Intelligent credible protection method, device, equipment, medium and program product

Abstract

The invention provides an intelligent credible protection method and device, equipment, a medium and a program product. The method comprises the steps that credible log information, network flow log information and equipment credible environments of multiple pieces of equipment are obtained in real time; generating a credible protection strategy according to the credible log information and the network flow log information based on the equipment credible environment by utilizing a pre-trained machine learning model; and according to the credible protection strategy, carrying out credible protection on at least one piece of equipment. According to the embodiment of the invention, the corresponding credible protection strategy can be intelligently generated according to the real-time information of the equipment, the response speed is high, and the network security degree is relatively high.

Description

Technical Field

[0001] The present invention relates to the field of trusted computing technology, and in particular to an intelligent trusted protection method, device, equipment, medium and program product. Background Art

[0002] In the era of smart grids, network security issues are becoming increasingly prominent, and there is a problem of sensitive data leakage. Therefore, it is necessary to prevent malware, virus, worm intrusion, distributed denial of service (DDos) attacks, port scanning, illegal logins, and weak password attacks, and promptly detect and block the transmission of malicious payloads.

[0003] Network security is inseparable from the security of physical facilities. Attacks on smart grids can extend to physical devices, so different files and applications on multiple devices need to be analyzed. Currently, trusted computing technology is a relatively professional means of information security protection, but the configuration of trusted policies requires relatively professional trusted security managers. Generally speaking, configuration by security managers will result in a lower response speed when dealing with security incidents, resulting in a low level of network security. Summary of the invention

[0004] The purpose of the present invention is to provide an intelligent trusted protection method, device, equipment, medium and program product to solve the problems of low response speed, low accuracy and low network security in generating trusted protection strategies.

[0005] In order to solve the above technical problems, an embodiment of the present invention provides an intelligent trusted protection method, including:

[0006] Obtain trusted log information, network traffic log information, and device trusted environment of multiple devices in real time;

[0007] Generate a trusted protection strategy based on the trusted log information and the network traffic log information using a pre-trained machine learning model and based on the trusted environment of the device;

[0008] According to the trusted protection policy, trusted protection is performed on at least one of the devices.

[0009] Optionally, the trusted protection strategy includes at least one of the following:

[0010] A device starts a trusted protection policy, where the device starts a trusted protection policy for indicating a target reference value required by a component of the device;

[0011] A file protection policy, wherein the file protection policy is used to indicate files that need to be integrity protected and file access control permissions;

[0012] An application execution permission policy, wherein the application execution permission policy is used to indicate the execution permission of the application;

[0013] The integrity verification policy of the kernel program and the application process in the memory is used to instruct the kernel program and the application process in the memory to perform integrity verification;

[0014] The process anti-closing strategy is used to indicate whether the application process is opened or closed;

[0015] Peripheral device management and control strategy, the peripheral device management and control strategy is used to indicate the access control authority of the external device;

[0016] The application program and data dissemination control policy is used to indicate the dissemination permission of the application program and the data of the application program.

[0017] Optionally, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including:

[0018] In the trusted startup process of the device, obtaining first component information of the device according to the trusted log information and the network traffic log information;

[0019] Based on the device trusted environment, the first component information is input into a pre-trained machine learning model to obtain the device startup trusted protection strategy generated by the machine learning model.

[0020] Optionally, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including:

[0021] During the operation of the device, obtaining file access control information of the device according to the trusted log information and the network traffic log information, the file access control information including at least one of a file operation state, a file operation program, and a file operation user;

[0022] Based on the device trusted environment, the file access control information is input into a pre-trained machine learning model to obtain the file protection policy generated by the machine learning model.

[0023] Optionally, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including:

[0024] During the operation of the device, the trusted log information and the network traffic log information are used to obtain execution information of an application of the device, wherein the execution information includes at least one of application information, an execution object, and an execution result;

[0025] Based on the device trusted environment, the execution information is input into a pre-trained machine learning model to obtain the application execution permission policy generated by the machine learning model.

[0026] Optionally, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including:

[0027] During the operation of the device, obtaining second component information and memory integrity information of the device according to the trusted log information and the network traffic log information, wherein the memory integrity information includes at least one of integrity information of a kernel program in the memory and integrity information of an application process;

[0028] Based on the device trusted environment, the second component information and the memory integrity information are input into a pre-trained machine learning model to obtain the integrity verification strategy of the kernel program and application process in the memory generated by the machine learning model.

[0029] Optionally, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including:

[0030] During the operation of the device, obtaining behavior data information of the application and its process of the device according to the trusted log information and the network traffic log information;

[0031] Based on the trusted environment of the device, the behavior data information of the application and its process is input into a pre-trained machine learning model to obtain an anti-shutdown strategy for the process generated by the machine learning model.

[0032] Optionally, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including:

[0033] When it is detected that at least one of the devices is connected to an external device, obtaining the third component information, the first application information and the external device permission information of the device corresponding to the external device according to the trusted log information and the network traffic log information;

[0034] Based on the device trusted environment, the third component information, the first application information and the external device permission information are input into a pre-trained machine learning model to obtain the peripheral management and control policy generated by the machine learning model.

[0035] Optionally, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including:

[0036] During operation of the device, the trusted log information and the network traffic log information obtain device propagation information, fourth component information, and second application information;

[0037] Based on the device trusted environment, the device propagation information, the fourth component information and the second application information are input into a pre-trained machine learning model to obtain the application and data propagation control strategy generated by the machine learning model.

[0038] Optionally, the device trusted environment includes one or more of the following:

[0039] an overall trustworthy status of a plurality of said devices;

[0040] Device behavior status;

[0041] Network transmission status;

[0042] Alarm status.

[0043] The embodiment of the present invention further provides an intelligent trusted protection device, comprising:

[0044] A first acquisition module is used to acquire the trusted log information, network traffic log information and device trusted environment of multiple devices in real time;

[0045] A first generating module is used to generate a trusted protection strategy based on the trusted log information and the network traffic log information by using a pre-trained machine learning model and based on the trusted environment of the device;

[0046] The first protection module is used to perform trusted protection on at least one of the devices according to the trusted protection policy.

[0047] An embodiment of the present invention further provides a network device, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program implements the intelligent trusted protection method as described in any one of the above items when executed by the processor.

[0048] An embodiment of the present invention further provides a readable storage medium, comprising: a program is stored on the readable storage medium, and when the program is executed by a processor, the steps of the intelligent trusted protection method as described in any one of the above items are implemented.

[0049] An embodiment of the present invention further provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of the intelligent trusted protection method as described in any one of the above items.

[0050] At least one of the above technical solutions of the present invention has the following beneficial effects:

[0051] In the above scheme, a machine learning model is used to generate a corresponding trusted protection strategy based on the trusted environment of the device and the trusted log information and network traffic log information obtained in real time. The device is trustedly protected according to the trusted protection strategy. The embodiment of the present invention can intelligently generate a trusted protection strategy in real time and perform protection, with fast response speed, high accuracy and high network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A schematic diagram of a flow chart of an intelligent trusted protection method according to an embodiment of the present invention;

[0053] Figure 2 It is a schematic diagram of the structure of an intelligent trusted protection device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] like Figure 1 As shown, an embodiment of the present invention provides an intelligent trusted protection method, including:

[0056] Step S101, obtaining trusted log information, network traffic log information and device trusted environment of multiple devices in real time;

[0057] In step S101, the trusted log information includes but is not limited to device identification, device type, device geographic tag, time, device security tag, user information, behavior subject, and behavior object, wherein the specific information description is shown in Table 1;

[0058]

[0059]

[0060] Table 1

[0061] Network traffic log information includes but is not limited to IP connection information, Transmission Control Protocol (TCP) connection information, User Datagram Protocol (UDP) connection information, Hypertext Transfer Protocol Secure (HTTPS), where the specific information is described in Table 2;

[0062]

[0063]

[0064] Table 2

[0065] The device trusted environment includes, but is not limited to, one or more of the overall trusted status, device behavior status, network transmission status, and alarm status of the multiple devices.

[0066] Step S102, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, generating a trusted protection strategy;

[0067] In step S102, the machine learning model is generated by training through multiple machine learning algorithms based on the trusted log information and network traffic log information in the historical database. It should be noted that the machine learning model is constantly updated and trained. After the trusted protection strategy is generated, the trusted log information and network traffic log information corresponding to the trusted protection strategy are imported into the historical database to update the historical database, thereby updating the trained machine learning model.

[0068] The device trusted environment affects the accuracy, security level, importance level, etc. of trusted log information and network traffic log information. Therefore, when generating a trusted protection strategy based on real-time information, the current device trusted environment needs to be considered. For example, when the overall trusted state of multiple devices is untrustworthy, it means that there are security risks and a trusted protection strategy needs to be generated; when the behavior state of the device is abnormal, the relevant information of the corresponding device is determined as invalid information and / or the device is protected first; when the network transmission state is abnormal, it means that the corresponding acquired device information is inaccurate and needs to be re-acquired or the relevant information obtained in this case is determined as invalid information, etc. The present invention does not make specific limitations on this and can be set according to actual conditions.

[0069] Step S103: Perform trusted protection on at least one of the devices according to the trusted protection strategy.

[0070] In the embodiment of the present invention, a machine learning model is used to obtain the trusted log information, network traffic log information and trusted environment of the device in real time, and based on the trusted environment of the device, a corresponding trusted protection strategy is intelligently generated according to the trusted log information and the network traffic log information, and the device is trustedly protected according to the trusted protection strategy. The embodiment of the present invention can intelligently generate a trusted protection strategy in real time and perform protection. Compared with the manual configuration method in the prior art, it has a fast response speed, high accuracy and high security.

[0071] Optionally, the trusted protection strategy includes at least one of the following:

[0072] A device starts a trusted protection policy, where the device starts a trusted protection policy for indicating a target reference value required by a component of the device;

[0073] A file protection policy, wherein the file protection policy is used to indicate files that need to be integrity protected and file access control permissions;

[0074] An application execution permission policy, wherein the application execution permission policy is used to indicate the execution permission of the application;

[0075] The integrity verification policy of the kernel program and the application process in the memory is used to instruct the kernel program and the application process in the memory to perform integrity verification;

[0076] The process anti-closing strategy is used to indicate whether the application process is opened or closed;

[0077] Peripheral device control policy, the peripheral device control policy is used to indicate the access control authority of the external device;

[0078] The application program and data dissemination control policy is used to indicate the dissemination permission of the application program and the data of the application program.

[0079] In the embodiment of the present invention, the role of each strategy is explained, and the corresponding device is implemented according to the content indicated by each strategy, so as to perform trustworthy protection on the device. The specific content included in each strategy is explained through specific embodiments below:

[0080] The components of the device include but are not limited to hardware configuration, mainboard firmware, operating system kernel and operating system key configuration. The device startup trusted protection strategy includes each component and its target baseline value. After the device startup trusted protection strategy is generated, the initial baseline value of the device is adjusted according to the target baseline value, and then the device is trusted protected.

[0081] The file protection policy includes the files that need to be integrity protected, their baseline values, and file access control permissions (whether the file is allowed to be accessed and / or controlled, whether the specified user or application is allowed to read, modify, write, rename, delete, etc., whether an alarm is generated when the operation is performed, etc.). For example, the files specified in the file protection policy need to be protected from tampering, and an alarm should be issued when tampering is detected; the files specified in the file protection policy can be read and written by specific applications, and an alarm is issued when other applications are detected to have illegal access to the file.

[0082] The application execution permission policy includes whether the application (the program itself, dynamic link library, kernel module, script, etc.) is allowed to execute, whether the specified user is allowed to execute, whether the specified application call is allowed to execute, and whether an alarm is generated during execution, which is used to indicate the application's execution permission; for example, the application specified in the application execution permission policy is not allowed to be executed, and an alarm is issued when the execution of the application is detected.

[0083] The integrity verification strategy for kernel programs and application processes in memory includes whether the integrity of the operating system kernel or the specified application process is verified during memory operation, the memory area for integrity verification and its baseline value, whether the process is allowed to continue execution after the integrity is violated, and whether an alarm is generated.

[0084] The process anti-closing strategy includes whether the closing behavior of the application process needs to be monitored, if a process closing action is detected, the operation of the closing action (allow or deny the closing action), and whether to generate an alarm.

[0085] The peripheral management strategy includes the operation permissions (mount, unmount, read content, modify content, rename files, delete files, etc.) of the external device on the device and whether to generate an alarm when an external device (peripheral) is detected to be connected to the device.

[0086] The application and data propagation control strategy includes whether to allow the specified application and its data to propagate in the network, prohibiting the application from propagating or prohibiting the application's data from propagating when an unauthorized application or its data propagates in the network, and discarding related messages in the network forwarder.

[0087] Optionally, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including:

[0088] In the trusted startup process of the device, obtaining first component information of the device according to the trusted log information and the network traffic log information;

[0089] Based on the device trusted environment, the first component information is input into a pre-trained machine learning model to obtain the device startup trusted protection strategy generated by the machine learning model.

[0090] In the embodiment of the present invention, the components of the device include but are not limited to hardware configuration, mainboard firmware, operating system kernel and operating system key configuration, and the first component information of the device is obtained by deducing the corresponding component information in the current behavior subject and object of the device in the trusted log information and the connection information related to the above components in the network traffic log information, and the first component information includes the benchmark value of the component, firmware version information, device usage information and comparison information between devices of the same type. It should be noted that the benchmark value of the component can be obtained from the measurement value of the component.

[0091] Based on the device trusted environment, the first component information is input into a pre-trained machine learning model, and the target benchmark value required for the component is determined through artificial neural network algorithm, random forest algorithm, maximum expectation algorithm and other algorithms, thereby generating a device startup trusted protection strategy.

[0092] Optionally, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including:

[0093] During the operation of the device, obtaining file access control information of the device according to the trusted log information and the network traffic log information, the file access control information including at least one of a file operation state, a file operation program, and a file operation user;

[0094] Based on the device trusted environment, the file access control information is input into a pre-trained machine learning model to obtain the file protection policy generated by the machine learning model.

[0095] In an embodiment of the present invention, the file is all files in the current behavior subject and object of the device, and the file access control information is derived based on all information about the file in the trusted log information and all connection information about the file in the network traffic log information to obtain the file access control information, wherein the file operation status includes but is not limited to the file type, file path, the frequency of file attacks, the frequency of file use, the file integrity status, the measurement value of the file in a normal integrity state, whether the file allows one or more actions such as reading, writing, renaming, and deletion, and the success or failure of the action, the file operation program represents the application that operates the file, and the file operation user represents the user who operates the file.

[0096] Based on the trusted environment of the device, the file access control information is input into a pre-trained machine learning model, and a file protection policy is generated through an artificial neural network algorithm, a random forest algorithm, a maximum expectation algorithm, etc. The specific content of the policy can be derived from information such as the reading and writing of related files in multiple devices in the system by applications.

[0097] It should be noted that, in general, generating the policy also needs to consider the measurement values ​​of the specified device components.

[0098] Optionally, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including:

[0099] During the operation of the device, obtaining execution information of an application of the device according to the trusted log information and the network traffic log information, the execution information including at least one of application information, an execution object, and an execution result;

[0100] Based on the device trusted environment, the execution information is input into a pre-trained machine learning model to obtain the application execution permission policy generated by the machine learning model.

[0101] In an embodiment of the present invention, the application is all the applications in the current behavior subject and object of the device, and the execution information of the application is obtained by deduction based on all the information about the application in the trusted log information and all the connection information about the application in the network traffic log information, wherein the application information includes but is not limited to one or more of the application type, application owner, application installation path, number of times the application is attacked, frequency of use of the application, and application execution environment information; the execution object is but not limited to files, memory, and network resources; the execution result includes whether the application is allowed to perform actions such as reading, writing, renaming, deleting, transferring, etc. on each execution object and whether the action is successful or not.

[0102] Based on the device trusted environment, the execution information is input into a pre-trained machine learning model, and an application execution permission policy is generated through an artificial neural network algorithm, a random forest algorithm, a maximum expectation algorithm, etc. It should be noted that, in general, the generation of the policy also needs to consider the baseline value of the specified device component, and the baseline value of the component can be obtained from the measurement value of the component.

[0103] Optionally, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including:

[0104] During the operation of the device, obtaining second component information and memory integrity information of the device according to the trusted log information and the network traffic log information, wherein the memory integrity information includes at least one of integrity information of a kernel program in the memory and integrity information of an application process;

[0105] Based on the device trusted environment, the second component information and the memory integrity information are input into a pre-trained machine learning model to obtain the integrity verification strategy of the kernel program and application process in the memory generated by the machine learning model.

[0106] In an embodiment of the present invention, components include but are not limited to hardware configuration, mainboard firmware, operating system kernel and operating system key configuration, etc., and are derived based on the relevant information of components, programs and processes in memory in the trusted log information and the relevant connection information of components, programs and processes in memory in the network traffic log information to obtain second component information and memory integrity information, wherein the second component information includes the behavior and benchmark values ​​of the components of the device, the integrity information of the kernel program includes the behavior of the application in the kernel (reading, writing, renaming, deleting, etc., whether the behavior is successful or not) and its benchmark value, the data of the application in the kernel and its benchmark value, the operation behavior of the application on the hardware / file / memory / network resources in the system, etc., and the integrity information of the application process includes the data of the application process in the kernel and its benchmark value, and the operation behavior of the application process on the hardware / file / memory / network resources in the system.

[0107] Based on the trusted environment of the device, the second component information and memory integrity information are input into a pre-trained machine learning model, and an integrity verification strategy for the kernel program and application process in the memory is generated through an artificial neural network algorithm, a random forest algorithm, a maximum expectation algorithm, etc.

[0108] Optionally, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including:

[0109] During the operation of the device, obtaining behavior data information of the application and its process of the device according to the trusted log information and the network traffic log information;

[0110] Based on the trusted environment of the device, the behavior data information of the application and its process is input into a pre-trained machine learning model to obtain an anti-shutdown strategy for the process generated by the machine learning model.

[0111] In the embodiment of the present invention, the application is all the applications in the current behavior subject and object of the device, and the behavior data information of the application and its process is obtained by deduction based on the information about the application in the trusted log information and the connection information about the application in the network traffic log information. The behavior data information of the application and its process includes the behavior of the application (read, write, rename, delete, etc., whether the action is successful or not) and its benchmark value, the data of the process in the memory and its benchmark value, and the operation behavior on the hardware / file / memory / network resources in the system. The above information can be derived from the relevant information of the application and its process in multiple devices in the system.

[0112] Based on the trusted environment of the device, the behavioral data information of the application and its process is input into a pre-trained machine learning model, and an anti-shutdown strategy for the process is generated through an artificial neural network algorithm, a random forest algorithm, a maximum expectation algorithm, etc.

[0113] Optionally, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including:

[0114] When it is detected that at least one of the devices is connected to an external device, obtaining the third component information, the first application information and the external device permission information of the device corresponding to the external device according to the trusted log information and the network traffic log information;

[0115] Based on the device trusted environment, the third component information, the first application information and the external device permission information are input into a pre-trained machine learning model to obtain the peripheral management and control policy generated by the machine learning model.

[0116] In an embodiment of the present invention, components include but are not limited to hardware configuration, mainboard firmware, operating system kernel and operating system key configuration, etc. When it is detected that at least one of the devices is connected to an external device, the third component information, first application information and external device permission information of the device corresponding to the external device are derived based on the relevant information of the components, applications and external devices in the trusted log information and the relevant connection information of the components, applications and external devices in the network traffic log information, wherein the third component information includes the behavior and benchmark value of the component of the corresponding device, the behavior of the application (reading, writing, renaming, deleting and other actions, whether the action is successful or not) and its benchmark value, the first application information includes the data of the application process in the memory and its benchmark value, operations on the hardware / files / memory / network resources in the system, etc.; the external device permission information includes whether the peripheral allows the specified peripheral to mount, unmount, read content, modify content, rename files, delete files on the specified device and whether an alarm is generated.

[0117] Based on the device trusted environment, the third component information, the first application information and the external device permission information are input into a pre-trained machine learning model, and a peripheral management and control strategy is generated through an artificial neural network algorithm, a random forest algorithm and a maximum expectation algorithm.

[0118] Optionally, using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including:

[0119] During operation of the device, the trusted log information and the network traffic log information obtain device propagation information, fourth component information, and second application information;

[0120] Based on the device trusted environment, the device propagation information, the fourth component information and the second application information are input into a pre-trained machine learning model to obtain the application and data propagation control strategy generated by the machine learning model.

[0121] In an embodiment of the present invention, components include but are not limited to hardware configuration, mainboard firmware, operating system kernel and operating system key configuration, etc., and are derived based on the relevant information on component, application and data propagation in the trusted log information and the relevant connection information on component, application and data propagation in the network traffic log information (such as comparison of multiple similar devices, abnormal virus propagation conditions, etc.) to obtain device propagation information, fourth component information and second application information, wherein the fourth component information includes the behavior of the device component and its benchmark value, the second application information includes the behavior of the application and its benchmark value (read, write, rename, delete and other actions, whether the action is successful or not), the data of the process in the memory and its benchmark value, and the operation of the hardware / file / memory / network resources in the system; the device propagation information includes information on the propagation of the application and its data in the network.

[0122] Based on the device trusted environment, the device propagation information, the fourth component information and the second application information are input into a pre-trained machine learning model, and an application and data propagation management strategy is generated through an artificial neural network algorithm, a random forest algorithm, a maximum expectation algorithm, etc.

[0123] Optionally, the device trusted environment includes one or more of the following:

[0124] an overall trustworthy status of a plurality of said devices;

[0125] Device behavior status;

[0126] Network transmission status;

[0127] Alarm status.

[0128] In an embodiment of the present invention, the device trusted environment affects the accuracy, security level, importance level, etc. of trusted log information and network traffic log information. Therefore, when generating a trusted protection strategy based on real-time information, it is necessary to consider the current device trusted environment. For example; when the overall trusted state of multiple devices is untrustworthy, it means that there are security risks and a trusted protection strategy needs to be generated; when the behavior state of the device is abnormal, the relevant information of the corresponding device is determined as invalid information and / or the device is protected first; when the network transmission state is abnormal, it means that the corresponding acquired device information is inaccurate and needs to be re-acquired or the relevant information acquired in this case is determined as invalid information, etc. The present invention does not make specific limitations on this and can be set according to actual conditions.

[0129] like Figure 2 As shown, an embodiment of the present invention further provides an intelligent trusted protection device, comprising:

[0130] The first acquisition module 201 is used to acquire the trusted log information, network traffic log information and device trusted environment of multiple devices in real time;

[0131] A first generating module 202 is used to generate a trusted protection strategy based on the trusted log information and the network traffic log information by using a pre-trained machine learning model and based on the trusted environment of the device;

[0132] The first protection module 203 is used to perform trusted protection on at least one of the devices according to the trusted protection policy.

[0133] Optionally, the trusted protection strategy generated by the first generating module 202 includes at least one of the following:

[0134] A device starts a trusted protection policy, where the device starts a trusted protection policy for indicating a target reference value required by a component of the device;

[0135] A file protection policy, wherein the file protection policy is used to indicate files that need to be integrity protected and file access control permissions;

[0136] An application execution permission policy, wherein the application execution permission policy is used to indicate the execution permission of the application;

[0137] The integrity verification policy of the kernel program and the application process in the memory is used to instruct the kernel program and the application process in the memory to perform integrity verification;

[0138] The process anti-closing strategy is used to indicate whether the application process is opened or closed;

[0139] Peripheral device control policy, the peripheral device control policy is used to indicate the access control authority of the external device;

[0140] The application program and data dissemination control policy is used to indicate the dissemination permission of the application program and the data of the application program.

[0141] Optionally, the first generating module 202 includes:

[0142] A first acquisition unit is used to obtain first component information of the device according to the trusted log information and the network traffic log information during the trusted startup process of the device;

[0143] The first generating unit is used to input the first component information into a pre-trained machine learning model based on the device trusted environment, and obtain the device startup trusted protection strategy generated by the machine learning model.

[0144] Optionally, the first generating module 202 includes:

[0145] A second acquisition unit is used to obtain file access control information of the device according to the trusted log information and the network traffic log information during the operation of the device, wherein the file access control information includes at least one of a file operation state, a file operation program, and a file operation user;

[0146] The second generating unit is used to input the file access control information into a pre-trained machine learning model based on the device trusted environment to obtain the file protection policy generated by the machine learning model.

[0147] Optionally, the first generating module 202 includes:

[0148] A third acquisition unit is used to obtain, during the operation of the device, execution information of an application of the device from the trusted log information and the network traffic log information, wherein the execution information includes at least one of application information, an execution object, and an execution result;

[0149] The third generating unit is used to input the execution information into a pre-trained machine learning model based on the device trusted environment, and obtain the application execution permission policy generated by the machine learning model.

[0150] Optionally, the first generating module 202 includes:

[0151] a fourth acquisition unit, configured to obtain, during operation of the device, second component information and memory integrity information of the device according to the trusted log information and the network traffic log information, wherein the memory integrity information includes at least one of integrity information of a kernel program in the memory and integrity information of an application process;

[0152] The fourth generating unit is used to input the second component information and the memory integrity information into a pre-trained machine learning model based on the trusted environment of the device, and obtain the integrity verification strategy of the kernel program and application process in the memory generated by the machine learning model.

[0153] Optionally, the first generating module 202 includes:

[0154] A fifth acquisition unit, configured to obtain, during operation of the device, behavior data information of the application and its process of the device according to the trusted log information and the network traffic log information;

[0155] The fifth generating unit is used to input the behavior data information of the application and its process into a pre-trained machine learning model based on the trusted environment of the device, and obtain the anti-shutdown strategy of the process generated by the machine learning model.

[0156] Optionally, the first generating module 202 includes:

[0157] A sixth acquisition unit is used to obtain, when detecting that at least one of the devices is connected to an external device, the third component information, the first application information and the external device permission information of the device corresponding to the external device according to the trusted log information and the network traffic log information;

[0158] The sixth generation unit is used to input the third component information, the first application information and the external device permission information into a pre-trained machine learning model based on the device trusted environment, and obtain the peripheral management and control policy generated by the machine learning model.

[0159] Optionally, the first generating module 202 includes:

[0160] A seventh acquisition unit is used to obtain device propagation information, fourth component information and second application information from the trusted log information and the network traffic log information during the operation of the device;

[0161] The seventh generation unit is used to input the device propagation information, the fourth component information and the second application information into a pre-trained machine learning model based on the device trusted environment, and obtain the application and data propagation control strategy generated by the machine learning model.

[0162] It should be noted that the embodiment of the device is a device corresponding to the embodiment of the above method, and all implementation methods in the embodiment of the above method are applicable to the embodiment of the device and can achieve the same technical effect.

[0163] An embodiment of the present invention also provides a network device, comprising: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, the program implements the intelligent trusted protection method as described in any one of the above items and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0164] The embodiment of the present invention further provides a readable storage medium, including: a program is stored on the readable storage medium, and when the program is executed by the processor, the steps of the intelligent trusted protection method described in any one of the above items are implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0165] An embodiment of the present invention also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, the steps of the intelligent trusted protection method as described in any of the above items are implemented, and the same technical effect can be achieved. To avoid repetition, they are not repeated here.

[0166] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0167] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. An intelligent and trusted protection method, characterized in that: include: Obtain trusted log information, network traffic log information, and device trusted environment of multiple devices in real time; Generate a trusted protection strategy based on the trusted log information and the network traffic log information using a pre-trained machine learning model and based on the trusted environment of the device; According to the trusted protection policy, trusted protection is performed on at least one of the devices.

2. The intelligent trusted protection method according to claim 1, characterized in that: The trusted protection strategy includes at least one of the following: A device starts a trusted protection policy, where the device starts a trusted protection policy for indicating a target reference value required by a component of the device; A file protection policy, wherein the file protection policy is used to indicate files that need to be integrity protected and file access control permissions; An application execution permission policy, wherein the application execution permission policy is used to indicate the execution permission of the application; The integrity verification policy of the kernel program and the application process in the memory is used to instruct the kernel program and the application process in the memory to perform integrity verification; The process anti-closing strategy is used to indicate whether the application process is opened or closed; Peripheral device management and control strategy, the peripheral device management and control strategy is used to indicate the access control authority of the external device; The application program and data dissemination control policy is used to indicate the dissemination permission of the application program and the data of the application program.

3. The intelligent trusted protection method according to claim 2, characterized in that: Using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including: In the trusted startup process of the device, obtaining first component information of the device according to the trusted log information and the network traffic log information; Based on the device trusted environment, the first component information is input into a pre-trained machine learning model to obtain the device startup trusted protection strategy generated by the machine learning model.

4. The intelligent trusted protection method according to claim 2, characterized in that: Using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including: During the operation of the device, obtaining file access control information of the device according to the trusted log information and the network traffic log information, the file access control information including at least one of a file operation state, a file operation program, and a file operation user; Based on the device trusted environment, the file access control information is input into a pre-trained machine learning model to obtain the file protection policy generated by the machine learning model.

5. The intelligent trusted protection method according to claim 2, characterized in that: Using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including: During the operation of the device, the trusted log information and the network traffic log information are used to obtain execution information of an application of the device, wherein the execution information includes at least one of application information, an execution object, and an execution result; Based on the device trusted environment, the execution information is input into a pre-trained machine learning model to obtain the application execution permission policy generated by the machine learning model.

6. The intelligent trusted protection method according to claim 2, characterized in that: Using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including: During the operation of the device, obtaining second component information and memory integrity information of the device according to the trusted log information and the network traffic log information, wherein the memory integrity information includes at least one of integrity information of a kernel program in a memory and integrity information of an application process; Based on the trusted environment of the device, the second component information and the memory integrity information are input into a pre-trained machine learning model to obtain an integrity verification strategy for the kernel program and application process in the memory generated by the machine learning model.

7. The intelligent trusted protection method according to claim 2, characterized in that: Using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including: During the operation of the device, obtaining behavior data information of the application and its process of the device according to the trusted log information and the network traffic log information; Based on the trusted environment of the device, the behavior data information of the application and its process is input into a pre-trained machine learning model to obtain an anti-shutdown strategy for the process generated by the machine learning model.

8. The intelligent trusted protection method according to claim 2, characterized in that: Using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including: When it is detected that at least one of the devices is connected to an external device, obtaining, according to the trusted log information and the network traffic log information, third component information, first application information and external device permission information of a device corresponding to the external device being connected; Based on the device trusted environment, the third component information, the first application information and the external device permission information are input into a pre-trained machine learning model to obtain the peripheral management and control policy generated by the machine learning model.

9. The intelligent trusted protection method according to claim 2, characterized in that: Using a pre-trained machine learning model, based on the device trusted environment, and according to the trusted log information and the network traffic log information, a trusted protection strategy is generated, including: During operation of the device, the trusted log information and the network traffic log information obtain device propagation information, fourth component information, and second application information; Based on the device trusted environment, the device propagation information, the fourth component information and the second application information are input into a pre-trained machine learning model to obtain the application and data propagation management strategy generated by the machine learning model.

10. The intelligent trusted protection method according to any one of claims 1 to 9, characterized in that: The device trusted environment includes one or more of the following: an overall trustworthy status of a plurality of said devices; Device behavior status; Network transmission status; Alarm status.

11. An intelligent and reliable protection device, characterized in that: include: A first acquisition module is used to acquire the trusted log information, network traffic log information and device trusted environment of multiple devices in real time; A first generating module is used to generate a trusted protection strategy based on the trusted log information and the network traffic log information by using a pre-trained machine learning model and based on the trusted environment of the device; The first protection module is used to perform trusted protection on at least one of the devices according to the trusted protection policy.

12. A network device, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the intelligent trusted protection method according to any one of claims 1 to 10.

13. A readable storage medium, characterized in that: include: The readable storage medium stores a program, and when the program is executed by the processor, the steps of the intelligent trusted protection method according to any one of claims 1 to 10 are implemented.

14. A computer program product, characterized in that The method comprises computer instructions, which, when executed by a processor, implement the steps of the intelligent trusted protection method according to any one of claims 1 to 10.

Images