavior is also higher than that of other applications, and its network delay fluctuates abnormally during the communication period. Combining the above parameters, it is judged that the application has a high security risk, that is, the smart terminal may involve data leakage or be implanted with malicious code. By combining network traffic, system logs, user operations, network delays and other multiple factors, the application is considered to have a high security risk. It collects data from various aspects, provides a comprehensive security assessment perspective, and can more accurately identify abnormal behaviors and potential threats. By collecting and analyzing current network traffic data and application behaviors in real time, it can promptly discover and respond to new security threats, enhancing the security protection capabilities of smart terminals. By setting the evaluation interval of normal behavior, it can effectively identify abnormal behaviors that exceed the normal range, reduce the false alarm rate, and improve the accuracy of the assessment. By using historical network traffic data for comparative analysis, it can better understand the abnormality of current behavior, providing an important reference for security assessment. It can dynamically adjust the assessment standards and parameters according to different smart terminals and application scenarios, improving the adaptability and flexibility of the assessment.

[0078] The step of determining whether the application behavior is within a preset application behavior evaluation interval, and if not, marking it as an application behavior to be evaluated, includes:

[0079] S201, obtaining a standard application behavior evaluation interval;

[0080] S202, determining whether the application behavior is within a standard application behavior evaluation range;

[0081] If the application behavior is within the standard application behavior evaluation range, the application behavior of the smart terminal is determined to be normal;

[0082] If the application behavior is not within the standard application behavior evaluation range, the application behavior of the smart terminal is determined to be abnormal and marked as application behavior to be evaluated.

[0083] As in the above steps S201 to S202, the application behavior evaluation interval is obtained based on the analysis and statistics of a large amount of normal application behavior data, and usually includes the range of behavior parameters, such as CPU usage, memory usage, network traffic, accessed system resources, permission requests, etc. This evaluation interval is used as a benchmark to determine whether the application behavior is normal. The behavior data of the current application will be compared with the preset standard evaluation interval. If the application behavior is within the standard evaluation interval, the behavior is determined to be normal, that is, the application behavior of the smart terminal does not exceed the normal range and does not need further evaluation. If the application behavior exceeds the standard evaluation interval, the behavior is determined to be abnormal and marked as the application behavior to be evaluated. By establishing a standard application behavior evaluation interval, normal and abnormal behaviors can be effectively distinguished. The standard The setting of the interval is based on the statistical analysis of a large amount of data, which can accurately reflect the normal behavior patterns of most applications, thereby improving the accuracy of the assessment and realizing automated detection and judgment. By comparing the application behavior and the standard evaluation interval in real time, abnormal behavior can be automatically identified, reducing manual intervention and improving detection efficiency. Since the evaluation interval is set based on a large amount of normal behavior data, it can effectively filter out normal fluctuations and reduce the possibility of false alarms. It will only mark and further evaluate in truly abnormal cases. It can detect application behavior in real time and mark abnormal behavior in time for further evaluation and processing, enhancing the response speed of security threats. The standard application behavior evaluation interval can be adjusted and updated according to new data and environmental changes, making the evaluation method dynamically adaptable and able to cope with different application scenarios and changing security threats.

[0084] The step of calculating the network traffic fluctuation parameter according to the historical network traffic data and the current network traffic data corresponding to the behavior of the application program to be evaluated comprises:

[0085] S401, obtaining historical network traffic parameters according to historical network traffic data corresponding to the behavior of the application program to be evaluated;

[0086] S402, obtaining current network traffic parameters according to current network traffic data corresponding to the behavior of the application program to be evaluated;

[0087] S403, obtaining a network traffic fluctuation function;

[0088] S404: Input the historical network traffic parameters and the current network traffic parameters into the network traffic fluctuation function, and mark the output result as the network traffic fluctuation parameter.

[0089] As in the above steps S401 to S404, historical network traffic data related to the behavior of the application to be evaluated is collected. This data usually includes network traffic information over a period of time in the past, such as the number, size, transmission frequency, connection duration, etc. of data packets. By analyzing these historical data, parameters describing historical network traffic, such as average traffic, peak traffic, traffic fluctuation, etc., are extracted. Current network traffic data is collected. This data is related to the network activity of the application behavior to be evaluated at the current time point. Current network traffic parameters are extracted, which are similar to historical network traffic parameters, including current average traffic, peak traffic, real-time traffic fluctuation, etc. A network traffic fluctuation function is defined. The network traffic fluctuation function is used to calculate and compare changes in historical and current network traffic data. It can be based on statistical methods, such as standard deviation, variance, or based on machine learning methods, such as time series analysis models, anomaly detection algorithms, etc. The network traffic fluctuation function is Where B represents the network traffic fluctuation parameter, i represents the number of the historical network traffic fluctuation parameter, n represents the total number of historical network traffic fluctuation parameters, and W i It is represented as the i-th historical network traffic fluctuation parameter, W max It is expressed as the maximum value of the historical network traffic fluctuation parameter, W min It is expressed as the minimum value of the historical network traffic fluctuation parameter, W dThe network traffic fluctuation parameter is expressed as the current network traffic fluctuation parameter. The historical network traffic parameters and the current network traffic parameters are input into the network traffic fluctuation function. The network traffic fluctuation parameter is calculated by the function. This fluctuation parameter reflects the change of the current network traffic relative to the historical traffic. If the change is abnormal and obvious, it may indicate the existence of security risks. By comparing the historical and current network traffic data, abnormal network activities can be accurately identified. For example, the network traffic of an application suddenly increases in a specific time period, which may indicate that the application is performing abnormal data transmission or is under attack. The network traffic fluctuation function can be adjusted and optimized according to different application scenarios and network environments, so as to dynamically adapt to different application needs, provide flexible security assessment, collect and analyze the current network traffic data in real time, and compare it with historical data. It can timely discover and respond to potential network security threats and improve security protection capabilities. By introducing historical network traffic parameters as a comparison benchmark, normal network traffic fluctuations can be effectively filtered out, reducing the possibility of false alarms. Alarms will only be triggered when they deviate significantly from historical patterns. Combining historical and current multi-dimensional network traffic parameters, through comprehensive analysis, the network behavior characteristics of the application can be more comprehensively understood, and the accuracy of risk assessment can be improved.

[0090] The step of obtaining the abnormal frequency of the behavior of the application to be evaluated includes:

[0091] S601, obtaining the number of times that the application behavior of the smart terminal is marked as the application behavior to be evaluated;

[0092] S602, obtaining the duration of each evaluation of the application behavior;

[0093] S603: Obtain the abnormal frequency of the behavior of the application program to be evaluated according to the number of times and duration of the behavior of the application program to be evaluated marked.

[0094] As in the above steps S601 to S603, the number of times that the application behavior in the smart terminal is marked as the application behavior to be evaluated is recorded. Whenever a certain application behavior is detected to be abnormal, that is, it exceeds the preset evaluation standard range, the behavior will be marked as to be evaluated, and the number of such times will be counted. The duration of each application behavior being marked as the application behavior to be evaluated is recorded. The duration refers to the time interval from the time when the behavior is marked as to be evaluated to the time when the state of the behavior is confirmed to be restored to normal or the processing is completed. By analyzing the number of times and duration of the application behavior marked as to be evaluated, the abnormal frequency of the application behavior to be evaluated is calculated. This frequency reflects the degree of abnormality of the application behavior in the smart terminal, that is, the frequency of the abnormal behavior. The frequency of the application behavior to be evaluated can be calculated by dividing the number of application behaviors to be evaluated by the duration of the application behavior to be evaluated. The abnormal frequency of application behavior can be estimated. By monitoring and recording the number of times application behavior is marked as to be evaluated, potential abnormal behavior in smart terminals can be discovered in a timely manner, which improves the speed of discovering abnormal behavior. By calculating the frequency of abnormal behavior, the degree of abnormality of application behavior in smart terminals can be quantified. The higher the frequency, the more frequently the abnormal behavior occurs and the higher the risk. The quantitative data of abnormal frequency can provide a basis for decision-making for security managers. They can take corresponding security measures according to the frequency of abnormality, such as strengthening monitoring, adjusting permissions, updating defense strategies, etc. By continuously recording and analyzing abnormal frequency, the trend and pattern of abnormal behavior can be discovered, and then the security strategy and protection measures can be optimized to improve the security of smart terminals. By quantitatively evaluating the abnormal frequency, resources can be allocated more accurately to handle abnormal behavior, avoid waste of resources and false alarms, and improve operational efficiency.

[0095] The step of obtaining network delay data of the behavior of the application program to be evaluated, and obtaining a network delay fluctuation parameter according to the network delay data, comprises:

[0096] S701, obtaining network delay data of the application behavior to be evaluated;

[0097] S702, obtaining multiple network delay parameters according to the network delay data;

[0098] S703, obtaining a network delay fluctuation function;

[0099] S704: Input multiple network delay parameters into a network delay fluctuation function, and mark the output result as a network delay fluctuation parameter.

[0100] As in the above steps S701 to S704, network delay data of the application behavior to be evaluated is collected. Network delay refers to the time required for data to travel from the sending end to the receiving end, including transmission delay, queuing delay, processing delay, etc., which is used to measure network performance. By analyzing the network delay data, multiple network delay parameters are calculated, such as average delay, maximum delay, minimum delay, delay variation range, etc. These parameters can reflect the network delay characteristics of the application behavior to be evaluated. A network delay fluctuation function is defined to calculate and compare the changes in network delay data. This function can be based on statistical methods, such as standard deviation and variance, or can be based on machine learning methods, such as time series analysis models, anomaly detection algorithms, etc. The network delay fluctuation function is In the formula, Y represents the network delay fluctuation parameter, a represents the number of network delay fluctuations, m represents the total number of network delay fluctuations, and C a It is expressed as the ath network traffic fluctuation parameter. The obtained multiple network delay parameters are input into the network delay fluctuation function for processing. The fluctuation parameter of the network delay is calculated by the function. This parameter reflects the change of the current network delay relative to the historical delay. If the change is abnormal and obvious, it may indicate the existence of security risks. By analyzing the network delay data and calculating the network delay fluctuation parameter, the abnormal behavior of the network delay, such as a sudden increase in delay or unstable delay, can be identified, so as to timely discover potential security risks. By monitoring the network delay data and fluctuation parameters, the network performance of the smart terminal can be monitored in real time, network problems can be discovered and handled in time, and the user experience can be improved. Abnormal network delay fluctuations may be signs of network attacks or abnormal traffic. By timely identification and response, damage caused by network attacks can be prevented and the safety of smart terminals and users can be protected. By analyzing the network delay data and fluctuation parameters, the network status can be better understood, network resources can be reasonably allocated, and network utilization and performance can be improved. According to the changes in network delay, network policies and configurations can be dynamically adjusted to adapt to different network environments and application scenarios, thereby improving flexibility and adaptability.

[0101] The step of judging the security risk of the smart terminal according to the network traffic fluctuation parameter, the behavior deviation parameter, the abnormal frequency and the network delay fluctuation parameter includes:

[0102] S801, calculating security risk parameters according to network traffic fluctuation parameters, behavior deviation parameters, abnormal frequency, and network delay fluctuation parameters;

[0103] S802, obtaining a standard security risk threshold;

[0104] S803, determining whether the security risk parameter exceeds the standard security risk threshold;

[0105] If the security risk parameter exceeds the standard security risk threshold, it is determined that the smart terminal has a security risk;

[0106] If the security risk parameter does not exceed the standard security risk threshold, the smart terminal is judged to be safe.

[0107] As in the above steps S801 to S803, multiple security indicators such as network traffic fluctuation parameters, behavior deviation parameters, abnormal frequency and network delay fluctuation parameters are comprehensively considered, and a comprehensive security risk parameter is generated through calculation through a certain algorithm or model. This parameter can comprehensively reflect the security risk level of the smart terminal. A standard security risk threshold is set in advance. This threshold is based on a comprehensive consideration of factors such as security policies, business needs and risk assessment results. This threshold is used as a criterion for determining security risks. The calculated security risk parameter is compared with the standard security risk threshold. If the security risk parameter exceeds the standard security risk threshold, it indicates that a security risk has occurred in the smart terminal; conversely, if the security risk parameter does not exceed the standard security risk threshold, the smart terminal is determined to be safe. By comprehensively considering multiple Security indicators such as network traffic fluctuations, behavioral deviations, abnormal frequencies and network delays can more comprehensively evaluate the security status of smart terminals and avoid the one-sidedness brought by a single indicator. According to the pre-set standard security risk threshold, it can accurately determine whether there is a security risk in the smart terminal and avoid the errors caused by subjective judgment. By calculating the security risk parameters in real time and comparing them with the standard security risk threshold, security risks can be discovered in time, and rapid response and processing can be achieved, thereby improving security performance. According to the setting of the standard security risk threshold, the tolerance range of security risks can be controlled to a certain extent, making security management more controllable. By regularly updating the standard security risk threshold and adjusting it according to the latest security intelligence and risk assessment results, intelligent security decisions can be made, thereby improving the adaptability and flexibility of security performance.

[0108] The step of calculating the security risk parameter according to the network traffic fluctuation parameter, the behavior deviation parameter, the abnormal frequency and the network delay fluctuation parameter comprises:

[0109] S8011. Obtain security risk function;

[0110] S8012. Input the network traffic fluctuation parameter, behavior deviation parameter, abnormal frequency and network delay fluctuation parameter into the security risk function, and mark the output result as the security risk parameter.

[0111] As in the above steps S8011 to S8012, a security risk function is defined. This function is used to comprehensively consider multiple security indicators such as network traffic fluctuation parameters, behavioral deviation parameters, abnormal frequency, and network delay fluctuation parameters to calculate a comprehensive security risk parameter. The security risk function can be defined according to specific needs and security policies. It can be a simple weighted sum function or a complex machine learning model. The security risk function is A=B×X×P×Y, where A represents the security risk parameter, X represents the behavioral deviation parameter, and P represents the abnormal frequency. Multiple security indicators such as network traffic fluctuation parameters, behavioral deviation parameters, abnormal frequency, and network delay fluctuation parameters are used as function inputs and input into the security risk function for calculation. The security risk function comprehensively considers these input parameters and outputs a security risk parameter for evaluation. Estimate the security risk level of smart terminals. By inputting multiple security indicators into the security risk function for comprehensive calculation, the security risk of smart terminals can be evaluated more comprehensively and accurately, avoiding the limitations brought by a single indicator and improving the comprehensiveness and accuracy of the evaluation. The security risk function can be adjusted and optimized according to real-time security intelligence and environmental changes, and has a certain degree of adaptability, which can make the security assessment more targeted and timely. The security risk parameters can be used as the evaluation results to provide decision support for security managers. They can formulate corresponding security strategies and response measures according to the size and change trend of the security risk parameters, thereby improving the efficiency of security management and the accuracy of decision-making. By continuously optimizing the security risk function and combining real-time security data and feedback information, the accuracy and effectiveness of the security assessment can be continuously optimized, thereby improving the security protection capabilities of smart terminals.

[0112] After the step of determining whether the security risk parameter exceeds the standard security risk threshold, the method further includes:

[0113] S804, obtaining a security risk level table, wherein the security risk level table includes a plurality of security risk assessment intervals and a security risk level corresponding to each security risk assessment interval;

[0114] S805, obtaining a target security risk assessment interval according to the security risk parameter exceeding the standard security risk threshold;

[0115] S806. Obtain the corresponding security risk level from the security risk level table according to the target security risk assessment interval.

[0116] As in the above steps S804 to S806, a security risk level table is prepared, which includes multiple security risk assessment intervals and the security risk level corresponding to each security risk assessment interval. This level table is obtained based on a comprehensive consideration of factors such as security policies, previous terminal security inspections and risk assessment results. The security risk parameters that exceed the standard security risk threshold are matched with the security risk assessment intervals in the security risk level table to determine the target security risk assessment interval in which the current security risk parameter is located. This interval can be determined based on the size of the security risk parameter, reflecting the security risk level of the current smart terminal. According to the target security risk assessment interval, the corresponding security risk level is obtained in the security risk level table. This level reflects the current security status of the smart terminal, which usually includes high risk, medium risk, and low risk levels, and may also have more detailed divisions. By preparing a security risk level table, the security assessment can be standardized. As a result, the assessment of security risks is more objective and accurate, which is convenient for security managers to understand and make decisions. By obtaining the corresponding security risk level from the security risk level table according to the purpose security risk assessment interval, the security risk of the smart terminal can be quickly graded, making the security assessment results intuitive and clear. The security risk level in the security risk level table is derived based on a comprehensive consideration of business needs and risk assessment results, and can intuitively reflect the security status of the smart terminal, so that security managers can understand the degree of security risk at a glance. The level information in the security risk level table can provide decision-making support for security managers. They can formulate corresponding security measures and response strategies according to the level of security risk, so as to ensure the security of smart terminals. The security risk level table is a dynamically updated resource, which can be continuously optimized and improved according to actual conditions to adapt to different security risk assessment needs and environmental changes.

[0117] Please see attached Figure 2 As shown, the present invention also provides a smart terminal security risk assessment system, which is used in the above-mentioned smart terminal security risk assessment method, comprising:

[0118] Behavior module, used to collect application behavior of smart terminals;

[0119] A judgment module, used to judge whether the application behavior is within a preset application behavior evaluation interval, and if not, mark it as an application behavior to be evaluated;

[0120] A network traffic module, used to collect network traffic data corresponding to the behavior of the application program to be evaluated, wherein the network traffic data includes historical network traffic data and current network traffic data;

[0121] A traffic fluctuation module, used to calculate network traffic fluctuation parameters based on historical network traffic data and current network traffic data corresponding to the behavior of the application to be evaluated;

[0122] Deviation module, used to obtain the system log corresponding to the network data to be evaluated, and obtain the behavior deviation parameters of the user operation record and the application behavior according to the system log;

[0123] The frequency module is used to obtain the abnormal frequency of the application behavior to be evaluated;

[0124] A network delay module is used to obtain network delay data of the application behavior to be evaluated, and obtain network delay fluctuation parameters based on the network delay data;

[0125] The risk determination module is used to determine the security risk of the smart terminal based on network traffic fluctuation parameters, behavior deviation parameters, abnormal frequency and network delay fluctuation parameters.

[0126] As mentioned above, the behavior module is responsible for collecting application behavior data of smart terminals, including the operation status of applications, user operation behaviors, etc. According to the preset application behavior evaluation interval, the judgment module judges the collected application behavior. If the behavior is not within the interval, it is marked as application behavior to be evaluated. The network traffic module collects network traffic data corresponding to the application behavior to be evaluated, including historical network traffic data and current network traffic data, to provide data support for subsequent security risk assessment. According to historical and current network traffic data, the traffic fluctuation module calculates the fluctuation parameters of network traffic to evaluate the stability and abnormality of network traffic. The deviation module obtains the system log corresponding to the network data to be evaluated, and obtains the deviation parameters between the user operation record and the application behavior by analyzing the system log, which helps to evaluate the normality of the application behavior. The frequency module is used to calculate the abnormal frequency of the application behavior to be evaluated, that is, the number of times the behavior is marked as to be evaluated, and the duration of each behavior. The network delay module is responsible for obtaining the network delay data of the application behavior to be evaluated, and calculates the network delay data based on the data. The fluctuation parameters of network delay are used to evaluate the stability and abnormality of network delay. Finally, according to the network traffic fluctuation parameters, behavior deviation parameters, abnormal frequency and network delay fluctuation parameters, the risk judgment module judges the security risk of the smart terminal. If the security risk exceeds the preset threshold, the terminal is judged to have a security risk. It comprehensively considers multiple security indicators, such as application behavior, network traffic, user operation, abnormal frequency and network delay, making the security assessment more comprehensive and accurate. The behavior and network status of smart terminals will change continuously. The system can collect data in real time and conduct security risk assessment to help users discover potential security problems in time. Through the preset security risk threshold and risk level table, the security status of smart terminals can be intelligently judged, and security risks exceeding the threshold can be warned and processed. The modular design makes it flexible and customizable, and it can be configured and expanded according to different application scenarios and needs. The final security risk judgment result provides decision support for security managers, helping them to formulate corresponding security strategies and measures to ensure the security of smart terminals.

[0127] And, a smart terminal security risk assessment terminal, comprising:

[0128] one or more processors;

[0129] a storage device having one or more programs stored thereon;

[0130] When the one or more programs are executed by the one or more processors, the one or more processors implement the smart terminal security risk assessment method.

[0131] The above is only a preferred embodiment of the present invention. It should be noted that, for those skilled in the art, several improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications should also be considered as the protection scope of the present invention. The structures, devices and operating methods not specifically described and explained in the present invention shall be implemented according to the conventional means in the art unless otherwise specified and limited.

Claims

1. A method for assessing security risks of intelligent terminals, characterized in that: include: Collect application behavior of smart terminals; Determine whether the application behavior is within a preset application behavior evaluation interval. If not, mark it as an application behavior to be evaluated. Collecting network traffic data corresponding to the behavior of the application to be evaluated, wherein the network traffic data includes historical network traffic data and current network traffic data; Calculate network traffic fluctuation parameters based on historical network traffic data and current network traffic data corresponding to the behavior of the application to be evaluated; Obtain the system log corresponding to the network data to be evaluated, and obtain the behavior deviation parameters of the user operation records and application behavior based on the system log; Obtain the abnormal frequency of the application behavior to be evaluated; Obtain network delay data of the application behavior to be evaluated, and obtain network delay fluctuation parameters based on the network delay data; Determine the security risk of smart terminals based on network traffic fluctuation parameters, behavior deviation parameters, abnormal frequency, and network delay fluctuation parameters; The step of judging the security risk of the smart terminal according to the network traffic fluctuation parameter, the behavior deviation parameter, the abnormal frequency and the network delay fluctuation parameter includes: Calculate security risk parameters based on network traffic fluctuation parameters, behavior deviation parameters, abnormal frequency, and network delay fluctuation parameters; Obtain standard security risk thresholds; Determine whether the security risk parameter exceeds the standard security risk threshold; If the security risk parameter exceeds the standard security risk threshold, it is determined that the smart terminal has a security risk; If the security risk parameter does not exceed the standard security risk threshold, the smart terminal is determined to be safe; The step of calculating the security risk parameter according to the network traffic fluctuation parameter, the behavior deviation parameter, the abnormal frequency and the network delay fluctuation parameter comprises: Obtain the security risk function, which is A=B×X×P×Y, where A represents the security risk parameter, B represents the network traffic fluctuation parameter, X represents the behavior deviation parameter, P represents the abnormal frequency, and Y represents the network delay fluctuation parameter; The network traffic fluctuation parameters, behavior deviation parameters, abnormal frequency and network delay fluctuation parameters are input into the security risk function, and the output results are marked as security risk parameters.

2. The intelligent terminal security risk assessment method according to claim 1, characterized in that: The step of determining whether the application behavior is within a preset application behavior evaluation interval, and if not, marking it as an application behavior to be evaluated, includes: Get the standard application behavior evaluation interval; Determine whether the application behavior is within the standard application behavior evaluation range; If the application behavior is within the standard application behavior evaluation interval, the application behavior of the smart terminal is determined to be normal; If the application behavior is not within the standard application behavior evaluation range, the application behavior of the smart terminal is determined to be abnormal and marked as application behavior to be evaluated.

3. The intelligent terminal security risk assessment method according to claim 1, characterized in that: The step of calculating the network traffic fluctuation parameter according to the historical network traffic data and the current network traffic data corresponding to the behavior of the application program to be evaluated comprises: Obtain historical network traffic parameters according to historical network traffic data corresponding to the behavior of the application to be evaluated; Obtain current network traffic parameters according to current network traffic data corresponding to the behavior of the application to be evaluated; Get the network traffic fluctuation function, the network traffic fluctuation function is Where B represents the network traffic fluctuation parameter, i represents the number of the historical network traffic fluctuation parameter, n represents the total number of historical network traffic fluctuation parameters, and W i It is represented as the i-th historical network traffic fluctuation parameter, W max It is expressed as the maximum value of the historical network traffic fluctuation parameter, W min It is expressed as the minimum value of the historical network traffic fluctuation parameter, W d It is represented as the current network traffic fluctuation parameter; The historical network traffic parameters and the current network traffic parameters are input into the network traffic fluctuation function, and the output result is marked as the network traffic fluctuation parameter.

4. The intelligent terminal security risk assessment method according to claim 1, characterized in that: The step of obtaining the abnormal frequency of the behavior of the application to be evaluated includes: Obtain the number of times that the application behavior of the smart terminal is marked as the application behavior to be evaluated; Get the duration of each evaluation of application behavior; The abnormal frequency of the application behavior to be evaluated is obtained based on the number of times the application behavior is marked as to be evaluated and the duration.

5. The intelligent terminal security risk assessment method according to claim 1, characterized in that: The step of obtaining network delay data of the behavior of the application program to be evaluated, and obtaining a network delay fluctuation parameter according to the network delay data, comprises: Obtain network latency data for the application behavior to be evaluated; Obtain multiple network delay parameters according to network delay data; Get the network delay fluctuation function, the network delay fluctuation function is In the formula, Y represents the network delay fluctuation parameter, a represents the number of network delay fluctuations, m represents the total number of network delay fluctuations, and C a It is represented as the ath network traffic fluctuation parameter; A plurality of network delay parameters are input into a network delay fluctuation function, and an output result is marked as a network delay fluctuation parameter.

6. The intelligent terminal security risk assessment method according to claim 1, characterized in that: After the step of determining whether the security risk parameter exceeds the standard security risk threshold, the method further includes: Obtaining a security risk level table, wherein the security risk level table includes a plurality of security risk assessment intervals and a security risk level corresponding to each security risk assessment interval; Obtaining a target security risk assessment interval based on security risk parameters exceeding a standard security risk threshold; Obtain the corresponding security risk level from the security risk level table according to the target security risk assessment interval.

7. A smart terminal security risk assessment system, applied to the smart terminal security risk assessment method according to any one of claims 1 to 6, characterized in that: include: Behavior module, used to collect application behavior of smart terminals; A judgment module, used to judge whether the application behavior is within a preset application behavior evaluation interval, and if not, mark it as an application behavior to be evaluated; A network traffic module, used to collect network traffic data corresponding to the behavior of the application program to be evaluated, wherein the network traffic data includes historical network traffic data and current network traffic data; A traffic fluctuation module, used to calculate network traffic fluctuation parameters based on historical network traffic data and current network traffic data corresponding to the behavior of the application to be evaluated; Deviation module, used to obtain the system log corresponding to the network data to be evaluated, and obtain the behavior deviation parameters of the user operation record and the application behavior according to the system log; The frequency module is used to obtain the abnormal frequency of the application behavior to be evaluated; A network delay module is used to obtain network delay data of the application behavior to be evaluated, and obtain network delay fluctuation parameters based on the network delay data; The risk determination module is used to determine the security risk of the smart terminal based on network traffic fluctuation parameters, behavior deviation parameters, abnormal frequency and network delay fluctuation parameters.

8. An intelligent terminal security risk assessment terminal, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the smart terminal security risk assessment method described in any one of claims 1-6.

Images