Method, device and equipment for identifying sensitive behaviors of application program of intelligent measurement terminal

Abstract

The invention relates to an application program sensitive behavior identification method and device of an intelligent measurement terminal, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring multi-dimensional side channel data of the intelligent measurement terminal; the multi-dimensional side channel data is used as input, a trained sensitive behavior classifier is called, the category of the activity behavior of the application program operated by the intelligent measurement terminal is recognized, a behavior recognition result is obtained, and the behavior recognition result comprises the category of the activity behavior; the sensitive behavior classifier is obtained based on training of multi-dimensional side channel time sequence data carrying behavior category labels; under the condition that the behavior recognition result represents that the intelligent measurement terminal has the sensitive behavior, whether the sensitive behavior is an abnormal sensitive behavior or not is judged based on the type of the sensitive behavior and a preset sensitive behavior detection rule. By adopting the method, the security of sensitive behavior identification of the intelligent measurement terminal can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, device, equipment, and storage medium for identifying application-sensitive behavior of an intelligent measurement terminal. Background Art

[0002] With the rapid development of the Internet of Things and embedded systems, smart measurement terminal devices play an increasingly important role in the power system. At the same time, the security issues of applications on these smart measurement terminal devices are gradually exposed, posing a threat to privacy and data security, which may damage the grid infrastructure and affect power supply. The methods for sensitive behavior identification of applications for terminal devices in the industrial field are often invasive, such as requiring modification of the underlying system framework or having high permissions, which poses certain security risks.

[0003] Therefore, a secure way is needed to monitor and identify the sensitive behaviors of smart measurement terminal applications, so as to monitor and detect possible anomalies in the smart measurement terminals of the power system in real time, promptly discover and respond to potential security threats, and avoid further harm. Summary of the invention

[0004] Based on this, it is necessary to provide a method, device, computer equipment, computer-readable storage medium and computer program product for identifying sensitive behavior of applications in smart measurement terminals, which can improve the security of sensitive behavior identification of applications in smart measurement terminals in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for identifying application-sensitive behaviors of an intelligent measurement terminal, comprising:

[0006] Obtain multi-dimensional side channel data from intelligent measurement terminals;

[0007] Taking multi-dimensional side channel data as input, calling the trained sensitive behavior classifier, identifying the category of the activity behavior of the application running on the smart measurement terminal, and obtaining the behavior recognition result, which includes the category of the activity behavior. The sensitive behavior classifier is trained based on the multi-dimensional side channel time series data carrying the behavior category label;

[0008] When the behavior recognition result indicates that the intelligent measurement terminal has sensitive behavior, it is determined whether the sensitive behavior is abnormal sensitive behavior based on the category of the sensitive behavior and the preset sensitive behavior detection rules.

[0009] In one embodiment, before calling the trained sensitive behavior classifier with the multi-dimensional side channel data as input, the method further includes:

[0010] Obtain historical operating status data of intelligent measurement terminals;

[0011] Based on the historical operation status data, determine the multi-dimensional side channel time series historical data;

[0012] Preprocess the multi-dimensional side channel time series historical data to build a sensitive behavior side channel feature library;

[0013] Based on the sensitive behavior side channel feature library, a pre-built residual encoder is trained to obtain a sensitive behavior classifier, wherein the sensitive behavior side channel feature library includes multi-dimensional side channel time series data carrying behavior category labels, and each dimension of side channel time series data corresponds to a side channel data source.

[0014] In one embodiment, training a pre-built residual encoder based on a sensitive behavior side channel feature library includes:

[0015] Input the multi-dimensional side channel time series data into a pre-built residual encoder;

[0016] Extracting time series features of the side channel time series data in each dimension to obtain multi-dimensional time series feature data;

[0017] Based on the multi-dimensional time series feature data, determine the sensitive behavior category corresponding to the multi-dimensional time series feature data;

[0018] Based on the behavior category labels carried by the multidimensional time series feature data and the output sensitive behavior categories, the loss function value of the residual encoder is determined, and based on the loss function value, the parameters of the residual encoder are iteratively updated until the preset training end conditions are reached to obtain the trained sensitive behavior classifier.

[0019] In one embodiment, the residual encoder includes multiple residual blocks and pooling layers, attention mechanism layers, fully connected layers, and regression layers; based on the multi-dimensional time series feature data, determining the sensitive behavior category corresponding to the multi-dimensional time series feature data includes:

[0020] Based on the residual block and the pooling layer, the time series features of the side channel time series data in each dimension are extracted to obtain multi-dimensional time series feature data;

[0021] Input the multi-dimensional time series feature data into the attention mechanism layer of the residual encoder to learn the importance of timestamps and obtain the attention feature vector sequence of the multi-dimensional time series feature data;

[0022] The attention feature vector sequence is input into the fully connected layer and regression layer of the residual encoder, and the sensitive behavior category corresponding to the multi-dimensional time series feature data is output.

[0023] In one embodiment, preprocessing multi-dimensional side channel time series historical data to build a sensitive behavior side channel feature library includes:

[0024] Determine the feature importance of each feature dimension of the multi-dimensional side channel time series historical data;

[0025] Based on the importance of each feature, select target feature dimensions whose contribution is greater than a preset contribution threshold from multiple feature dimensions;

[0026] Based on the side channel time series historical data of the target feature dimension, a sensitive behavior side channel feature library is constructed.

[0027] In one embodiment, the sensitive behavior includes a normal sensitive behavior or an abnormal sensitive behavior; based on the category of the sensitive behavior and a preset sensitive behavior detection rule, determining whether the sensitive behavior is an abnormal sensitive behavior includes:

[0028] Based on the preset sensitive behavior detection rules, determine the normal time period for normal sensitive behaviors;

[0029] If the time period in which the identified sensitive behavior occurs is not within the normal time period corresponding to the sensitive behavior, the sensitive behavior is determined to be an abnormal sensitive behavior.

[0030] In one embodiment, the method for identifying application-sensitive behaviors of a smart measurement terminal further includes:

[0031] If the sensitive behavior is determined to be abnormally sensitive behavior, the interaction data of the abnormally sensitive behavior is recorded and warning information is pushed;

[0032] Generate event reports of abnormal and sensitive behaviors based on interaction data.

[0033] In a second aspect, the present application also provides an application sensitive behavior recognition device for an intelligent measurement terminal, comprising:

[0034] A data acquisition module, used to obtain multi-dimensional side channel data of the intelligent measurement terminal;

[0035] The online monitoring module is used to take the multi-dimensional side channel data as input, call the trained sensitive behavior classifier, identify the category of the activity behavior of the application running on the intelligent measurement terminal, and obtain the behavior recognition result. The behavior recognition result includes the category of the activity behavior. The sensitive behavior classifier is trained based on the multi-dimensional side channel time series data carrying the behavior category label.

[0036] The anomaly detection module is used to determine whether the sensitive behavior is an abnormal sensitive behavior based on the category of the sensitive behavior and the preset sensitive behavior detection rules when the behavior recognition result indicates that the intelligent measurement terminal has sensitive behavior.

[0037] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps in any one of the above-mentioned embodiments of the method for identifying application-sensitive behavior of an intelligent measurement terminal are implemented.

[0038] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in any of the above-mentioned embodiments of the method for identifying application-sensitive behavior of an intelligent measurement terminal.

[0039] In a fifth aspect, the present application further provides a computer program product, including a computer program, which, when executed by a processor, implements the steps in any of the above-mentioned application program sensitive behavior identification methods for smart measurement terminals.

[0040] The above-mentioned method, device, computer equipment, computer-readable storage medium and computer program product for identifying application sensitive behaviors of the intelligent measuring terminal, on the one hand, perform preliminary detection of application sensitive behaviors through multi-dimensional side channel data of the intelligent measuring terminal and the trained sensitive behavior classifier. Since the multi-dimensional side channel data includes the system operation status data of the measuring terminal, and the acquisition of the system operation status data does not require modification of the terminal system bottom layer, the security and privacy of the preliminary detection and identification process of application sensitive behaviors can be improved; on the other hand, after the preliminary detection of sensitive behaviors, an abnormal behavior judgment link is designed using sensitive behavior detection rules, and the sensitive behavior detection rules are used to judge whether the sensitive behavior of the current application is suspected of abnormality, which not only improves the efficiency and accuracy of abnormal sensitive behavior identification, but also improves the flexibility and scalability of abnormal sensitive behavior identification. Furthermore, the above-mentioned scheme can also improve the security of power system measurement terminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 It is a flowchart of a method for identifying application-sensitive behaviors of an intelligent measurement terminal in one embodiment;

[0043] Figure 2 A schematic diagram of a flow chart of a method for identifying application-sensitive behaviors of an intelligent measurement terminal in another embodiment;

[0044] Figure 3 is a structural diagram of a residual encoder in one embodiment;

[0045] Figure 4 A schematic diagram of training a sensitive behavior classifier in one embodiment;

[0046] Figure 5 A system architecture diagram for classifying sensitive behaviors in one embodiment;

[0047] Figure 6 It is a structural block diagram of an application sensitive behavior identification device of an intelligent measurement terminal in one embodiment;

[0048] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0050] In one embodiment, Figure 1 As shown, a method for identifying application-sensitive behaviors of an intelligent measurement terminal is provided. This embodiment uses the method applied to a measurement terminal as an example. It can be understood that the method can also be applied to a server, and can also be applied to a system including a measurement terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes steps S200 to S600. Among them:

[0051] S200: Acquire multi-dimensional side channel data of the intelligent measurement terminal.

[0052] Among them, the intelligent measurement terminal is a device that integrates multiple functions in the power system. It is mainly used to collect electrical data and perform remote control operations. It is often installed in key nodes of the power network, such as substations and distribution cabinets.

[0053] Multidimensional side channel data is physical information generated by the software system during operation. It is data that can indirectly reflect the activity status of the system. It can be the system's operating status information, including but not limited to CPU-related data, memory-related data, network traffic-related data, disk-related information, etc. Among them, CPU-related data can include CPU time and CPU utilization, etc.; memory-related data can be memory occupancy, I / O rate, etc.; network traffic-related data can include network throughput, network utilization, etc.; disk-related data can include disk utilization, etc. Each data source corresponds to a dimension of the multidimensional side channel data. The multidimensional side channel data of the intelligent measurement terminal can be obtained through a third-party application or script.

[0054] In practical applications, a collector program for the system's operating status information can be developed in the intelligent measurement terminal. The collector can obtain CPU-related information, memory-related information, and network traffic-related information in the software system of the intelligent measurement terminal, and then use the collected data as multi-dimensional side channel data.

[0055] S400, taking the multi-dimensional side channel data as input, calling the trained sensitive behavior classifier, identifying the category of the activity behavior of the application running on the smart measurement terminal, and obtaining the behavior recognition result, which includes the category of the activity behavior. The sensitive behavior classifier is trained based on the multi-dimensional side channel time series data carrying the behavior category label.

[0056] Among them, the categories of active behaviors may include sensitive behaviors and normal behaviors. Sensitive behaviors include a series of software behaviors that may pose a threat to user data, including but not limited to: file writing: using the file writing function to tamper with data and system information; memory writing: writing to the terminal memory to modify the data of other applications or system-level data; uplink communication: sending sensitive information in the terminal to unauthorized entities without user authorization; privilege escalation: obtaining higher permissions or access control levels than they should have. It is understandable that since the smart measurement terminal may run multiple applications at the same time, it is necessary to identify whether the activities of multiple applications are sensitive behaviors, that is, the obtained behavior identification results include multiple categories of active behaviors.

[0057] The sensitive behavior classifier can be obtained by training a deep learning model based on multi-dimensional side channel time series data carrying behavior category labels, and is used to identify the categories of activity behaviors of applications running on smart measurement terminals. The multi-dimensional side channel time series data can be obtained by processing multi-dimensional side channel historical data within a historical time period. The trained sensitive behavior classifier can be deployed on the cloud, on a server, or in a smart measurement terminal.

[0058] In actual applications, after the intelligent measurement terminal obtains the multi-dimensional side channel data, it calls the trained sensitive behavior classifier deployed in the system, and inputs the multi-dimensional side channel data into the sensitive behavior classifier in parallel to obtain the behavior category of the active behavior of each application running in the system. The category of active behavior can include sensitive behavior or normal behavior.

[0059] S600: When the behavior recognition result indicates that the intelligent measurement terminal has a sensitive behavior, determine whether the sensitive behavior is an abnormal sensitive behavior based on the category of the sensitive behavior and a preset sensitive behavior detection rule.

[0060] The preset sensitive behavior detection rules can be set according to the working mode of the intelligent measurement terminal and the categories of different sensitive behaviors. Specifically, the functions implemented by the intelligent measurement terminal in different working modes are determined according to the working mode, and the function implementation of the intelligent measurement terminal is related to the application in its system. Different applications will perform corresponding active behaviors when running. For example, in the data collection working mode, the intelligent measurement terminal implements data collection through the data collection application. The active behavior of the data collection application can be file writing behavior. If it involves other unnecessary active behaviors, it may be an abnormal sensitive behavior.

[0061] The applications of the intelligent measurement terminal include but are not limited to local meter reading APP (Application), downstream communication APP, remote communication APP, remote signal / pulse APP, local maintenance APP, etc. Among them, the meter reading APP is used to realize the local meter reading function; the downstream communication APP is used to realize the downstream communication function, such as meter reading, data forwarding function of other ports to the ports of this intelligent measurement terminal, and local module upgrade; the remote communication APP is used to complete the data forwarding task to other devices, and the remote signal / pulse APP is used for remote signal and pulse power collection; the local maintenance APP is used for local parameter setting, maintenance, USB (Universal Serial Bus) import and export, production test procedures, etc.

[0062] Therefore, the preset sensitive behavior detection rules may include: determining the unnecessary activity behaviors of the application program under different working modes of the smart measurement terminal, and judging whether the identified sensitive behavior category is abnormal sensitive behavior based on the unnecessary activity behaviors. It may also be determining the working hours of the application program under different working modes of the smart measurement terminal, thereby determining the working hours corresponding to different sensitive behaviors, and judging whether the identified sensitive behavior category is abnormal sensitive behavior based on the working hours corresponding to different sensitive behaviors.

[0063] In practical applications, the behavior recognition results of applications running in the system are obtained through the trained sensitive behavior classifier. When the behavior recognition results represent the existence of sensitive behaviors in the intelligent measurement terminal, that is, when the categories of each identified activity behavior include sensitive behavior categories, the sensitive behavior detection rules corresponding to the identified sensitive behavior categories are used to further determine whether the sensitive behavior is abnormal sensitive behavior.

[0064] In the above-mentioned method for identifying application sensitive behaviors of intelligent measuring terminals, on the one hand, preliminary detection of application sensitive behaviors is performed through the multi-dimensional side channel data of the intelligent measuring terminal and the trained sensitive behavior classifier. Since the multi-dimensional side channel data includes the system operation status data of the intelligent measuring terminal, and the acquisition of the system operation status data does not require modification of the terminal system bottom layer, the security and privacy of the preliminary detection and identification process of application sensitive behaviors can be improved; on the other hand, after the preliminary detection of sensitive behaviors, an abnormal behavior judgment link is designed using sensitive behavior detection rules. The sensitive behavior detection rules are used to judge whether the sensitive behavior of the current application is suspected of abnormality. This not only improves the efficiency and accuracy of abnormal sensitive behavior identification, but also improves the flexibility and scalability of abnormal sensitive behavior identification. Furthermore, the above-mentioned scheme can also improve the security of intelligent measuring terminals in power systems.

[0065] In order to improve the efficiency and accuracy of identifying sensitive behaviors, in an exemplary embodiment, Figure 3 As shown, before S400, it includes S320 to S380. Among them:

[0066] S320: Obtain historical operating status data of the intelligent measurement terminal.

[0067] Since the sensitive behaviors of applications in the intelligent measurement terminal system are often accompanied by changes in the operating status data of various systems, the changes in the operating status data of the intelligent measurement terminal system can be considered as the side features of the sensitive behaviors of the applications. Therefore, a sensitive behavior side channel feature library is constructed based on the operating status data of the intelligent measurement terminal system for the classification of sensitive behaviors.

[0068] The historical operation status data is the historical operation status information of the intelligent measurement terminal system, including but not limited to CPU-related data, memory-related data, network traffic-related data, disk-related information, etc. The historical operation status data of the intelligent measurement terminal can be obtained by developing a collector program in the intelligent measurement terminal to obtain the system's operation status information, or can be collected through an automated script.

[0069] S340: Determine multi-dimensional side channel time series historical data based on the historical operating status data.

[0070] The multi-dimensional side channel time series historical data is the operation status data of the intelligent measurement terminal in the historical time period, that is, the historical operation status data, and each data source of the historical operation status data corresponds to a dimension of the multi-dimensional side channel time series historical data. For example, the historical operation status data includes the CPU time, CPU utilization, memory occupancy, and network utilization in the historical time period, and the CPU time, CPU utilization, memory occupancy, and network utilization are respectively a dimension of the multi-dimensional side channel time series historical data.

[0071] In practical applications, the CPU-related information, memory-related information, and network traffic-related information in the historical time period of the software system of the intelligent measurement terminal can be obtained as multi-dimensional side channel time series historical data.

[0072] S360, preprocesses the multi-dimensional side channel time series historical data and builds a sensitive behavior side channel feature library.

[0073] The sensitive behavior side channel feature library is composed of multi-dimensional side channel time series data with behavior category labels. The behavior category labels can include multiple sensitive behavior category labels and normal behavior category labels. Among them, multiple sensitive behavior category labels can be set according to needs, including but not limited to file write labels, memory write labels, uplink communication labels, privilege escalation operation labels, etc.

[0074] Before building a sensitive behavior side channel feature library, preprocessing of the multi-dimensional side channel time series historical data may include data alignment, data cleaning, data labeling, etc. Specifically, since the timestamps of the multi-dimensional side channel time series historical data corresponding to each behavior category label recorded by the automated script may not completely correspond to the time points of the multi-dimensional side channel time series historical data collected by the collector in the system, the time points of the multi-dimensional side channel time series historical data are aligned with the timestamps corresponding to the behavior category labels through data alignment preprocessing, so as to facilitate the subsequent data labeling processing of the multi-dimensional side channel time series historical data.

[0075] Data cleaning can be to process the outliers of the median abnormality of the data after data alignment processing of the multi-dimensional side channel time series historical data, and the outliers may be caused by writing errors. Data annotation can be to annotate the multi-dimensional side channel time series historical data according to the timestamps corresponding to each behavior category label recorded by the automated script.

[0076] In practical applications, after preprocessing the multi-dimensional side channel time series historical data such as data alignment, data cleaning, and data labeling, data compression and data indexing are performed based on the processed multi-dimensional side channel time series historical data to build a sensitive behavior side channel feature library. The feature library built using the system operation status data, that is, the multi-dimensional side channel time series historical data, contains the features of the monitored sensitive behavior categories.

[0077] S380, based on the sensitive behavior side channel feature library, train a pre-built residual encoder to obtain a sensitive behavior classifier, wherein the sensitive behavior side channel feature library includes multi-dimensional side channel time series data carrying behavior category labels, and each dimension of the side channel time series data corresponds to a side channel data source.

[0078] The residual encoder is a deep learning model structure that combines two basic models, the residual network (ResNet) and the encoder (Encoder), and has good feature learning and generalization capabilities. The residual network is a deep convolutional neural network structure that introduces residual connections to solve the gradient vanishing and gradient exploding problems during training. The encoder is a network structure or model component that helps convert input data into a higher-level or more abstract representation, that is, more representative features that can better capture the important information of the input data.

[0079] In practical applications, the multidimensional side channel time series data carrying behavior category labels in the sensitive behavior side channel feature library can be input into a pre-built residual encoder. The residual encoder learns the characteristics of the multidimensional side channel time series data according to the behavior category labels. Through iterative training, the residual encoder performs classification of the multidimensional side channel time series data, thereby realizing the classification of sensitive behaviors and obtaining a sensitive behavior classifier.

[0080] In this embodiment, by acquiring the multi-dimensional side channel time series historical data of the intelligent measurement terminal and constructing a sensitive behavior side channel feature library, it is beneficial to improve the efficiency and accuracy of sensitive behavior identification. The pre-constructed residual encoder with good feature learning and generalization capabilities is trained based on the sensitive behavior side channel feature library. It can perform classification of multi-dimensional side channel time series data, thereby classifying sensitive behaviors, thereby improving the efficiency and accuracy of sensitive behavior identification.

[0081] By training the pre-built residual encoder with multi-dimensional side channel time series data carrying behavior category labels, a sensitive behavior classifier is obtained. In an exemplary embodiment, S380 also includes S382 to S388. Among them:

[0082] S382, input the multi-dimensional side channel time series data into a pre-built residual encoder.

[0083] S384, extracting the time series features of the side channel time series data of each dimension to obtain multi-dimensional time series feature data.

[0084] S386: Based on the multi-dimensional time series feature data, determine the sensitive behavior category corresponding to the multi-dimensional time series feature data.

[0085] S388, based on the behavior category labels carried by the multidimensional time series feature data and the output sensitive behavior categories, determines the loss function value of the residual encoder, and based on the loss function value, iteratively updates the parameters of the residual encoder until the preset training end conditions are reached, thereby obtaining a trained sensitive behavior classifier.

[0086] In practical applications, the multi-dimensional side channel time series data may be input into a pre-built residual encoder in parallel according to the time dimension.

[0087] The residual encoder extracts the time series features of the side channel time series of each dimension to obtain multi-dimensional time series feature data. The residual encoder learns the importance of multi-dimensional time series feature data and captures the dependencies of long-distance multi-dimensional time series features, thereby determining the sensitive behavior category corresponding to the multi-dimensional time series feature data.

[0088] After obtaining the sensitive behavior category corresponding to the input multi-dimensional side channel time series data through the residual encoder, the loss function value is calculated through the loss function, the behavior category label carried by the input multi-dimensional time series feature data, and the output sensitive behavior category, and the back propagation is started from the output layer of the residual encoder according to the loss function value, the parameter gradient value of each layer is calculated, and the parameters of the residual encoder are updated to minimize the loss function value. Among them, the loss function can be a mean square error loss function or a cross entropy loss function. The preset training end condition can be that the loss function value is continuously less than a preset loss threshold within a preset number of iterations, the training of the residual encoder is stopped, and the trained sensitive behavior classifier is obtained.

[0089] In this embodiment, the features of the multi-dimensional side channel time series data are extracted through a residual encoder, and the residual encoder is trained to perform sensitive behavior classification based on the extracted time series features, which is beneficial to improving the accuracy of sensitive behavior classification. The parameters of the residual encoder are updated based on the loss function value, which can improve the performance of the residual encoder and improve the convergence of the residual encoder, thereby improving the accuracy of sensitive behavior classification.

[0090] In an exemplary embodiment, the residual encoder includes multiple residual blocks and pooling layers, attention mechanism layers, fully connected layers and regression layers, and S386 also includes S3862 to S3866. Among them:

[0091] S3862, based on the residual block and the pooling layer, extract the time series features of the side channel time series data of each dimension to obtain multi-dimensional time series feature data.

[0092] like Figure 4 As shown in the figure, the residual encoder is mainly composed of multiple residual blocks and maximum pooling layers cascaded together. Each residual block is composed of multiple convolutional layers, batch normalization layers and ReLU activation functions cascaded together. The residual encoder also includes an attention mechanism layer, a fully connected layer and a Softmax regression layer.

[0093] In practical applications, such as Figure 5 As shown, the side channel time series of each dimension of the multi-dimensional side channel time series data can be input into the residual encoder in parallel as different channels of the one-dimensional convolutional layer. In the residual encoder, the time series features of the side channel time series data of each dimension are extracted through the pooling operations of multiple layers of cascaded residual blocks and maximum pooling layers in sequence, so as to obtain multi-dimensional time series feature data.

[0094] S3864, input the multi-dimensional time series feature data into the attention mechanism layer of the residual encoder, learn the importance of timestamps, and obtain the attention feature vector sequence of the multi-dimensional time series feature data.

[0095] Since the importance of sensitive behavior categories represented by different timestamps in the input multi-dimensional time series feature data is different, the time series features of some timestamps are more important, while the time series features of other timestamps are relatively less important. By introducing the attention mechanism layer, the model can learn the importance of time series features of different timestamps.

[0096] In practical applications, the extracted multidimensional time series feature data can be input into the attention mechanism layer of the residual encoder, and the attention mechanism layer can perform weight assignment and weighted feature representation on the multidimensional time series feature data of different timestamps to obtain a sequence of attention feature vectors of the multidimensional time series feature data, so that the model can pay attention to the important parts of the multidimensional time series feature data and adaptively focus on the multidimensional time series feature data of different timestamps, thereby learning the importance of different timestamps.

[0097] S3866, inputs the attention feature vector sequence into the fully connected layer and regression layer of the residual encoder, and outputs the sensitive behavior category corresponding to the multi-dimensional time series feature data.

[0098] After learning the importance of different timestamps through the attention mechanism layer and obtaining the attention feature vector sequence of the multidimensional time series feature data, the attention feature vector sequence of the multidimensional time series feature data is input into the fully connected layer and Softmax regression layer of the residual encoder, and converted into the probability distribution of sensitive behavior categories by the fully connected layer and Softmax regression layer. The predicted probability results of each category are output to obtain the sensitive behavior categories corresponding to the multidimensional time series feature data.

[0099] In this embodiment, the residual encoder that combines the structure and function of the residual network and the encoder can learn the rich features of the sensitive behavior side channel data while ensuring a low model complexity, thereby enabling efficient and stable classification of sensitive behaviors.

[0100] In order to reduce the computing resources for sensitive behavior classification, a sensitive behavior side channel feature library is constructed by screening multi-dimensional side channel channels. In an exemplary embodiment, S360 also includes S362 to S366. Among them:

[0101] S362, determining the feature importance of each feature dimension of the multi-dimensional side channel time series historical data.

[0102] S364: Based on the importance of each feature, a target feature dimension whose contribution is greater than a preset contribution threshold is screened out from multiple feature dimensions.

[0103] S366, build a sensitive behavior side channel feature library based on the side channel time series historical data of the target feature dimension.

[0104] In this embodiment, the feature dimensions include but are not limited to a CPU time dimension, a CPU utilization dimension, a memory occupancy dimension, a network throughput dimension, and a network utilization dimension.

[0105] After preprocessing the multidimensional side channel time series historical data, the multidimensional side channel time series historical data carrying behavior category labels are obtained. The regression model can be trained by the multidimensional side channel time series historical data carrying behavior category labels to calculate the feature importance of each feature dimension. The feature importance represents the degree of correlation between the data under this dimension and the sensitive behavior classification.

[0106] After obtaining the feature importance of each feature dimension of the multi-dimensional side channel time series historical data, a contribution threshold of the feature dimension can be set according to the relevance of different side channel data sources to the sensitive behavior classification. Based on the preset contribution threshold, feature dimensions with a contribution threshold greater than the contribution threshold are screened out as target feature dimensions.

[0107] The historical side channel time series data of the side channel data source corresponding to each target feature dimension is obtained and processed to obtain multidimensional side channel time series data carrying behavior category labels. After data compression, data indexing and other processing, a sensitive behavior side channel feature library is constructed. The number of dimensions of the multidimensional side channel time series data in the sensitive behavior side channel feature library is the number of target feature dimensions, that is, the number of side channel data sources, and in the multidimensional side channel time series data, the length of different multidimensional side channel time series is related to the duration of historical collection.

[0108] In this embodiment, by screening out feature dimensions that contribute greatly to sensitive behavior classification and constructing a sensitive behavior side channel feature library, computing resources can be saved to reduce energy consumption, which is beneficial to improving the efficiency of sensitive behavior identification.

[0109] In an exemplary embodiment, the sensitive behavior includes a normal sensitive behavior or an abnormal sensitive behavior, and S600 includes S620 to S640. Among them:

[0110] S620: Determine a normal time period for normal sensitive behaviors based on preset sensitive behavior detection rules.

[0111] S640: If the identified time period of occurrence of the sensitive behavior is not within the normal time period corresponding to the sensitive behavior, the sensitive behavior is determined to be an abnormal sensitive behavior.

[0112] Abnormal sensitive behaviors are sensitive behaviors that are suspected of being abnormal and pose a threat to the security of intelligent measurement terminals.

[0113] The preset sensitive behavior detection rule includes detecting whether the sensitive behavior is an abnormal sensitive behavior based on the normal occurrence time corresponding to each sensitive behavior. The normal occurrence time corresponding to each sensitive behavior can be determined according to the working mode of the intelligent measurement terminal.

[0114] When the intelligent measuring terminal is in different working modes, the intelligent measuring terminal runs different applications, which may occur at specific times or under specific conditions. Therefore, the corresponding normal sensitive behavior time period can be set for the activity behaviors of different applications. Specifically, when the intelligent measuring terminal is in the meter reading working mode, the local meter reading APP is run, and the meter reading work is usually carried out at a specific time, which can be to record the meter readings of residential buildings at midnight or zero o'clock every day. The meter reading time is determined according to the design of the power grid system and the number of households in the residential building, and can be 5 minutes to 20 minutes. Taking the meter reading starting at zero o'clock every day and the meter reading time of 20 minutes as an example, the corresponding meter reading APP working time is 0:00~0:20. Sensitive behaviors related to the meter reading working mode may include file writing, and this time period is the normal time period for normal file writing behaviors; when the intelligent measurement terminal is in the data reporting working mode, this work usually runs the remote communication APP under certain conditions to upload the locally collected data to the upper-level server. The operating conditions may be: uploading the collected data to the upper-level server when the amount of collected data reaches a certain threshold, or uploading the collected data to the upper-level server at a unified specific time point. The sensitive behavior involved in the remote communication APP may be uplink communication, and the normal time period for normal uplink communication is determined according to the specific working conditions.

[0115] In this way, when the behavior recognition result of the sensitive behavior classifier indicates the existence of sensitive behavior, the category of the sensitive behavior is determined, and based on the working mode of the intelligent measurement terminal, the application running under the working model is determined, and based on the active behavior of the application, the normal occurrence time period of the normal sensitive behavior corresponding to the sensitive behavior category is determined.

[0116] After determining the normal occurrence time period of the normal sensitive behavior corresponding to the sensitive behavior category, determine the occurrence time period of the sensitive behavior, and judge whether the occurrence time period of the sensitive behavior is within the normal occurrence time period. If it is not within the normal occurrence time period, the sensitive behavior is an abnormal sensitive behavior and may pose a threat to the security of the intelligent measurement terminal.

[0117] In this embodiment, the abnormal sensitive behavior judgment link is set through the sensitive behavior detection rules to further judge whether the current APP sensitive behavior is suspected of abnormality, thereby improving the efficiency and accuracy of abnormal sensitive behavior identification. The sensitive behavior detection rules can be set according to different application programs, and abnormal sensitive behavior detection can be performed for different application environments of the smart measurement terminal, thereby improving the flexibility and scalability of abnormal sensitive behavior detection, and further improving the security of the smart measurement terminals of the power system.

[0118] In order to take corresponding measures in time after discovering that the intelligent measurement terminal has abnormal sensitive behavior, in an exemplary embodiment, S700 to S800 are also included. Among them:

[0119] S700, when it is determined that the sensitive behavior is an abnormally sensitive behavior, record the interaction data of the abnormally sensitive behavior and push warning information.

[0120] Among them, the interaction data of abnormally sensitive behavior can be the interaction data generated when the application occurs abnormally sensitive behavior, such as the memory location accessed when the application occurs abnormally sensitive behavior, and the modified file content or data content related to system performance and configuration.

[0121] The pushed warning information may include the name of the application that has abnormally sensitive behavior, and the category of abnormally sensitive behavior. For example, "XXX application is performing abnormal file writing", which is used to prompt the user that the current measurement terminal has abnormally sensitive behavior. The method of pushing warning information may include pushing warning information in the notification bar of the smart measurement terminal, displaying the warning information in the form of a full-screen or half-screen pop-up window, issuing a warning prompt by emitting a specific sound or vibration mode, and providing a visual warning prompt by flashing an indicator light. It can be understood that the method of pushing warning information can be any one of the aforementioned methods or a combination of any multiple methods, which is not limited here.

[0122] In some implementations, in addition to pushing warning information, it may also include forcibly terminating abnormally sensitive behaviors to protect the security of the intelligent measurement terminal system.

[0123] In actual applications, when it is determined that the sensitive behavior is an abnormally sensitive behavior, the application that occurs the abnormally sensitive behavior is determined, and the interaction data generated when the application occurs the abnormally sensitive behavior is recorded. The intelligent measurement terminal is controlled to emit a warning sound, and a pop-up window of early warning information is pushed on the display of the intelligent measurement terminal to prompt the user that abnormally sensitive behavior is currently occurring, so that the user can understand the specific situation and take corresponding measures.

[0124] S800, generating an event report of abnormal sensitive behavior based on the interaction data.

[0125] The event report may include the category of the abnormally sensitive behavior, the time when the abnormally sensitive behavior occurred, the application program in which the abnormally sensitive behavior occurred, and the interaction data generated by the application program in which the abnormally sensitive behavior occurred. The generated event report may be saved in the system in the form of a log file.

[0126] In actual applications, the category of abnormally sensitive behavior, the time when the abnormally sensitive behavior occurred, the application where the abnormally sensitive behavior occurred, and the interaction data generated by the application where the abnormally sensitive behavior occurred are generated as event reports and stored in the system for staff to review and analyze.

[0127] In this embodiment, by pushing warning information and recording the interactive data of abnormal and sensitive behaviors to generate event reports, relevant technical personnel are prompted to take corresponding measures in a timely manner, thereby reducing the threat of abnormal and sensitive behaviors to the privacy and data security of smart measurement terminals, improving the security and stability of smart measurement terminals, and further improving the security and stability of the power system.

[0128] In another embodiment, if the sensitive behavior is determined not to be an abnormal sensitive behavior, that is, a normal sensitive behavior, the interaction data of the sensitive behavior may be recorded without pushing an early warning message.

[0129] In order to make a clearer description of the application sensitive behavior identification method provided by the present application, the following is a specific embodiment and the attached Figure 5 To illustrate, this specific embodiment includes the following contents:

[0130] Specifically, the historical operation status data of the intelligent measurement terminal may be obtained, including CPU-related data, memory-related data, and network traffic-related data. Subsequently, based on the historical operation status data, the multi-dimensional side channel time series historical data is determined, the multi-dimensional side channel time series historical data is pre-processed, the feature importance of each feature dimension of the multi-dimensional side channel time series historical data is determined, and based on each feature importance, a target feature dimension whose contribution is greater than a preset contribution threshold is screened out from multiple feature dimensions.

[0131] Subsequently, a sensitive behavior side channel feature library is constructed based on the side channel time series historical data of the target feature dimension.

[0132] The residual encoder is trained based on the sensitive behavior side channel feature library, and the parameters of the residual encoder are iteratively updated until the preset training end condition is reached to obtain the trained sensitive behavior classifier. After obtaining the sensitive behavior classifier, the sensitive behavior classifier is deployed as the analysis kernel in the monitor of the intelligent measurement terminal, and the system operation status data obtained by the collector is received and analyzed in real time through the analysis kernel.

[0133] Since the intelligent measurement terminal can run multiple applications at the same time and different applications may have multiple sensitive behaviors, the collector program developed in the intelligent measurement terminal system can collect the system's operating status data, namely CPU-related data, memory-related data, and network traffic-related data in real time, and transmit the collected data to the analysis kernel.

[0134] The intelligent measurement terminal can use the trained sensitive behavior classifier and the analysis kernel to receive and analyze the system operation status data obtained by the collector in real time, classify sensitive behaviors, and obtain behavior recognition results.

[0135] If the behavior recognition result indicates that the intelligent measurement terminal has sensitive behavior, then based on the preset sensitive behavior detection rules, the sensitive behavior is detected for abnormality to determine whether the sensitive behavior is abnormal sensitive behavior. If the sensitive behavior is determined to be abnormal sensitive behavior, the prompter pushes warning information and generates an event report of abnormal sensitive behavior.

[0136] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0137] In an exemplary embodiment, Figure 6 As shown, a device 600 for identifying application-sensitive behaviors of an intelligent measurement terminal is provided, comprising: a data acquisition module 610, an online monitoring module 620 and an anomaly detection module 630, wherein:

[0138] The data acquisition module 610 is used to obtain multi-dimensional parallel side channel data of the intelligent measurement terminal.

[0139] The online monitoring module 620 is used to take the multi-dimensional parallel side channel data as input, call the trained sensitive behavior classifier, identify the category of the active behavior of the application running on the smart measurement terminal, and obtain the behavior recognition result. The behavior recognition result includes the category of the active behavior. The sensitive behavior classifier is trained based on the multi-dimensional side channel time series data carrying the behavior category label.

[0140] The abnormality detection module 630 is used to determine whether the sensitive behavior is an abnormal sensitive behavior based on the category of the sensitive behavior and the preset sensitive behavior detection rules when the behavior recognition result indicates that the intelligent measurement terminal has a sensitive behavior.

[0141] In an exemplary embodiment, the data acquisition module 610 is also used to obtain historical operating status data of the intelligent measurement terminal.

[0142] In an exemplary embodiment, the application sensitive behavior identification device 600 of the intelligent measurement terminal also includes an offline training module 640, and the offline training module 640 is used to determine the multi-dimensional side channel time series historical data based on the historical operation status data; pre-process the multi-dimensional side channel time series historical data to construct a sensitive behavior side channel feature library; based on the sensitive behavior side channel feature library, train the pre-constructed residual encoder to obtain a sensitive behavior classifier, wherein the sensitive behavior side channel feature library includes multi-dimensional side channel time series data carrying behavior category labels, and each dimension of side channel time series data corresponds to a side channel data source.

[0143] In an exemplary embodiment, the offline training module 640 is also used to input the multidimensional side channel time series data into a pre-built residual encoder; extract the time series features of the side channel time series data of each dimension to obtain multidimensional time series feature data; determine the sensitive behavior category corresponding to the multidimensional time series feature data based on the multidimensional time series feature data; determine the loss function value of the residual encoder based on the behavior category label carried by the multidimensional time series feature data and the output sensitive behavior category, and iteratively update the parameters of the residual encoder based on the loss function value until the preset training end condition is reached to obtain a trained sensitive behavior classifier.

[0144] In an exemplary embodiment, the offline training module 640 is also used to extract time series features of side channel time series data of each dimension based on the residual block and the pooling layer to obtain multidimensional time series feature data; input the multidimensional time series feature data into the attention mechanism layer of the residual encoder to learn the importance of timestamps and obtain an attention feature vector sequence of the multidimensional time series feature data; input the attention feature vector sequence into the fully connected layer and regression layer of the residual encoder to output the sensitive behavior category corresponding to the multidimensional time series feature data.

[0145] In an exemplary embodiment, the offline training module 640 is also used to determine the feature importance of each feature dimension of the multi-dimensional side channel time series historical data; based on each feature importance, select a target feature dimension whose contribution is greater than a preset contribution threshold from multiple feature dimensions; and construct a sensitive behavior side channel feature library based on the side channel time series historical data of the target feature dimension.

[0146] In an exemplary embodiment, the anomaly detection module 630 is also used to determine the normal time period for the normal occurrence of normal sensitive behavior based on preset sensitive behavior detection rules when the behavior recognition results indicate that the intelligent measurement terminal has sensitive behavior; if the identified time period for the occurrence of the sensitive behavior is not within the normal time period corresponding to the sensitive behavior, the sensitive behavior is determined to be an abnormal sensitive behavior.

[0147] In an exemplary embodiment, the anomaly detection module 630 is also used to record the interaction data of the abnormal sensitive behavior and push warning information when determining that the sensitive behavior is an abnormal sensitive behavior; and generate an event report of the abnormal sensitive behavior based on the interaction data.

[0148] Each module in the application sensitive behavior recognition device 600 of the above-mentioned intelligent measurement terminal can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0149] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a method for determining the focus height is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0150] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0151] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps in any of the above-mentioned application program sensitive behavior identification methods for smart measurement terminals are implemented.

[0152] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in any of the above-mentioned application program sensitive behavior identification methods for smart measurement terminals are implemented.

[0153] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps in any one of the above-mentioned application program sensitive behavior identification methods for a smart measurement terminal.

[0154] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0155] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0156] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0157] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for identifying application sensitive behaviors of an intelligent measurement terminal, characterized in that: Applied to a measurement terminal, the method comprises: Obtain multi-dimensional side channel data from intelligent measurement terminals; Taking the multi-dimensional side channel data as input, calling a trained sensitive behavior classifier, identifying the category of the activity behavior of the application running on the measurement terminal, and obtaining a behavior recognition result, wherein the behavior recognition result includes the category of the activity behavior, and the sensitive behavior classifier is trained based on the multi-dimensional side channel time series data carrying the behavior category label; In the case where the behavior recognition result indicates that the intelligent measurement terminal has a sensitive behavior, it is determined whether the sensitive behavior is an abnormal sensitive behavior based on the category of the sensitive behavior and a preset sensitive behavior detection rule.

2. The method according to claim 1, characterized in that Before calling the trained sensitive behavior classifier using the multi-dimensional side channel data as input, the method further includes: Acquiring historical operating status data of the intelligent measurement terminal; Based on the historical operating status data, determining multi-dimensional side channel time series historical data; Preprocess the multi-dimensional side channel time series historical data to build a sensitive behavior side channel feature library; Based on the sensitive behavior side channel feature library, a pre-constructed residual encoder is trained to obtain a sensitive behavior classifier, wherein the sensitive behavior side channel feature library includes multi-dimensional side channel time series data carrying behavior category labels, and each dimension of side channel time series data corresponds to a side channel data source.

3. The method according to claim 2, characterized in that The training of a pre-built residual encoder based on the sensitive behavior side channel feature library includes: Inputting the multi-dimensional side channel time series data into a pre-built residual encoder; Extracting time series features of the side channel time series data in each dimension to obtain multi-dimensional time series feature data; Based on the multidimensional time series feature data, determining a sensitive behavior category corresponding to the multidimensional time series feature data; Based on the behavior category label carried by the multidimensional time series feature data and the output sensitive behavior category, the loss function value of the residual encoder is determined, and based on the loss function value, the parameters of the residual encoder are iteratively updated until the preset training end condition is reached to obtain a trained sensitive behavior classifier.

4. The method according to claim 3, characterized in that The residual encoder includes multiple residual blocks and pooling layers, attention mechanism layers, fully connected layers and regression layers; extracts time series features of side channel time series data of each dimension to obtain multi-dimensional time series feature data, including: Based on the residual block and the pooling layer, extract the time series features of the side channel time series data of each dimension to obtain multi-dimensional time series feature data; The determining, based on the multidimensional time series feature data, a sensitive behavior category corresponding to the multidimensional time series feature data includes: Inputting the multidimensional time series feature data into the attention mechanism layer of the residual encoder, learning the importance of timestamps, and obtaining an attention feature vector sequence of the multidimensional time series feature data; The attention feature vector sequence is input into the fully connected layer and the regression layer of the residual encoder, and the sensitive behavior category corresponding to the multi-dimensional time series feature data is output.

5. The method according to claim 2, characterized in that: The preprocessing of multi-dimensional side channel time series historical data to construct a sensitive behavior side channel feature library includes: Determining the feature importance of each feature dimension of the multi-dimensional side channel time series historical data; Based on the importance of each feature, select target feature dimensions whose contribution is greater than a preset contribution threshold from multiple feature dimensions; Based on the side channel time series historical data of the target feature dimension, a sensitive behavior side channel feature library is constructed.

6. The method according to claim 1, characterized in that The sensitive behavior includes normal sensitive behavior or abnormal sensitive behavior; The determining whether the sensitive behavior is an abnormal sensitive behavior based on the category of the sensitive behavior and a preset sensitive behavior detection rule includes: Based on preset sensitive behavior detection rules, determine the normal occurrence time period of the normal sensitive behavior; If the time period in which the identified sensitive behavior occurs is not within the normal time period corresponding to the sensitive behavior, the sensitive behavior is determined to be an abnormal sensitive behavior.

7. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: If it is determined that the sensitive behavior is an abnormally sensitive behavior, recording the interaction data of the abnormally sensitive behavior and pushing warning information; An event report of the abnormal sensitive behavior is generated based on the interaction data.

8. A device for identifying sensitive behavior of an application program of an intelligent measurement terminal, characterized in that: The device comprises: A data acquisition module, used to obtain multi-dimensional side channel data of the intelligent measurement terminal; an online monitoring module, configured to use the multi-dimensional side channel data as input, call a trained sensitive behavior classifier, identify the category of the activity behavior of the application program running on the smart measurement terminal, and obtain a behavior recognition result, wherein the behavior recognition result includes the category of the activity behavior, and the sensitive behavior classifier is trained based on the multi-dimensional side channel time series data carrying the behavior category label; The abnormality detection module is used to determine whether the sensitive behavior is an abnormal sensitive behavior based on the category of the sensitive behavior and a preset sensitive behavior detection rule when the behavior recognition result indicates that the measurement terminal has a sensitive behavior.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images