Cloud security mobile phone-based ebpf isolation method and system, and medium

Abstract

The invention provides an ebpf isolation method and system based on a cloud security mobile phone and a medium, and belongs to the technical field of cloud mobile phones and big data. The method comprises the steps of obtaining cloud security mobile phone monitoring information in a preset time period, extracting security tracking information for identification processing, obtaining malicious behavior identification information and triggering a corresponding isolation mechanism, obtaining isolation response information for processing to obtain an isolation effect evaluation index, comparing the isolation effect evaluation index with a preset isolation effect evaluation index threshold to obtain system performance monitoring information in a preset time period, extracting performance loss data and processing to obtain a system performance loss index, and comparing the system performance loss index with a preset performance loss index threshold to judge the system performance loss. The malicious behaviors can be accurately identified, the isolation mechanism is immediately triggered, the malicious behaviors are prevented from being further spread and damaged, the isolation effect is quantified, the effectiveness of the isolation mechanism is accurately known, and it is ensured that the isolation mechanism does not affect the system performance.

Description

Technical Field

[0001] The present application relates to the field of cloud phones and big data technology, and more specifically, to an eBPF isolation method, system and medium based on a cloud security phone. Background Art

[0002] With the rapid development of cloud technology and mobile terminal technology, more and more users need terminal application scenarios with internal and external isolation, such as users of mobile terminal devices used in public security, procuratorial and judicial departments, and users who want to separate mobile terminal devices used for work and life. For information security or data confidentiality, these users usually adopt a dual-mobile phone strategy, one mobile phone for life and the other for secure office use. However, using two mobile phones is not only inconvenient to carry, but also brings troubles in operation, so cloud security phones came into being.

[0003] Although traditional cloud security phones have met the needs of users for information security or data confidentiality to a certain extent, they have insufficient control over the isolation mechanism and its impact on system performance, and lack a comprehensive analysis and intuitive reflection of the effectiveness of the isolation mechanism.

[0004] In view of the above problems, effective technical solutions are currently awaited. Summary of the invention

[0005] The purpose of this application is to provide an eBPF isolation method, system and medium based on a cloud security mobile phone, which can obtain cloud security mobile phone monitoring information within a preset time period and extract security tracking information for identification and processing, obtain malicious behavior identification information and trigger the corresponding isolation mechanism, obtain isolation response information for processing to obtain an isolation effect evaluation index, compare the isolation effect evaluation index with a preset isolation effect evaluation index threshold, obtain system performance monitoring information within a preset time period, extract performance loss data for processing to obtain a system performance loss index, and compare it with a preset performance loss index threshold to determine system performance loss. This application can accurately identify malicious behavior and immediately trigger an isolation mechanism to prevent further spread and damage of malicious behavior, quantify the isolation effect, accurately understand the effectiveness of the isolation mechanism, and ensure that the isolation mechanism does not affect system performance.

[0006] The present application provides an eBPF isolation method based on a cloud security mobile phone, characterized in that it includes the following steps:

[0007] Obtain cloud security mobile phone monitoring information within a preset time period and extract security tracking information;

[0008] According to the security tracking information, identification processing is performed through a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism;

[0009] Acquire the isolation response information within the preset time period and process it through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index;

[0010] The isolation effect evaluation index is compared with a preset isolation effect evaluation index threshold, and if the comparison result requirement is met, the system performance monitoring information within a preset time period is obtained;

[0011] The performance loss data is extracted from the system performance monitoring information and processed to obtain a system performance loss index, which is then compared with a preset performance loss index threshold to determine the system performance loss situation.

[0012] Among them, in the eBPF isolation method based on cloud security mobile phone described in the present application, it is characterized in that the identification processing is performed through a preset malicious behavior identification database according to the security tracking information, malicious behavior identification information is obtained and the corresponding isolation mechanism is triggered, specifically:

[0013] Extracting security tracking data according to the security tracking information, including system log record data, network traffic data, file access record data, process call data and user behavior log data;

[0014] According to the system log record data, network traffic data, file access record data, process call data and user behavior log data, identification and processing are performed through a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism.

[0015] Among them, in the eBPF isolation method based on cloud security mobile phone described in this application, it is characterized in that the malicious behavior identification information is obtained and the corresponding isolation mechanism is triggered, specifically:

[0016] Extracting malicious behavior data according to the malicious behavior identification information, including malicious behavior type data, behavior feature data, malicious degree data, and attack source data;

[0017] The corresponding isolation mechanism is triggered according to the malicious behavior type data, behavior feature data, malicious degree data and attack source data, including process call isolation, network data connection isolation and system resource isolation.

[0018] Among them, in the eBPF isolation method based on cloud security mobile phone described in the present application, it is characterized in that the isolation response information within the preset time period is obtained and processed through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index, specifically:

[0019] Obtaining isolation response information within the preset time period, extracting response time data, isolation range data and isolation degree data;

[0020] Processing the response time data, the isolation range data, and the isolation degree data through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index;

[0021] The calculation formula of the isolation behavior evaluation model is:

[0022]

[0023] Among them, G p is the isolation effect evaluation index, m t , g a , g c They are response time data, isolation range data and isolation degree data respectively, and η, v, π1, π2, δ are preset characteristic coefficients.

[0024] Among them, in the eBPF isolation method based on cloud security mobile phone described in the present application, it is characterized in that the isolation effect evaluation index is compared with the preset isolation effect evaluation index threshold, and if the comparison result requirements are met, the system performance monitoring information within the preset time period is obtained, specifically:

[0025] Comparing the isolation effect evaluation index with a preset isolation effect evaluation index threshold to obtain an effect index deviation rate;

[0026] Comparing the effect index deviation rate with a preset effect index deviation rate threshold;

[0027] If the effect index deviation rate is greater than or equal to the preset effect index deviation rate threshold, the isolation effect evaluation index does not meet the requirements and the isolation mechanism needs to be adjusted;

[0028] If the effect index deviation rate is less than a preset effect index deviation rate threshold, the system performance monitoring information within a preset time period is obtained.

[0029] Among them, in the eBPF isolation method based on cloud security mobile phone described in the present application, it is characterized in that the system performance loss index is obtained by extracting performance loss data according to the system performance monitoring information, and is compared with a preset performance loss index threshold to judge the system performance loss situation, specifically:

[0030] Extracting performance loss data according to the system performance monitoring information, including CPU usage data, memory occupancy data, disk operation rate and network bandwidth occupancy data;

[0031] The CPU usage data, memory occupancy data, disk operation rate and network bandwidth occupancy data are processed by a preset system performance evaluation model to obtain a system performance loss index;

[0032] The system performance loss index is compared with a preset performance loss index threshold to determine the system performance loss situation.

[0033] Among them, in the eBPF isolation method based on cloud security mobile phone described in the present application, it is characterized in that the system performance loss index is compared with a preset performance loss index threshold to judge the system performance loss situation, specifically:

[0034] Comparing the system performance loss index with a preset performance loss index threshold;

[0035] If the system performance loss index is greater than or equal to a preset performance loss index threshold, then loss excess data is obtained;

[0036] Counting is performed according to the loss exceeding standard data to obtain loss exceeding standard times data;

[0037] Comparing the loss exceeding the limit number data with a preset exceeding the limit number threshold;

[0038] If the loss exceeds the limit number data is greater than or equal to the threshold number of times, the system performance loss is too large and the system needs to be optimized;

[0039] If the loss exceeding the limit number is less than the exceeding limit number threshold, the system performance loss is within an acceptable range.

[0040] In a second aspect, the present application provides an eBPF isolation system based on a cloud security mobile phone, the system comprising: a memory and a processor, the memory comprising a program of an eBPF isolation method based on a cloud security mobile phone, the program of an eBPF isolation method based on a cloud security mobile phone being executed by the processor to implement the following steps:

[0041] Obtain cloud security mobile phone monitoring information within a preset time period and extract security tracking information;

[0042] According to the security tracking information, identification processing is performed through a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism;

[0043] Acquire the isolation response information within the preset time period and process it through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index;

[0044] The isolation effect evaluation index is compared with a preset isolation effect evaluation index threshold, and if the comparison result requirement is met, the system performance monitoring information within a preset time period is obtained;

[0045] The performance loss data is extracted from the system performance monitoring information and processed to obtain a system performance loss index, which is then compared with a preset performance loss index threshold to determine the system performance loss situation.

[0046] Among them, in the eBPF isolation system based on cloud security mobile phone described in the present application, it is characterized in that the identification and processing are performed through a preset malicious behavior identification database according to the security tracking information, malicious behavior identification information is obtained and the corresponding isolation mechanism is triggered, specifically:

[0047] Extracting security tracking data according to the security tracking information, including system log record data, network traffic data, file access record data, process call data and user behavior log data;

[0048] According to the system log record data, network traffic data, file access record data, process call data and user behavior log data, identification and processing are performed through a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism.

[0049] In the third aspect, the present application also provides a computer-readable storage medium, which includes an eBPF isolation method program based on a cloud security mobile phone. When the eBPF isolation method program based on a cloud security mobile phone is executed by a processor, the steps of an eBPF isolation method based on a cloud security mobile phone as described in any one of the above items are implemented.

[0050] As can be seen from the above, the embodiment of the present application provides an eBPF isolation method, system and medium based on a cloud security mobile phone, by obtaining cloud security mobile phone monitoring information within a preset time period, extracting security tracking information, and then identifying and processing through a preset malicious behavior recognition database, obtaining malicious behavior recognition information and triggering the corresponding isolation mechanism, obtaining the isolation response information of the isolation mechanism corresponding to the time period and processing it through a preset isolation behavior evaluation model, obtaining the isolation effect evaluation index, and comparing the isolation effect evaluation index with the preset isolation effect evaluation index threshold. If the comparison result requirements are met, the system performance monitoring information within the preset time period is obtained, and the performance loss data is extracted according to the system performance monitoring information for processing to obtain the system performance loss index, and compared with the preset performance loss index threshold to judge the system performance loss situation. The present application can actively discover potential security threats and quickly identify them through a malicious behavior recognition database. Once malicious behavior is identified, the isolation mechanism is immediately triggered, which effectively curbs the spread of security threats and reflects the ability of rapid response and active defense. Using a preset malicious behavior recognition database for identification ensures the accuracy and efficiency of identification. By obtaining the isolation response information of the corresponding time period of the isolation mechanism and processing it using the preset isolation behavior evaluation model, a specific isolation effect evaluation index is obtained. This quantifiable evaluation method provides a scientific basis for evaluating the effectiveness of the isolation mechanism, which helps to continuously optimize and improve the isolation strategy. After confirming that the isolation mechanism is effective, further attention is paid to changes in system performance to ensure that the implementation of security measures will not excessively affect system performance and maintain the stability and availability of the system. This application effectively reduces the risk of malicious attacks on cloud security phones and improves the security of mobile phones. Through intelligent and automated processing procedures, it improves the intelligence level of security protection, making security protection more efficient and accurate.

[0051] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or understood by practicing the embodiments of the present application. The purpose and other advantages of the present application can be realized and obtained by the structures particularly pointed out in the written description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0053] Figure 1 A flowchart of an eBPF isolation method based on a cloud security mobile phone provided in an embodiment of the present application;

[0054] Figure 2 A flowchart of obtaining malicious behavior identification information of an eBPF isolation method based on a cloud security mobile phone provided in an embodiment of the present application;

[0055] Figure 3 A flowchart of the triggering corresponding isolation mechanism of an eBPF isolation method based on a cloud security mobile phone provided in an embodiment of the present application;

[0056] Figure 4 A flowchart of obtaining an isolation effect evaluation index for an ebpf isolation method based on a cloud security mobile phone provided in an embodiment of the present application;

[0057] Figure 5 A flowchart of obtaining system performance monitoring information of an eBPF isolation method based on a cloud security mobile phone provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0059] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance. It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0060] Please refer to Figure 1 , Figure 1The flowchart of an eBPF isolation method based on a cloud security mobile phone in some embodiments of the present application. The eBPF isolation method based on a cloud security mobile phone is used in a terminal device, such as a computer, a mobile phone terminal, etc. The eBPF isolation method based on a cloud security mobile phone includes the following steps:

[0061] S101, obtaining cloud security mobile phone monitoring information within a preset time period and extracting security tracking information;

[0062] S102, performing identification processing through a preset malicious behavior identification database according to the security tracking information, obtaining malicious behavior identification information and triggering a corresponding isolation mechanism;

[0063] S103, obtaining the isolation response information within the preset time period and processing it through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index;

[0064] S104, comparing the isolation effect evaluation index with a preset isolation effect evaluation index threshold, and if the comparison result requirement is met, obtaining system performance monitoring information within a preset time period;

[0065] S105 , extracting performance loss data according to the system performance monitoring information, processing the data and obtaining a system performance loss index, and comparing the data with a preset performance loss index threshold to determine the system performance loss situation.

[0066] Among them, the present application obtains cloud security mobile phone monitoring information within a preset time period, extracts security tracking information, and then performs identification processing through a preset malicious behavior recognition database, obtains malicious behavior recognition information and triggers the corresponding isolation mechanism, obtains the isolation response information of the isolation mechanism corresponding to the time period and processes it through a preset isolation behavior evaluation model, obtains the isolation effect evaluation index, and compares the isolation effect evaluation index with the preset isolation effect evaluation index threshold. If the comparison result requirements are met, the system performance monitoring information within the preset time period is obtained, and the performance loss data is extracted according to the system performance monitoring information for processing to obtain the system performance loss index, and compared with the preset performance loss index threshold to judge the system performance loss situation. The present application can actively discover potential security threats and quickly identify them through a malicious behavior recognition database. Once malicious behavior is identified, the isolation mechanism is immediately triggered, which effectively curbs the spread of security threats and reflects the ability of rapid response and active defense. Using the preset malicious behavior recognition database for identification ensures the accuracy and efficiency of identification. By obtaining the isolation response information of the isolation mechanism corresponding to the time period and processing it using the preset isolation behavior evaluation model, a specific isolation effect evaluation index is obtained. This quantifiable evaluation method provides a scientific basis for evaluating the effectiveness of the isolation mechanism, which helps to continuously optimize and improve the isolation strategy. After confirming that the isolation mechanism is effective, further attention is paid to changes in system performance to ensure that the implementation of security measures will not excessively affect system performance and maintain the stability and availability of the system. This application effectively reduces the risk of malicious attacks on cloud security phones and improves the security of mobile phones. Through intelligent and automated processing procedures, it improves the intelligence level of security protection, making security protection more efficient and accurate.

[0067] Please refer to Figure 2 , Figure 2 This is a flowchart of obtaining malicious behavior identification information of an eBPF isolation method based on a cloud security mobile phone in some embodiments of the present application. According to an embodiment of the present invention, the security tracking information is identified and processed through a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism, specifically:

[0068] S201, extracting security tracking data according to the security tracking information, including system log record data, network traffic data, file access record data, process call data and user behavior log data;

[0069] S202: performing identification and processing based on the system log record data, network traffic data, file access record data, process call data and user behavior log data through a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism.

[0070] Among them, in order to identify and effectively isolate malicious behaviors against cloud security phones, security tracking data is extracted according to security tracking information, including system log record data, network traffic data, file access record data, process call data and user behavior log data. System log record data includes system startup / shutdown, login activities, error reports, security events, etc. Network traffic data includes the source address, destination address, port, protocol type, amount of data transmitted, etc. of network requests. File access record data includes the time the file is accessed, the accessing user, the operation type, the file path, etc. Process call data includes process startup, end, system call and other information. User behavior log data includes user login, logout, operation sequence, accessed pages or resources, etc. Feature matching is performed through the preset malicious behavior identification database to identify potential malicious behaviors, obtain malicious behavior identification information and trigger the corresponding isolation mechanism.

[0071] Please refer to Figure 3 , Figure 3 This is a flowchart of triggering a corresponding isolation mechanism of an eBPF isolation method based on a cloud security mobile phone in some embodiments of the present application. According to an embodiment of the present invention, obtaining malicious behavior identification information and triggering a corresponding isolation mechanism are specifically:

[0072] S301, extracting malicious behavior data according to the malicious behavior identification information, including malicious behavior type data, behavior feature data, malicious degree data and attack source data;

[0073] S302. Trigger corresponding isolation mechanisms according to the malicious behavior type data, behavior feature data, maliciousness degree data, and attack source data, including process call isolation, network data connection isolation, and system resource isolation.

[0074] Among them, in order to effectively isolate malicious behavior, malicious behavior data is extracted according to malicious behavior identification information, including malicious behavior type data, behavior feature data, malicious degree data and attack source data to trigger corresponding isolation mechanisms, including process call isolation, network data connection isolation, and system resource isolation. Process call isolation terminates the malicious process when a malicious process or system call is detected, and isolates or deletes files related to the malicious process. Network data connection isolation uses firewall rules to block traffic from malicious IP addresses or domain names when a network connection from a malicious source or an abnormal network traffic pattern is detected. System resource isolation isolates the infected system or components from the network when malicious behavior affects critical system resources or causes system performance degradation, and limits the infected system's access to system resources.

[0075] Please refer to Figure 4 , Figure 4This is a flowchart of obtaining an isolation effect evaluation index of an eBPF isolation method based on a cloud security mobile phone in some embodiments of the present application. According to an embodiment of the present invention, the isolation response information within the preset time period is obtained and processed through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index, specifically:

[0076] S401, obtaining isolation response information within the preset time period, extracting response time data, isolation range data and isolation degree data;

[0077] S402, processing the response time data, the isolation range data, and the isolation degree data through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index;

[0078] The calculation formula of the isolation behavior evaluation model is:

[0079]

[0080] Among them, G p is the isolation effect evaluation index, m t , g a , g c They are response time data, isolation range data and isolation degree data respectively, and η, v, π1, π2, δ are preset characteristic coefficients (the characteristic coefficients are obtained by querying the preset cloud phone database).

[0081] Among them, in order to grasp the effect of the isolation mechanism and reflect it intuitively, the isolation response information of the isolation mechanism corresponding to the time period is obtained, the response time data, isolation range data and isolation degree data are extracted, and processed through the preset isolation behavior evaluation model to obtain the isolation effect evaluation index, which comprehensively and intuitively reflects the effect of the isolation mechanism from the response time, isolation range and degree of the isolation mechanism.

[0082] Please refer to Figure 5 , Figure 5 It is a flowchart of obtaining system performance monitoring information of an eBPF isolation method based on a cloud security mobile phone in some embodiments of the present application. According to an embodiment of the present invention, the isolation effect evaluation index is compared with a preset isolation effect evaluation index threshold, and if the comparison result requirements are met, the system performance monitoring information within a preset time period is obtained, specifically:

[0083] S501, comparing the isolation effect evaluation index with a preset isolation effect evaluation index threshold to obtain an effect index deviation rate;

[0084] S502, comparing the effect index deviation rate with a preset effect index deviation rate threshold;

[0085] S503: If the effect index deviation rate is greater than or equal to the preset effect index deviation rate threshold, the isolation effect evaluation index does not meet the requirements and the isolation mechanism needs to be adjusted;

[0086] S504: If the effect index deviation rate is less than a preset effect index deviation rate threshold, then obtaining system performance monitoring information within a preset time period.

[0087] Among them, in order to improve the isolation effect of the isolation mechanism and understand the impact of isolation behavior on system performance, the isolation effect evaluation index is compared with the preset isolation effect evaluation index threshold to obtain the effect index deviation rate, and the effect index deviation rate is compared with the preset effect index deviation rate threshold. If the effect index deviation rate is greater than or equal to the preset effect index deviation rate threshold, the isolation effect evaluation index does not meet the requirements and the isolation mechanism needs to be adjusted. For example, the response time, isolation range and isolation degree of the isolation mechanism do not meet the requirements. If the effect index deviation rate is less than the preset effect index deviation rate threshold, the system performance monitoring information within the preset time period is obtained. Since the ebpf program is executed directly in the kernel, it is necessary to pay attention to its impact on system performance.

[0088] According to an embodiment of the present invention, the system performance loss index is obtained by extracting performance loss data according to the system performance monitoring information, and compared with a preset performance loss index threshold to determine the system performance loss situation, specifically:

[0089] Extracting performance loss data according to the system performance monitoring information, including CPU usage data, memory occupancy data, disk operation rate and network bandwidth occupancy data;

[0090] The CPU usage data, memory occupancy data, disk operation rate and network bandwidth occupancy data are processed by a preset system performance evaluation model to obtain a system performance loss index;

[0091] The system performance loss index is compared with a preset performance loss index threshold to determine the system performance loss situation.

[0092] In order to understand the loss of system performance caused by the isolation mechanism, performance loss data is extracted according to the system performance monitoring information, including CPU usage data, memory occupancy data, disk operation rate and network bandwidth occupancy data, and processed through a preset system performance evaluation model to obtain a system performance loss index. The system performance loss index is compared with a preset performance loss index threshold to determine the system performance loss situation;

[0093] The calculation formula of the system performance evaluation model is:

[0094]

[0095] Among them, D ψ is the system performance loss index, c t 、n z 、p y , w d They are respectively CPU usage data, memory occupancy data, disk operation speed and network bandwidth occupancy data, and α, ζ, k, v, ∈ are preset characteristic coefficients (the characteristic coefficients are obtained by querying the preset cloud phone database).

[0096] According to an embodiment of the present invention, comparing the system performance loss index with a preset performance loss index threshold to determine the system performance loss situation is specifically as follows:

[0097] Comparing the system performance loss index with a preset performance loss index threshold;

[0098] If the system performance loss index is greater than or equal to a preset performance loss index threshold, then loss excess data is obtained;

[0099] Counting is performed according to the loss exceeding standard data to obtain loss exceeding standard times data;

[0100] Comparing the loss exceeding the limit number data with a preset exceeding the limit number threshold;

[0101] If the loss exceeds the limit number data is greater than or equal to the threshold number of times, the system performance loss is too large and the system needs to be optimized;

[0102] If the loss exceeding the limit number is less than the exceeding limit number threshold, the system performance loss is within an acceptable range.

[0103] Among them, in order to reduce the impact of the isolation mechanism on system performance and reduce system performance loss, the system performance loss index is compared with the preset performance loss index threshold. If the system performance loss index is greater than or equal to the preset performance loss index threshold, the loss exceeding data is obtained, and counting processing is performed based on the loss exceeding data to obtain the loss exceeding times data, and the loss exceeding times data is compared with the preset exceeding times threshold. If the loss exceeding times data is greater than or equal to the exceeding times threshold, the system performance loss is too large and the system needs to be optimized. For example, the loss exceeding times data is 3, and the exceeding times threshold is 3. If the loss exceeding times data is less than the exceeding times threshold, the system performance loss is within an acceptable range.

[0104] According to an embodiment of the present invention, it also includes:

[0105] Acquiring isolation frequency data within the preset time period;

[0106] Comparing the isolation frequency data with a preset isolation frequency threshold;

[0107] If the isolation frequency data is greater than or equal to the isolation frequency threshold, there are too many attack behaviors and system protection needs to be strengthened;

[0108] If the isolation frequency data is less than the isolation frequency threshold, the attack frequency is within the system protection capability.

[0109] Among them, in order to prevent system crashes, the frequency of malicious attack behaviors can be judged according to the behavior trigger frequency of the isolation mechanism. First, the isolation frequency data within the preset time period is obtained, and the isolation frequency data is compared with the preset isolation frequency threshold. If the isolation frequency data is greater than or equal to the isolation frequency threshold, there are too many attack behaviors and the system protection needs to be strengthened. For example, the isolation frequency data is 6 times per minute, and the isolation frequency threshold is 2 times per minute. If the isolation frequency data is less than the isolation frequency threshold, the attack frequency is within the system protection capability.

[0110] The present invention also discloses an eBPF isolation system based on a cloud security mobile phone, comprising a memory and a processor, wherein the memory comprises an eBPF isolation method program based on a cloud security mobile phone, and when the eBPF isolation method program based on a cloud security mobile phone is executed by the processor, the following steps are implemented:

[0111] Obtain cloud security mobile phone monitoring information within a preset time period and extract security tracking information;

[0112] According to the security tracking information, identification processing is performed through a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism;

[0113] Acquire the isolation response information within the preset time period and process it through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index;

[0114] The isolation effect evaluation index is compared with a preset isolation effect evaluation index threshold, and if the comparison result requirement is met, the system performance monitoring information within a preset time period is obtained;

[0115] The performance loss data is extracted from the system performance monitoring information and processed to obtain a system performance loss index, which is then compared with a preset performance loss index threshold to determine the system performance loss situation.

[0116] Among them, the present application obtains cloud security mobile phone monitoring information within a preset time period, extracts security tracking information, and then performs identification processing through a preset malicious behavior recognition database, obtains malicious behavior recognition information and triggers the corresponding isolation mechanism, obtains the isolation response information of the isolation mechanism corresponding to the time period and processes it through a preset isolation behavior evaluation model, obtains the isolation effect evaluation index, and compares the isolation effect evaluation index with the preset isolation effect evaluation index threshold. If the comparison result requirements are met, the system performance monitoring information within the preset time period is obtained, and the performance loss data is extracted according to the system performance monitoring information for processing to obtain the system performance loss index, and compared with the preset performance loss index threshold to judge the system performance loss situation. The present application can actively discover potential security threats and quickly identify them through a malicious behavior recognition database. Once malicious behavior is identified, the isolation mechanism is immediately triggered, which effectively curbs the spread of security threats and reflects the ability of rapid response and active defense. Using the preset malicious behavior recognition database for identification ensures the accuracy and efficiency of identification. By obtaining the isolation response information of the isolation mechanism corresponding to the time period and processing it using the preset isolation behavior evaluation model, a specific isolation effect evaluation index is obtained. This quantifiable evaluation method provides a scientific basis for evaluating the effectiveness of the isolation mechanism, which helps to continuously optimize and improve the isolation strategy. After confirming that the isolation mechanism is effective, further attention is paid to changes in system performance to ensure that the implementation of security measures will not excessively affect system performance and maintain the stability and availability of the system. This application effectively reduces the risk of malicious attacks on cloud security phones and improves the security of mobile phones. Through intelligent and automated processing procedures, it improves the intelligence level of security protection, making security protection more efficient and accurate.

[0117] According to an embodiment of the present invention, the security tracking information is identified and processed by a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism, specifically:

[0118] Extracting security tracking data according to the security tracking information, including system log record data, network traffic data, file access record data, process call data and user behavior log data;

[0119] According to the system log record data, network traffic data, file access record data, process call data and user behavior log data, identification and processing are performed through a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism.

[0120] Among them, in order to identify and effectively isolate malicious behaviors against cloud security phones, security tracking data is extracted according to security tracking information, including system log record data, network traffic data, file access record data, process call data and user behavior log data. System log record data includes system startup / shutdown, login activities, error reports, security events, etc. Network traffic data includes the source address, destination address, port, protocol type, amount of data transmitted, etc. of network requests. File access record data includes the time the file is accessed, the accessing user, the operation type, the file path, etc. Process call data includes process startup, end, system call and other information. User behavior log data includes user login, logout, operation sequence, accessed pages or resources, etc. Feature matching is performed through the preset malicious behavior identification database to identify potential malicious behaviors, obtain malicious behavior identification information and trigger the corresponding isolation mechanism.

[0121] According to an embodiment of the present invention, obtaining malicious behavior identification information and triggering a corresponding isolation mechanism specifically includes:

[0122] Extracting malicious behavior data according to the malicious behavior identification information, including malicious behavior type data, behavior feature data, malicious degree data, and attack source data;

[0123] The corresponding isolation mechanism is triggered according to the malicious behavior type data, behavior feature data, malicious degree data and attack source data, including process call isolation, network data connection isolation and system resource isolation.

[0124] Among them, in order to effectively isolate malicious behavior, malicious behavior data is extracted according to malicious behavior identification information, including malicious behavior type data, behavior feature data, malicious degree data and attack source data to trigger corresponding isolation mechanisms, including process call isolation, network data connection isolation, and system resource isolation. Process call isolation terminates the malicious process when a malicious process or system call is detected, and isolates or deletes files related to the malicious process. Network data connection isolation uses firewall rules to block traffic from malicious IP addresses or domain names when a network connection from a malicious source or an abnormal network traffic pattern is detected. System resource isolation isolates the infected system or components from the network when malicious behavior affects critical system resources or causes system performance degradation, and limits the infected system's access to system resources.

[0125] According to an embodiment of the present invention, the isolation response information within the preset time period is obtained and processed through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index, specifically:

[0126] Obtaining isolation response information within the preset time period, extracting response time data, isolation range data and isolation degree data;

[0127] Processing the response time data, the isolation range data, and the isolation degree data through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index;

[0128] The calculation formula of the isolation behavior evaluation model is:

[0129]

[0130] Among them, G p is the isolation effect evaluation index, m t , g a , g c They are response time data, isolation range data and isolation degree data respectively, and η, v, π1, π2, δ are preset characteristic coefficients (the characteristic coefficients are obtained by querying the preset cloud phone database).

[0131] Among them, in order to grasp the effect of the isolation mechanism and reflect it intuitively, the isolation response information of the isolation mechanism corresponding to the time period is obtained, the response time data, isolation range data and isolation degree data are extracted, and processed through the preset isolation behavior evaluation model to obtain the isolation effect evaluation index, which comprehensively and intuitively reflects the effect of the isolation mechanism from the response time, isolation range and degree of the isolation mechanism.

[0132] According to an embodiment of the present invention, the isolation effect evaluation index is compared with a preset isolation effect evaluation index threshold, and if the comparison result requirement is met, the system performance monitoring information within a preset time period is obtained, specifically:

[0133] Comparing the isolation effect evaluation index with a preset isolation effect evaluation index threshold to obtain an effect index deviation rate;

[0134] Comparing the effect index deviation rate with a preset effect index deviation rate threshold;

[0135] If the effect index deviation rate is greater than or equal to the preset effect index deviation rate threshold, the isolation effect evaluation index does not meet the requirements and the isolation mechanism needs to be adjusted;

[0136] If the effect index deviation rate is less than a preset effect index deviation rate threshold, the system performance monitoring information within a preset time period is obtained.

[0137] Among them, in order to improve the isolation effect of the isolation mechanism and understand the impact of isolation behavior on system performance, the isolation effect evaluation index is compared with the preset isolation effect evaluation index threshold to obtain the effect index deviation rate, and the effect index deviation rate is compared with the preset effect index deviation rate threshold. If the effect index deviation rate is greater than or equal to the preset effect index deviation rate threshold, the isolation effect evaluation index does not meet the requirements and the isolation mechanism needs to be adjusted. For example, the response time, isolation range and isolation degree of the isolation mechanism do not meet the requirements. If the effect index deviation rate is less than the preset effect index deviation rate threshold, the system performance monitoring information within the preset time period is obtained. Since the ebpf program is executed directly in the kernel, it is necessary to pay attention to its impact on system performance.

[0138] According to an embodiment of the present invention, the system performance loss index is obtained by extracting performance loss data according to the system performance monitoring information, and compared with a preset performance loss index threshold to determine the system performance loss situation, specifically:

[0139] Extracting performance loss data according to the system performance monitoring information, including CPU usage data, memory occupancy data, disk operation rate and network bandwidth occupancy data;

[0140] The CPU usage data, memory occupancy data, disk operation rate and network bandwidth occupancy data are processed by a preset system performance evaluation model to obtain a system performance loss index;

[0141] The system performance loss index is compared with a preset performance loss index threshold to determine the system performance loss situation.

[0142] In order to understand the loss of system performance caused by the isolation mechanism, performance loss data is extracted according to the system performance monitoring information, including CPU usage data, memory occupancy data, disk operation rate and network bandwidth occupancy data, and processed through a preset system performance evaluation model to obtain a system performance loss index. The system performance loss index is compared with a preset performance loss index threshold to determine the system performance loss situation;

[0143] The calculation formula of the system performance evaluation model is:

[0144]

[0145] Among them, D ψ is the system performance loss index, c t 、n z 、p y 、w dThey are respectively CPU usage data, memory occupancy data, disk operation rate and network bandwidth occupancy data, and α, ζ, κ, v, ∈ are preset characteristic coefficients (the characteristic coefficients are obtained by querying the preset cloud phone database).

[0146] According to an embodiment of the present invention, comparing the system performance loss index with a preset performance loss index threshold to determine the system performance loss situation is specifically as follows:

[0147] Comparing the system performance loss index with a preset performance loss index threshold;

[0148] If the system performance loss index is greater than or equal to a preset performance loss index threshold, then loss excess data is obtained;

[0149] Counting is performed according to the loss exceeding standard data to obtain loss exceeding standard times data;

[0150] Comparing the loss exceeding the limit number data with a preset exceeding the limit number threshold;

[0151] If the loss exceeds the limit number data is greater than or equal to the threshold number of times, the system performance loss is too large and the system needs to be optimized;

[0152] If the loss exceeding the limit number is less than the exceeding limit number threshold, the system performance loss is within an acceptable range.

[0153] Among them, in order to reduce the impact of the isolation mechanism on system performance and reduce system performance loss, the system performance loss index is compared with the preset performance loss index threshold. If the system performance loss index is greater than or equal to the preset performance loss index threshold, the loss exceeding data is obtained, and counting processing is performed based on the loss exceeding data to obtain the loss exceeding times data, and the loss exceeding times data is compared with the preset exceeding times threshold. If the loss exceeding times data is greater than or equal to the exceeding times threshold, the system performance loss is too large and the system needs to be optimized. For example, the loss exceeding times data is 3, and the exceeding times threshold is 3. If the loss exceeding times data is less than the exceeding times threshold, the system performance loss is within an acceptable range.

[0154] According to an embodiment of the present invention, it also includes:

[0155] Acquiring isolation frequency data within the preset time period;

[0156] Comparing the isolation frequency data with a preset isolation frequency threshold;

[0157] If the isolation frequency data is greater than or equal to the isolation frequency threshold, there are too many attack behaviors and system protection needs to be strengthened;

[0158] If the isolation frequency data is less than the isolation frequency threshold, the attack frequency is within the system protection capability.

[0159] Among them, in order to prevent system crashes, the frequency of malicious attack behaviors can be judged according to the behavior trigger frequency of the isolation mechanism. First, the isolation frequency data within the preset time period is obtained, and the isolation frequency data is compared with the preset isolation frequency threshold. If the isolation frequency data is greater than or equal to the isolation frequency threshold, there are too many attack behaviors and the system protection needs to be strengthened. For example, the isolation frequency data is 6 times per minute, and the isolation frequency threshold is 2 times per minute. If the isolation frequency data is less than the isolation frequency threshold, the attack frequency is within the system protection capability.

[0160] The third aspect of the present invention provides a computer-readable storage medium, which includes an eBPF isolation method program based on a cloud security mobile phone. When the eBPF isolation method program based on a cloud security mobile phone is executed by a processor, the steps of an eBPF isolation method based on a cloud security mobile phone as described in any one of the above items are implemented.

[0161] The present invention discloses an eBPF isolation method, system and medium based on a cloud security mobile phone. By acquiring cloud security mobile phone monitoring information within a preset time period, extracting security tracking information, and then performing identification processing through a preset malicious behavior recognition database, malicious behavior recognition information is obtained and a corresponding isolation mechanism is triggered. The isolation response information of the isolation mechanism corresponding to the time period is obtained and processed through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index, and the isolation effect evaluation index is compared with a preset isolation effect evaluation index threshold. If the comparison result requirements are met, the system performance monitoring information within the preset time period is obtained, and the performance loss data is extracted according to the system performance monitoring information for processing to obtain a system performance loss index, and the system performance loss index is compared with the preset performance loss index threshold to determine the system performance loss situation. The present application can actively discover potential security threats and quickly identify them through a malicious behavior recognition database. Once malicious behavior is identified, the isolation mechanism is immediately triggered, which effectively curbs the spread of security threats and reflects the ability of rapid response and active defense. The preset malicious behavior recognition database is used for identification to ensure the accuracy and efficiency of identification. By obtaining the isolation response information of the isolation mechanism corresponding to the time period and processing it using a preset isolation behavior evaluation model, a specific isolation effect evaluation index is obtained. This quantifiable evaluation method provides a scientific basis for evaluating the effectiveness of the isolation mechanism, which helps to continuously optimize and improve the isolation strategy. After confirming that the isolation mechanism is effective, further attention is paid to changes in system performance to ensure that the implementation of security measures will not excessively affect system performance and maintain the stability and availability of the system. This application effectively reduces the risk of malicious attacks on cloud security phones and improves the security of mobile phones. Through intelligent and automated processing procedures, it improves the intelligence level of security protection, making security protection more efficient and accurate.

[0162] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0163] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0164] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0165] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a readable storage medium, which, when executed, executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories, random access memories, magnetic disks or optical disks, and other media that can store program codes.

[0166] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

Claims

1. An eBPF isolation method based on cloud security mobile phone, characterized in that: The following steps are involved: Obtain cloud security mobile phone monitoring information within a preset time period and extract security tracking information; According to the security tracking information, identification processing is performed through a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism; Acquire the isolation response information within the preset time period and process it through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index; The isolation effect evaluation index is compared with a preset isolation effect evaluation index threshold, and if the comparison result requirement is met, the system performance monitoring information within a preset time period is obtained; The performance loss data is extracted from the system performance monitoring information and processed to obtain a system performance loss index, which is then compared with a preset performance loss index threshold to determine the system performance loss situation.

2. According to claim 1, an eBPF isolation method based on cloud security mobile phone is characterized in that: The security tracking information is identified and processed by using a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism, specifically: Extracting security tracking data according to the security tracking information, including system log record data, network traffic data, file access record data, process call data and user behavior log data; According to the system log record data, network traffic data, file access record data, process call data and user behavior log data, identification and processing are performed through a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism.

3. According to claim 2, a method for isolating ebpf based on cloud security mobile phone is characterized in that: The obtaining of malicious behavior identification information and triggering of a corresponding isolation mechanism are specifically: Extracting malicious behavior data according to the malicious behavior identification information, including malicious behavior type data, behavior feature data, malicious degree data, and attack source data; The corresponding isolation mechanism is triggered according to the malicious behavior type data, behavior feature data, malicious degree data and attack source data, including process call isolation, network data connection isolation and system resource isolation.

4. According to claim 3, the eBPF isolation method based on cloud security mobile phone is characterized in that: The isolation response information within the preset time period is obtained and processed through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index, specifically: Obtaining isolation response information within the preset time period, extracting response time data, isolation range data and isolation degree data; Processing the response time data, the isolation range data, and the isolation degree data through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index; The calculation formula of the isolation behavior evaluation model is: Among them, G p is the isolation effect evaluation index, m t , g a , g c They are response time data, isolation range data and isolation degree data respectively, and η, v, π1, π2, δ are preset characteristic coefficients.

5. According to claim 4, the eBPF isolation method based on cloud security mobile phone is characterized in that: The isolation effect evaluation index is compared with a preset isolation effect evaluation index threshold, and if the comparison result requirement is met, the system performance monitoring information within a preset time period is obtained, specifically: Comparing the isolation effect evaluation index with a preset isolation effect evaluation index threshold to obtain an effect index deviation rate; Comparing the effect index deviation rate with a preset effect index deviation rate threshold; If the effect index deviation rate is greater than or equal to the preset effect index deviation rate threshold, the isolation effect evaluation index does not meet the requirements and the isolation mechanism needs to be adjusted; If the effect index deviation rate is less than a preset effect index deviation rate threshold, the system performance monitoring information within a preset time period is obtained.

6. According to the eBPF isolation method based on cloud security mobile phone according to claim 5, it is characterized in that: The system performance loss index is obtained by extracting performance loss data according to the system performance monitoring information, and is compared with a preset performance loss index threshold to determine the system performance loss situation, specifically: Extracting performance loss data according to the system performance monitoring information, including CPU usage data, memory occupancy data, disk operation rate and network bandwidth occupancy data; The CPU usage data, memory occupancy data, disk operation rate and network bandwidth occupancy data are processed by a preset system performance evaluation model to obtain a system performance loss index; The system performance loss index is compared with a preset performance loss index threshold to determine the system performance loss situation.

7. According to claim 6, an eBPF isolation method based on cloud security mobile phone is characterized in that: The system performance loss index is compared with a preset performance loss index threshold to determine the system performance loss situation, specifically: Comparing the system performance loss index with a preset performance loss index threshold; If the system performance loss index is greater than or equal to a preset performance loss index threshold, then loss excess data is obtained; Counting is performed according to the loss exceeding standard data to obtain loss exceeding standard times data; Comparing the loss exceeding the limit number data with a preset exceeding the limit number threshold; If the loss exceeds the limit number data is greater than or equal to the threshold number of times, the system performance loss is too large and the system needs to be optimized; If the loss exceeding the limit number is less than the exceeding limit number threshold, the system performance loss is within an acceptable range.

8. An eBPF isolation system based on cloud security mobile phone, characterized in that: The invention comprises a memory and a processor, wherein the memory comprises an eBPF isolation method program based on a cloud security mobile phone, and the eBPF isolation method program based on a cloud security mobile phone is executed by the processor to implement the following steps: Obtain cloud security mobile phone monitoring information within a preset time period and extract security tracking information; According to the security tracking information, identification processing is performed through a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism; Acquire the isolation response information within the preset time period and process it through a preset isolation behavior evaluation model to obtain an isolation effect evaluation index; The isolation effect evaluation index is compared with a preset isolation effect evaluation index threshold, and if the comparison result requirement is met, the system performance monitoring information within a preset time period is obtained; The performance loss data is extracted from the system performance monitoring information and processed to obtain a system performance loss index, which is then compared with a preset performance loss index threshold to determine the system performance loss situation.

9. The eBPF isolation system based on cloud security mobile phone according to claim 8 is characterized in that: The security tracking information is identified and processed by using a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism, specifically: Extracting security tracking data according to the security tracking information, including system log record data, network traffic data, file access record data, process call data and user behavior log data; According to the system log record data, network traffic data, file access record data, process call data and user behavior log data, identification and processing are performed through a preset malicious behavior identification database to obtain malicious behavior identification information and trigger a corresponding isolation mechanism.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes an eBPF isolation method program based on a cloud security mobile phone. When the eBPF isolation method program based on a cloud security mobile phone is executed by a processor, the steps of an eBPF isolation method based on a cloud security mobile phone as described in any one of claims 1 to 7 are implemented.

Images