Method and device for monitoring version updating safety of POS machine software

Abstract

The invention discloses a POS machine software version update security monitoring method and device, and relates to the technical field of information security, and the method comprises the steps: obtaining a version update data packet; analyzing the data packet and obtaining an update function group; analyzing the security level of the update function group, and if the security level is greater than or equal to a preset security level, obtaining a first-level security monitoring instruction; performing deep correlation monitoring on the updated function group according to the instruction, and outputting a deep correlation monitoring data set; and performing security analysis based on the monitoring data set, outputting an associated risk index, and if the associated risk index is smaller than a preset value, performing update deployment on the POS terminal according to the update function group. The technical problem that potential safety risks in POS machine software version updating cannot be effectively monitored, prevented and controlled is solved, and the effect of comprehensive safety guarantee in the version updating process is achieved by monitoring the safety levels of the updating function groups in a graded mode and executing safety monitoring of the corresponding levels according to different safety requirements.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method and device for monitoring the version update security of POS machine software. Background Art

[0002] With the rapid development of electronic payment systems, POS (Point of Sale) machines, as an important electronic payment terminal device, have been widely used in various merchants, retail stores and service industries. Regular updates of POS machine software are an important means to maintain its functionality, security and stable performance. However, in the process of updating POS machine software versions, there are potential security risks, which may cause the system to suffer malicious attacks or data leakage, thereby affecting the security of transactions and customer trust. In the existing POS machine software update process, there is usually a lack of comprehensive security monitoring means for the update content, especially the lack of effective security level analysis of update data packages and update function groups. Since the security of update functions is not graded and monitored, low-risk and high-risk update operations are handled uniformly, which makes it easy to ignore vulnerabilities or malicious codes that may exist in high-risk updates. In addition, for the deployed update function groups, the existing technology lacks more comprehensive security analysis mechanisms such as deep code review and dynamic behavior analysis, making it difficult to discover hidden security risks in a timely manner. Summary of the invention

[0003] The present application solves the technical problem that potential security risks in POS machine software version updates cannot be effectively monitored and controlled by providing a version update security monitoring method and device for POS machine software. It achieves the effect of comprehensive security protection of the version update process by performing hierarchical monitoring of the security levels of update function groups and performing corresponding levels of security monitoring according to different security requirements.

[0004] The present application provides a version update security monitoring method for POS machine software, the method comprising: obtaining a version update data packet of the POS machine software; analyzing the version update data packet to obtain an update function group; analyzing the security level of the update function group, and if the security level of the update function group is greater than or equal to a preset security level, obtaining a first-level security monitoring instruction; performing deep correlation monitoring on the update function group according to the first-level security monitoring instruction, and outputting a deep correlation monitoring data set, including deep code review data, associated vulnerability scanning data, and dynamic behavior analysis data; performing security analysis based on the deep code review data, associated vulnerability scanning data, and dynamic behavior analysis data, and outputting an associated risk indicator, and if the associated risk indicator is less than the preset associated risk indicator, performing update deployment to the terminal of the POS machine software according to the update function group.

[0005] The present application also provides a version update security monitoring device for POS machine software, including: an update data packet acquisition module, the update data packet acquisition module is used to obtain the version update data packet of the POS machine software; an update data packet analysis module, the update data packet analysis module is used to analyze the version update data packet and obtain an update function group; a security level analysis module, the security level analysis module is used to analyze the security level of the update function group, if the security level of the update function group is greater than or equal to the preset security level, obtain a first-level security monitoring instruction; a deep correlation monitoring module, the deep correlation monitoring module is used to perform deep correlation monitoring on the update function group according to the first-level security monitoring instruction, and output a deep correlation monitoring data set, including deep code review data, associated vulnerability scanning data and dynamic behavior analysis data; an update deployment module, the update deployment module is used to perform security analysis based on the deep code review data, associated vulnerability scanning data and dynamic behavior analysis data, and output an associated risk indicator. If the associated risk indicator is less than the preset associated risk indicator, update deployment is performed to the terminal of the POS machine software according to the update function group.

[0006] The method and device for monitoring the version update security of POS software proposed in this application are used to obtain the version update data packet of POS software; analyze the version update data packet to obtain the update function group; analyze the security level of the update function group, and if the security level of the update function group is greater than or equal to the preset security level, obtain the first-level security monitoring instruction; perform deep correlation monitoring on the update function group according to the first-level security monitoring instruction, and output a deep correlation monitoring data set, including deep code review data, associated vulnerability scanning data, and dynamic behavior analysis data; perform security analysis based on the deep code review data, associated vulnerability scanning data, and dynamic behavior analysis data, and output an associated risk index. If the associated risk index is less than the preset associated risk index, update and deploy the POS software terminal according to the update function group. The technical problem that the potential security risks in the version update of POS software cannot be effectively monitored and controlled is solved, and the effect of achieving comprehensive security protection of the version update process is achieved by performing hierarchical monitoring on the security level of the update function group and performing corresponding levels of security monitoring according to different security requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] In order to more clearly illustrate the technical solution of the embodiment of the present disclosure, the accompanying drawings of the embodiment of the present disclosure will be briefly introduced below. A flow chart is used in the present application to illustrate the operations performed by the device according to the embodiment of the present application. It should be understood that the previous or following operations are not necessarily performed precisely in order. On the contrary, various steps can be processed in reverse order or simultaneously as needed. At the same time, other operations can also be added to these processes, or one or more operations can be removed from these processes.

[0008] Figure 1 A flowchart of a method for monitoring the security of POS software version updates provided in an embodiment of the present application; Figure 2 A schematic diagram of the structure of a POS software version update security monitoring device provided in an embodiment of the present application.

[0009] Explanation of the accompanying drawings: update data packet acquisition module 1, update data packet analysis module 2, security level analysis module 3, deep correlation monitoring module 4, update deployment module 5. DETAILED DESCRIPTION

[0010] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below.

[0011] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0012] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict, and the terms "first\second" involved are merely to distinguish similar objects and do not represent a specific ordering of objects. The terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by technicians in the technical field of this application. The terms used herein are for the purpose of describing the embodiments of the present application only.

[0013] The present application embodiment provides a method for monitoring the security of POS software version updates, such as Figure 1 As shown, the method includes: Get the version update package of the POS software.

[0014] In an embodiment of the present application, when the POS machine performs a software version upgrade, the system terminal downloads the required update files from a server or a designated update source (such as a web page). These update data packets usually contain new features of the software, fixed vulnerabilities, or performance optimization codes. This process ensures that the software of the POS machine can regularly obtain the latest functions or security patches to improve the overall performance and security of the terminal of the POS machine software. In the process of obtaining the data packet, the security of the data source is usually verified to prevent data loss or tampering during the download process.

[0015] Furthermore, the present application provides a method for obtaining a version update data packet of the POS machine software, including: Determine whether the update data packet is obtained through a web page jump. If it is obtained through a web page jump, collect the jump web page information; perform a web page security check based on the jump web page information, output a web page security index, and generate risk warning information if the web page security index is less than a preset web page security index.

[0016] Preferably, when acquiring the version update data packet, the system terminal will determine the source of the data. If the data source of the version update data packet is downloaded after a web page jump, the relevant information of the web page will be collected to form the jump web page information, including the URL of the web page, the jump path, the source website information, etc. Subsequently, a security detection tool (such as Tenable.io) is called to evaluate the security of the web page, and a web page security index is generated to quantify the security of the web page. The detection content includes the SSL / TLS certificate configuration of the web page (to ensure whether the transmission encryption is safe and effective), the integrity and security of the web page content (checking whether there is malicious code, script injection or phishing content), the security of third-party resources (analyzing whether the page references unsafe external resources or scripts), vulnerability scanning (detecting whether the web page has known vulnerabilities, such as SQL injection, cross-site scripting attacks, etc.). After the detection is completed, if the web page security index of the web page is lower than the preset web page security index, the system terminal will immediately generate a risk reminder, including the web page security index, specific risk details, etc. By sending this risk reminder information, the administrator can be notified that the web page has security risks to prevent possible malicious attacks or data leaks.

[0017] The version update data packet is analyzed to obtain an update function group.

[0018] In one embodiment, after receiving the version update data packet, the system terminal extracts the content of the update data packet through a parsing tool, such as the file structure, update log, modified code part, etc. The parsing can be performed through a file difference analysis tool or the instructions in the update script. After parsing the update data packet, identify which functional modules have changed. This includes the identification of new functions, modified functions, and repaired functions. For example, a new function may be a function that supports a new payment method, such as the introduction of mobile payment (such as Apple Pay, Google Pay) or cryptocurrency payment. A modified function may be an optimization or adjustment of an existing payment function, such as speeding up payment processing or improving the payment experience. A repair function may be a repair of a known problem (such as an error or vulnerability). The system terminal will classify these functional changes into update functional groups based on the update content. For example, support for new payment methods or security enhancement functions will be classified as a payment security functional group, while small UI adjustments or performance optimizations may be classified as an interface and performance optimization functional group. The purpose of this step is to classify different types of updates so that targeted security testing and verification can be performed later. Through this process, the system terminal can clearly identify the specific functional changes in the version update package and classify these changes into different functional groups, providing a basis for subsequent security testing and update deployment.

[0019] The security level of the update function group is analyzed, and if the security level of the update function group is greater than or equal to a preset security level, a first-level security monitoring instruction is obtained.

[0020] In one embodiment, the system terminal performs a preliminary assessment of the security impact based on the preset security risk assessment criteria and the nature of the update function group. The assessment criteria include the importance of the function, the impact of the function on the core part of the system, whether sensitive data (such as payment information, user identity authentication) is involved, whether there are known vulnerabilities in history, etc. If the update directly involves core functions such as payment functions and identity authentication, the corresponding update functions in the update function group will be directly determined as first-level risks because they directly affect transaction security and data protection. Updates related to important functions such as device connection management, printing and electronic invoices will be classified as second-level risks. Functions related to interface optimization and performance optimization will be classified as third-level risks because they have little impact on the core security of the POS machine. Subsequently, the system terminal counts the number of first-level risks, the number of second-level risks, and the number of third-level risks, and performs weighted calculation on the number of the three risks according to the preset weights to obtain the security level of the update function group. Among them, the preset weights include first-level risk weights, second-level risk weights, and third-level risk weights, which are determined based on the frequency of historical security events. After that, the security level of the updated function group is compared with the preset security level standard. If the security level of the updated function group is greater than or equal to the preset security level, the system terminal will automatically generate a first-level security monitoring instruction. The first-level security monitoring instruction is a more intensive security inspection procedure, including deep code review, associated vulnerability scanning and dynamic behavior analysis to ensure that the function group does not bring security risks before formal deployment.

[0021] Furthermore, the present application also includes: If the security level of the update function group is lower than the preset security level, obtain a second-level security monitoring instruction; perform basic verification on the update function group according to the second-level security monitoring instruction, including signature verification, integrity verification and static code verification; when the signature verification, integrity verification and static code verification are all verified to pass, perform update deployment to the terminal of the POS software according to the update function group.

[0022] Optionally, if the security level of the update function group is lower than the preset security level, the system terminal automatically generates a second-level security monitoring instruction for the update function group. Based on this second-level security monitoring instruction, the corresponding security detection tool (GitLab) is called to perform basic verification on the update function group, and OpenSSL or GPG is integrated through a custom CI / CD step to verify the signature of the update function group, and the digital signature of the update data packet is checked to ensure that the data packet comes from a trusted source and has not been tampered with. The integrity verification is performed through a hash verification tool to ensure that the file is not damaged or modified during the transmission process, and the accuracy of the update content is guaranteed. Static code verification is performed through the built-in static code scanning tool to find potential security risks or vulnerabilities and ensure that the updated code does not bring security risks. If all three verifications pass, the system terminal will deploy the update to the terminal of the POS software according to the content of the update function group. This ensures the basic security of the update process, and even the update function group with a lower risk level has undergone necessary security testing.

[0023] Furthermore, the present application also includes: When one of the signature verification, integrity verification and static code verification fails, a second rollback instruction is obtained, wherein the second rollback instruction includes a second response time, and the first response time is less than the second response time; when the terminal of the POS software receives the second rollback instruction, the state of the POS software is rolled back to the initial state according to the second response time.

[0024] Optionally, if any of the signature verification, integrity verification or static code verification fails, the system terminal will automatically obtain a second rollback instruction. The instruction contains a second response duration, which is the time delay before the system terminal performs the rollback operation. This second response duration is longer than the first response duration when the first-level security monitoring instruction is executed and the verification fails. When the POS software terminal receives the second rollback instruction, it will restore the software status to the initial state before the update within the specified second response duration. This operation ensures that the POS machine can safely return to the previous stable version when potential risks or problems are discovered, while providing managers with sufficient time to deal with the problem.

[0025] The update function group is subjected to deep correlation monitoring according to the first-level security monitoring instruction, and a deep correlation monitoring data set is output, including deep code review data, correlation vulnerability scanning data and dynamic behavior analysis data.

[0026] In one embodiment, the system terminal calls the corresponding security detection tool (GitLab) according to the first-level security monitoring instruction to perform deep correlation monitoring on the update function group, and integrates static code analysis tools (such as SonarQube or Checkmarx) through the GitLab CI / CD pipeline to perform detailed inspections on the code in the update function group, analyze the code structure, logic and potential vulnerabilities, find possible security risks or parts that do not meet security standards, and generate deep code review data. Through the built-in dependency scanning function, identify and compare vulnerabilities in third-party libraries to determine whether the update function group contains known security vulnerabilities. This process can identify historical vulnerabilities related to the update content or potential security issues of third-party dependencies, and generate associated vulnerability scanning data. Through CI / CD, integrate third-party runtime monitoring tools (such as Dynatrace) to monitor the running behavior of the update function group in a simulated running environment to detect whether there are abnormal operations, illegal calls or abnormal system interaction behaviors. Dynamic behavior analysis can discover potential risks that static code inspection cannot identify and generate dynamic behavior analysis data. The security detection tool then aggregates the generated deep code review data, correlated vulnerability scanning data, and dynamic behavior analysis data into a deep correlated monitoring dataset and outputs it for further evaluation of the security of the updated functional group, ensuring that all possible security issues are addressed before the update is deployed.

[0027] A security analysis is performed based on the deep code review data, associated vulnerability scanning data, and dynamic behavior analysis data, and an associated risk indicator is output. If the associated risk indicator is less than a preset associated risk indicator, an update is deployed to the terminal of the POS software according to the update function group.

[0028] In one embodiment, after obtaining the deep code review data, associated vulnerability scanning data, and dynamic behavior analysis data, the system terminal combines the deep anomaly comparison library and the feature convolution network to perform a comprehensive security analysis of the deep code review data, associated vulnerability scanning data, and dynamic behavior analysis data, including abnormal data identification, feature convolution, etc., to evaluate the potential security risks of the updated function group. By analyzing these data, the system terminal generates an associated risk index to quantify the security of the update. If the associated risk index is lower than the preset associated risk index, the system terminal will determine that the updated function group is safe and can continue to deploy the update. In this way, the version update data packet will be sent to the terminal of the POS software for installation and application, ensuring that the updated content will not cause any major security issues after a sufficient security review.

[0029] Furthermore, the present application also includes: If the associated risk indicator is greater than or equal to the preset associated risk indicator, a first rollback instruction is obtained, wherein the first rollback instruction includes a first response time; when the terminal of the POS software receives the first rollback instruction, the state of the POS software is rolled back to the initial state according to the first response time.

[0030] Preferably, if the associated risk index is greater than or equal to the preset associated risk index, the system terminal will automatically generate a first rollback instruction. The rollback instruction includes a first response time, that is, the time required before the rollback operation is performed. When the terminal of the POS software receives this rollback instruction, it will quickly restore the POS software to its initial state before the update within the set first response time. This ensures that when a potential major security risk is detected, the system terminal can roll back in time to avoid greater problems or security risks caused by the updated content.

[0031] Furthermore, the present application provides security analysis based on the deep code review data, associated vulnerability scanning data and dynamic behavior analysis data, and outputs associated risk indicators, including: Construct a deep anomaly comparison library; perform abnormal data identification on the deep code review data, associated vulnerability scanning data, and dynamic behavior analysis data respectively by calling the deep anomaly comparison library, and output abnormal code data, abnormal vulnerability scanning data, and abnormal behavior analysis data; perform feature convolution on the abnormal code data, abnormal vulnerability scanning data, and abnormal behavior analysis data, and output a feature convolution matrix; perform matrix calculation on the feature convolution matrix, and output an associated risk indicator.

[0032] Preferably, in order to quickly identify the anomalies in the deep code review data, the associated vulnerability scanning data and the dynamic behavior analysis data, the system terminal constructs a deep anomaly comparison library, which contains data of various known abnormal patterns and security issues for subsequent comparison and analysis. The system terminal calls this deep anomaly comparison library, analyzes and compares the deep code review data, the associated vulnerability scanning data and the dynamic behavior analysis data according to the Euclidean distance, identifies the data whose Euclidean distance of the abnormal data is less than the preset distance and extracts them, and generates abnormal code data, abnormal vulnerability scanning data and abnormal behavior analysis data. Among them, the abnormal code data contains potential security vulnerabilities in the identified code or code parts that do not meet the security standards. The abnormal vulnerability scanning data contains known vulnerabilities extracted from the vulnerability scanning results that match the records in the comparison library. The abnormal behavior analysis data contains abnormal behavior or abnormal system interaction data when the application is running. Subsequently, the system terminal performs feature convolution on these abnormal data, that is, extracts key features from the data according to the feature convolution network, and generates a feature convolution matrix. This matrix contains important information in these abnormal data, such as abnormal code proportion, CVE score, abnormal network request, etc. Subsequently, the generated feature convolution matrix is ​​calculated and combined with the weights of various types of data to obtain a comprehensive correlation risk index. This index is used to evaluate the overall security risk of the update function group and determine whether the update can be deployed safely.

[0033] Further, the present application provides feature convolution of the abnormal code data, abnormal vulnerability scanning data and abnormal behavior analysis data, including: Generate a feature convolution network; use the feature convolution network to perform feature convolution on the abnormal code data, and output abnormal code features, including abnormal code proportion, abnormal hard-coded credential number, and abnormal API call; use the feature convolution network to perform feature convolution on the abnormal vulnerability scanning data, and output abnormal vulnerability features, including CVE score, vulnerability severity level, and vulnerability impact range; use the feature convolution network to perform feature convolution on the abnormal behavior analysis data, and output abnormal behavior features, including abnormal network requests, abnormal behavior logs, and abnormal performance usage; output a feature convolution matrix based on the abnormal code features, the abnormal vulnerability features, and the abnormal behavior features.

[0034] Optionally, in the process of generating the feature convolution network, the system terminal first prepares a sample data set with labels. This sample data set includes abnormal code data, associated vulnerability scanning data, and dynamic behavior analysis data. The abnormal code data has labels of abnormal code ratio, abnormal hard-coded credentials, and abnormal API calls. The associated vulnerability scanning data has labels of CVE score, vulnerability severity level, and vulnerability impact range. The dynamic behavior analysis data has labels of abnormal network requests, abnormal behavior logs, and abnormal performance usage. After preparing the sample data set, the feature convolution network is designed, including input layer, convolution layer, activation function, pooling layer, fully connected layer, and output layer. In the network structure, the data is input to the input layer, and convolution operation is performed through multiple convolution kernels to extract local features of the data. The convolution kernel scans the input data point by point and extracts potential abnormal patterns or features through calculation, such as vulnerabilities in the code or abnormal operations in the behavior. The convolutional features are processed by the ReLU activation function. The introduction of the activation function allows the network to learn more complex nonlinear features, helping to identify anomalies more accurately. The pooling layer is used to reduce the dimension of the data, reduce the computational complexity while retaining the most critical features, and ensure that the extracted features are representative. After the feature map is pooled, it is flattened into a one-dimensional vector and input to the fully connected layer. The fully connected layer maps the extracted features to the output space to generate the final prediction value. When the network is initialized, the weight and bias parameters can be set by random initialization or pre-trained models, and are continuously updated through the training process to improve the performance of the network. During the training process, the sample data set is passed to each layer of the convolutional network through forward propagation. Through the convolution, pooling and fully connected layers, the output results are generated. These outputs are compared with the actual labels, and the error between the output results and the actual labels is calculated through the loss function (such as cross entropy loss). The larger the error, the less accurate the prediction result of the network. Subsequently, the gradient of the error is calculated through backpropagation, and the weights and biases of the network are updated layer by layer. The weights are adjusted using optimization algorithms such as stochastic gradient descent or Adam algorithm to gradually reduce the error so that the network can better learn the correct features from the input data. Through multiple cycles of forward propagation and back propagation, the convolution kernel gradually learns how to identify abnormal code snippets, vulnerability patterns, and abnormal system behaviors, and its feature extraction capabilities are continuously enhanced. In this process, the network will gradually learn to extract key features from various abnormal data from the input data.

[0035] After generating the feature convolution network, the system terminal uses the trained feature convolution network to perform feature convolution processing on the abnormal code data to extract key abnormal code features. These features include abnormal code ratio, number of abnormal hard-coded credentials, and abnormal API calls. Feature convolution processing is performed on the abnormal vulnerability scanning data to extract key abnormal vulnerability features. These features include CVE score, vulnerability severity level, and vulnerability impact range. Feature convolution processing is performed on the abnormal behavior analysis data to extract key abnormal behavior features. These features include abnormal network requests, abnormal behavior logs, and abnormal performance usage. Subsequently, the system terminal organizes each category of extracted features into a vector form. Taking abnormal code features as an example, this category includes three sub-features: abnormal code ratio, abnormal hard-coded credentials, and abnormal API calls. Each sub-feature will become an element in the vector. Similarly, abnormal vulnerability features and abnormal behavior features will also be constructed into their own vectors. Once these vectors are constructed, the system terminal arranges these vectors together in rows or columns to generate a matrix. Each row or column represents a feature of a category, and each element in it corresponds to a specific sub-feature under that category. For example, the proportion of abnormal code features, the number of hard-coded credentials, and the number of API calls will constitute one row of the matrix; CVE scores, vulnerability severity levels, and impact scope will constitute another row; abnormal network requests, behavior logs, and performance usage will constitute the third row. Through this arrangement, the system terminal integrates all features into a matrix. The final feature convolution matrix not only saves all the extracted features, but also allows the relationship between features of each category to be further analyzed through matrix operations. This matrix structure can help the system terminal efficiently process and calculate the relative importance or weight of each feature, and provide the necessary data basis for subsequent risk assessment.

[0036] Furthermore, the present application provides a method for performing matrix calculation on the feature convolution matrix and outputting associated risk indicators, including: The feature convolution matrix is ​​normalized and the processed feature convolution matrix is ​​output; an association weight matrix is ​​configured, vector calculation is performed on the processed feature convolution matrix according to the association weight matrix, and an association risk index is output.

[0037] Optionally, the system terminal normalizes each element of the feature convolution matrix so that its value is between 0 and 1. Common methods of normalization include minimum and maximum normalization and Z-score normalization, which can ensure that all features are compared under the same standard. After normalization, the system terminal will obtain a new processed feature convolution matrix, and the values ​​in the matrix reflect the relative strength of each feature under the same standard. Subsequently, an association weight matrix is ​​configured. This matrix is ​​used to represent the importance of each feature in the overall risk assessment. These weights are obtained based on historical data analysis and expert opinions, with the purpose of emphasizing that some features may have a higher influence in risk assessment. After that, the processed feature convolution matrix is ​​vectorized using the configured association weight matrix. By multiplying the weight matrix with the feature convolution matrix, a comprehensive association risk index is obtained. This index reflects the relative contribution of each feature in the overall risk assessment, thereby helping the system terminal to judge the overall safety of the update function group. Finally, the output association risk index will provide a basis for subsequent security decisions.

[0038] In the above, refer to Figure 1 The POS software version update security monitoring method according to the embodiment of the present invention is described in detail. Figure 2 A POS machine software version update security monitoring device according to an embodiment of the present invention is described.

[0039] The POS software version update security monitoring device according to the embodiment of the present invention is used to solve the technical problem that potential security risks in the POS software version update cannot be effectively monitored and controlled, and achieves the effect of comprehensive security protection of the version update process by hierarchical monitoring of the security level of the update function group and performing corresponding level security monitoring according to different security requirements. The POS software version update security monitoring device includes: an update data packet acquisition module 1, an update data packet analysis module 2, a security level analysis module 3, a deep correlation monitoring module 4, and an update deployment module 5.

[0040] An update data packet acquisition module 1, the update data packet acquisition module 1 is used to obtain the version update data packet of the POS machine software; an update data packet analysis module 2, the update data packet analysis module 2 is used to analyze the version update data packet and obtain the update function group; a security level analysis module 3, the security level analysis module 3 is used to analyze the security level of the update function group, if the security level of the update function group is greater than or equal to the preset security level, obtain the first level security monitoring instruction; a deep correlation monitoring module 4, the deep correlation monitoring module 4 is used to perform deep correlation monitoring on the update function group according to the first level security monitoring instruction, and output a deep correlation monitoring data set, including deep code review data, associated vulnerability scanning data and dynamic behavior analysis data; an update deployment module 5, the update deployment module 5 is used to perform security analysis based on the deep code review data, associated vulnerability scanning data and dynamic behavior analysis data, and output an associated risk indicator. If the associated risk indicator is less than the preset associated risk indicator, update deployment is performed to the terminal of the POS machine software according to the update function group.

[0041] Furthermore, the update data packet acquisition module 1 further includes: Determine whether the update data packet is obtained through a web page jump. If it is obtained through a web page jump, collect the jump web page information; perform a web page security check based on the jump web page information, output a web page security index, and generate risk warning information if the web page security index is less than a preset web page security index.

[0042] Furthermore, the security level analysis module 3 also includes: If the security level of the update function group is lower than the preset security level, obtain a second-level security monitoring instruction; perform basic verification on the update function group according to the second-level security monitoring instruction, including signature verification, integrity verification and static code verification; when the signature verification, integrity verification and static code verification are all verified to pass, perform update deployment to the terminal of the POS software according to the update function group.

[0043] Furthermore, the security level analysis module 3 also includes: When one of the signature verification, integrity verification and static code verification fails, a second rollback instruction is obtained, wherein the second rollback instruction includes a second response time, and the first response time is less than the second response time; when the terminal of the POS software receives the second rollback instruction, the state of the POS software is rolled back to the initial state according to the second response time.

[0044] Furthermore, the update deployment module 5 also includes: If the associated risk indicator is greater than or equal to the preset associated risk indicator, a first rollback instruction is obtained, wherein the first rollback instruction includes a first response time; when the terminal of the POS software receives the first rollback instruction, the state of the POS software is rolled back to the initial state according to the first response time.

[0045] Furthermore, the update deployment module 5 also includes: Construct a deep anomaly comparison library; perform abnormal data identification on the deep code review data, associated vulnerability scanning data, and dynamic behavior analysis data respectively by calling the deep anomaly comparison library, and output abnormal code data, abnormal vulnerability scanning data, and abnormal behavior analysis data; perform feature convolution on the abnormal code data, abnormal vulnerability scanning data, and abnormal behavior analysis data, and output a feature convolution matrix; perform matrix calculation on the feature convolution matrix, and output an associated risk indicator.

[0046] Furthermore, the update deployment module 5 also includes: Generate a feature convolution network; use the feature convolution network to perform feature convolution on the abnormal code data, and output abnormal code features, including abnormal code proportion, abnormal hard-coded credential number, and abnormal API call; use the feature convolution network to perform feature convolution on the abnormal vulnerability scanning data, and output abnormal vulnerability features, including CVE score, vulnerability severity level, and vulnerability impact range; use the feature convolution network to perform feature convolution on the abnormal behavior analysis data, and output abnormal behavior features, including abnormal network requests, abnormal behavior logs, and abnormal performance usage; output a feature convolution matrix based on the abnormal code features, the abnormal vulnerability features, and the abnormal behavior features.

[0047] Furthermore, the update deployment module 5 also includes: The feature convolution matrix is ​​normalized and the processed feature convolution matrix is ​​output; an association weight matrix is ​​configured, vector calculation is performed on the processed feature convolution matrix according to the association weight matrix, and an association risk index is output.

[0048] The POS software version update security monitoring device provided in the embodiment of the present invention can execute the POS software version update security monitoring method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0049] Although the present application makes various references to certain modules in the device according to the embodiments of the present application, any number of different modules may be used and run on the user terminal and / or server, and the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0050] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A method for monitoring the version update security of POS machine software, characterized in that: The method comprises: Obtain the version update data package of the POS machine software; Analyze the version update data packet to obtain an update function group; Analyze the security level of the update function group, and if the security level of the update function group is greater than or equal to a preset security level, obtain a first-level security monitoring instruction; Performing deep correlation monitoring on the update function group according to the first-level security monitoring instruction, and outputting a deep correlation monitoring data set, including deep code review data, correlation vulnerability scanning data, and dynamic behavior analysis data; A security analysis is performed based on the deep code review data, associated vulnerability scanning data, and dynamic behavior analysis data, and an associated risk indicator is output. If the associated risk indicator is less than a preset associated risk indicator, an update is deployed to the terminal of the POS software according to the update function group.

2. The method according to claim 1, characterized in that The method further comprises: If the associated risk indicator is greater than or equal to the preset associated risk indicator, obtaining a first rollback instruction, wherein the first rollback instruction includes a first response time; When the terminal of the POS software receives the first rollback instruction, the state of the POS software is rolled back to the initial state according to the first response time.

3. The method according to claim 2, characterized in that If the security level of the update function group is lower than the preset security level, obtaining a second-level security monitoring instruction; Performing basic verification on the update function group according to the second-level security monitoring instruction, including signature verification, integrity verification and static code verification; When the signature verification, integrity verification and static code verification are all verified to be passed, the update deployment is performed to the terminal of the POS software according to the update function group.

4. The method according to claim 3, characterized in that When one of the signature verification, integrity verification and static code verification fails, obtaining a second rollback instruction, wherein the second rollback instruction includes a second response time, and the first response time is less than the second response time; When the terminal of the POS software receives the second rollback instruction, the state of the POS software is rolled back to the initial state according to the second response time.

5. The method according to claim 1, characterized in that Based on the deep code review data, the associated vulnerability scanning data and the dynamic behavior analysis data, security analysis is performed to output associated risk indicators, and the method further includes: Build a deep anomaly comparison library; By calling the deep anomaly comparison library, the deep code review data, the associated vulnerability scanning data, and the dynamic behavior analysis data are respectively identified as abnormal data, and abnormal code data, abnormal vulnerability scanning data, and abnormal behavior analysis data are output; Performing feature convolution on the abnormal code data, abnormal vulnerability scanning data, and abnormal behavior analysis data, and outputting a feature convolution matrix; Perform matrix calculation on the feature convolution matrix and output the associated risk index.

6. The method according to claim 5, characterized in that Performing feature convolution on the abnormal code data, abnormal vulnerability scanning data, and abnormal behavior analysis data, the method comprising: Generate feature convolutional network; Perform feature convolution on the abnormal code data using the feature convolution network, and output abnormal code features, including abnormal code proportion, number of abnormal hard-coded credentials, and abnormal API calls; Performing feature convolution on the abnormal vulnerability scanning data using the feature convolution network, and outputting abnormal vulnerability features, including CVE scores, vulnerability severity levels, and vulnerability impact ranges; Performing feature convolution on the abnormal behavior analysis data using the feature convolution network, and outputting abnormal behavior features, including abnormal network requests, abnormal behavior logs, and abnormal performance usage; A feature convolution matrix is ​​output according to the abnormal code feature, the abnormal vulnerability feature and the abnormal behavior feature.

7. The method according to claim 5, characterized in that Performing matrix calculation on the feature convolution matrix and outputting the associated risk index, the method includes: Normalizing the feature convolution matrix and outputting the processed feature convolution matrix; An association weight matrix is ​​configured, vector calculation is performed on the processed feature convolution matrix according to the association weight matrix, and an association risk index is output.

8. The method according to claim 1, characterized in that Obtaining a version update data package of the POS machine software, the method further includes: Determine whether the update data packet is obtained through a web page jump, and if so, collect jump web page information; A webpage security detection is performed based on the redirected webpage information, and a webpage security index is output. If the webpage security index is less than a preset webpage security index, risk warning information is generated.

9. A POS machine software version update security monitoring device, characterized in that: The device is used to implement the version update security monitoring method of POS machine software according to any one of claims 1 to 8, comprising: Update data package acquisition module: obtain the version update data package of POS machine software; Update data packet analysis module: analyzes the version update data packet to obtain an update function group; Security level analysis module: analyzes the security level of the update function group, and obtains the first level security monitoring instruction if the security level of the update function group is greater than or equal to the preset security level; Deep correlation monitoring module: performs deep correlation monitoring on the update function group according to the first-level security monitoring instruction, and outputs a deep correlation monitoring data set, including deep code review data, correlation vulnerability scanning data and dynamic behavior analysis data; Update deployment module: Perform security analysis based on the deep code review data, associated vulnerability scanning data, and dynamic behavior analysis data, and output associated risk indicators. If the associated risk indicator is less than the preset associated risk indicator, update deployment is performed to the terminal of the POS software according to the update function group.

Images