Host quitting method based on UEFI

Abstract

The invention relates to the technical field of data processing, provides a UEFI (Unified Extensible Firmware Interface)-based host quitting method, and aims to solve the security problem caused by vulnerabilities and backdoors of an existing system. A behavior pattern recognition model is used for monitoring and recognizing system behaviors in real time, and when a line crossing behavior or a program which cannot be matched with a behavior baseline is detected, the system can generate early warning information and trigger an isolation mechanism to isolate data corresponding to an abnormal program or behavior. According to the invention, by constructing the behavior baseline and utilizing the artificial intelligence algorithm, accurate identification and rapid response to system behaviors are realized, the security protection capability of the system is effectively improved, the risk of network attack is reduced, and a powerful guarantee is provided for stable operation of the system.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a host martial law method based on UEFI. Background Art

[0002] UEFI (Unified Extensible Firmware Interface) based host security is a computer boot and security mechanism. As a replacement for the traditional BIOS (Basic Input Output System), UEFI is designed to provide a faster, safer, more flexible boot method and more functions. It runs first when the computer starts, is responsible for hardware initialization and operating system loading, so that the system can successfully boot and load hard disk information.

[0003] Host martial law has the ability to protect the stable operation of the host. Through artificial intelligence algorithms, host martial law summarizes the background environment when each micro-action of each program occurs, and generates the behavior pattern of each program. Then, based on the behavior pattern of each program, the system can identify and prevent the intrusion of any new program and the cross-border action of the existing program. However, in the process of real-time monitoring of the system, the existing system has loopholes and even backdoors, which makes the existing system vulnerable to network attacks. After the existing system encounters a network attack, it will cause the existing system to be unable to operate normally. For this reason, the present invention provides a host martial law method based on UEFI. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a host martial law method based on UEFI to solve the problem that the existing system has loopholes and even backdoors, which makes the existing system vulnerable to network attacks. After the existing system encounters a network attack, it will cause the existing system to be unable to operate normally.

[0005] In order to solve the above technical problems, the specific technical solutions of the present invention are as follows: The UEFI-based host martial law method provided by the present invention includes: Step S101, receiving system startup information. After receiving the system startup information, obtaining host basic data, the host basic data includes system operation data, user behavior data, security event data and system configuration, configuring the system in the host system, obtaining the configured host system, and using the configured host system as the real-time operation system; Step S102, obtaining the operation data of the real-time operation system, extracting data features from the operation data of the real-time operation system, and matching the data feature extraction results in a preset host martial law knowledge base to obtain host martial law configuration information corresponding to the operation data of the real-time operation system; Step S103, loading the host martial law configuration information into the real-time operation system, using the real-time operation system after loading the host martial law configuration information to monitor the system data, obtaining real-time monitoring data, receiving the behavior model analysis target information, matching the behavior model analysis target information in a preset algorithm model knowledge base, obtaining the algorithm model corresponding to the behavior model analysis target information, using the algorithm model corresponding to the behavior model analysis target information as a model to be trained, using the real-time monitoring data to train the model to be trained, obtaining a behavior pattern recognition model and a behavior baseline, the behavior pattern recognition model is used to identify programs that cross the line behavior and cannot match the behavior baseline; Step S104, obtaining real-time behavior information in the host system, using the behavior pattern recognition model to recognize the real-time behavior information in the host system, obtaining recognized behavior information, matching the recognized behavior information with the behavior baseline, obtaining a program that crosses the line or cannot match the behavior baseline, and generating warning information for the program that crosses the line or cannot match the behavior baseline; Step S105 , when a program that has crossed the line or cannot match the behavior baseline is generated during the system operation, data corresponding to the program that has crossed the line or cannot match the behavior baseline is isolated.

[0006] Furthermore, the host martial law method based on UEFI described in the present invention, step S101 includes: When the host system starts, the UEFI unified extensible firmware interface layer is first loaded and initialized, and when it receives the system startup information, it starts to execute the subsequent steps; After the system startup information is received, the basic data of the host is obtained. The basic data of the host includes system operation data, user behavior data, security event data and system configuration. The system operation data includes CPU usage and memory usage. The user behavior data includes login attempts and file access records. The security event data includes virus detection records and intrusion detection alarms. The system configuration includes network configuration, service configuration and security policy. Apply the acquired system configuration information to the host system, the system configuration information including updating network settings, adjusting service configurations, and strengthening security policies; After the system configuration is applied, the host system will be updated to the configured state, and the configured host system will be set as the real-time running system.

[0007] Furthermore, the host martial law method based on UEFI of the present invention, step S102 includes: continuously acquiring operation data from the configured host system, preprocessing the acquired operation data, extracting features from the preprocessed data, and combining the extracted data features into a feature set; The constructed data features are combined into a feature set and matched with the preset host martial law knowledge base, which includes a database of known security threats, abnormal behavior patterns, and normal behavior baseline information. Through matching, it is determined whether the operating data of the real-time operating system matches the known security threats or abnormal behavior patterns; According to the matching result, the host martial law configuration information corresponding to the real-time running system operation data is extracted from the host martial law knowledge base, and the host martial law configuration information includes security policies, behavior rules and response measures.

[0008] Furthermore, the host martial law method based on UEFI of the present invention, step S103 includes: Use a real-time running system loaded with host martial law configuration information to monitor system data, including system processes, network activities, and file operations; Continuously obtain real-time monitoring data from the system monitoring process, and determine the target information for behavior model analysis based on the host martial law requirements. The target information for model analysis includes specific types of system behaviors and abnormal behavior patterns; Matching the received behavior model analysis target information in a preset algorithm model knowledge base, using the matched algorithm model as a to-be-trained model, and using the to-be-trained model in a subsequent training process to generate a behavior pattern recognition model capable of recognizing a specific behavior pattern; Training the behavior pattern recognition model. The training process includes data input, model calculation, and parameter adjustment. After training, a behavior pattern recognition model is generated. The behavior pattern recognition model identifies cross-line behaviors and programs that cannot match the behavior baseline based on real-time monitoring data. During the training process, a behavior baseline is also constructed. The behavior baseline is the baseline of normal system behavior and is used to determine whether the real-time system behavior deviates from the normal track. The behavior baseline includes the normal range of system performance indicators and the normal pattern of network activities. The generated behavior pattern recognition model and behavior baseline are deployed to the real-time operation system to monitor and identify abnormal behaviors in real time.

[0009] Furthermore, the host martial law method based on UEFI of the present invention, step S104 includes: Capture behavioral information from the host system in real time, including process launches, file operations, network connections, and system calls; Input the acquired real-time behavior information into the constructed behavior pattern recognition model, extract the recognized behavior information, and extract the recognized behavior information from the output of the behavior pattern recognition model, the behavior information including the type of behavior, timestamp, and objects involved in the behavior; Load the constructed behavior baseline from the storage system. The behavior baseline includes the normal behavior pattern of the host system. The normal behavior pattern is the benchmark for judging whether the real-time behavior is abnormal. Match the identified behavior information with the loaded behavior baseline. The matching process compares the characteristics of the behavior information with the corresponding standards of the behavior baseline to determine whether the behavior deviates from the normal track. Procedures for determining whether there is cross-border behavior or unmatched behavioral baselines; Based on the matching results, determine whether there is any cross-line behavior or program that cannot match the behavior baseline in the identified behavior information; If there is a program that crosses the line or cannot match the behavioral baseline, the corresponding warning information will be generated according to the preset warning rules. The warning information includes behavior information, time of occurrence of the behavior, and potential risks of the behavior.

[0010] Furthermore, the host martial law method based on UEFI described in the present invention, step S105 includes: Monitor the system operation process in real time and use the behavior pattern recognition model to continuously identify the behavior in the host system. When the behavior pattern recognition model identifies the program that crosses the line or fails to match the behavior baseline, the isolation mechanism is triggered; Mark the identified cross-line behaviors or programs that cannot match the behavior baseline, and record the process ID, program name, and trigger time information; According to the marked abnormal program or behavior, the marked abnormal program or behavior includes files, database records and network connection data created, modified or accessed by the program; Perform isolation operations on the data corresponding to the marked abnormal programs or behaviors. Isolation measures include moving the data to an isolated storage area, modifying the access rights of files or databases, restricting the access of abnormal programs or behaviors, and cutting off the network connection of abnormal programs.

[0011] Furthermore, the host martial law method based on UEFI described in the present invention, step S105 includes: The isolation operation information is recorded in data, including the isolation time, isolation object and isolation measures, and isolation warning information is generated; Notify system administrators of quarantine warning information via system notification, email or SMS; Isolation warning information includes the discovery of programs that cross the line or fail to match the behavioral baseline and the status of data isolation. After the isolation operation is implemented, the system operation status is continuously monitored.

[0012] Beneficial effects of the present invention: The present invention uses a host martial law method based on UEFI, so that the system can be securely configured at the startup stage, so that the system is in a secure state from the beginning. Real-time monitoring and identification of abnormal behaviors in the system effectively prevents the intrusion of new programs and the cross-border actions of existing programs, reducing the risk of the system being attacked by the network.

[0013] We use artificial intelligence algorithms to build a behavioral pattern recognition model, and train the model through real-time monitoring data, so that it can accurately identify behaviors that cross the line and programs that cannot match the behavioral baseline. Combined with the behavioral baseline, we conduct a detailed comparison of system behaviors, which improves the accuracy and efficiency of abnormal behavior identification.

[0014] Achieve rapid response and isolation. When abnormal behavior is identified, the system will immediately trigger the isolation mechanism to isolate the data corresponding to the abnormal program or behavior to prevent the threat from spreading further. Detailed records of isolation operation information and timely notification of isolation warning information enable system administrators to quickly understand and respond to security incidents. Through continuous monitoring of system behavior and timely isolation of abnormal behavior, the stable operation of the system and data security are guaranteed. Even when the system is attacked or fails, the normal operation of the system can be quickly restored to reduce losses.

[0015] The UEFI-based host martial law method provided by the present invention realizes automated security monitoring and abnormal behavior identification, reduces the workload of system administrators, and effectively reduces the security management costs of enterprises by reducing manual intervention and reducing the complexity of security management.

[0016] In summary, the UEFI-based host martial law method provided by the present invention has obvious beneficial effects in improving system security protection capabilities, enhancing the accuracy of abnormal behavior recognition, achieving rapid response and isolation, system stability and reliability, and reducing security management costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solution of the present invention, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, for ordinary technicians in this field, other drawings can be obtained based on the drawings without paying any creative labor.

[0018] Figure 1 A schematic diagram of a UEFI-based host martial law method process provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. The technical solutions provided by the embodiments of the present invention are described in detail below in conjunction with the drawings.

[0020] In order to better understand the purpose of the present invention, the present invention is described in further detail below.

[0021] The UEFI-based host martial law method provided by the present invention includes: Step S101, receiving system startup information. After receiving the system startup information, obtaining host basic data, the host basic data includes system operation data, user behavior data, security event data and system configuration, configuring the system in the host system, obtaining the configured host system, and using the configured host system as the real-time operation system; In step S101, the UEFI-based host martialing method provided by the present invention first receives system startup information. When the system startup information is received, a series of operations are performed to configure and protect the host system. The following is a detailed analysis of this step: When the host system starts, the UEFI (Unified Extensible Firmware Interface) layer is first loaded and initialized. As a replacement for the traditional BIOS, UEFI is responsible for hardware initialization and operating system loading. During this process, the UEFI-based host martial law method receives system startup information, which is the trigger point for the subsequent steps to be executed.

[0022] When receiving the system startup information, the method starts to obtain the basic data of the host, which includes system operation data, user behavior data, security event data and system configuration.

[0023] System operation data includes CPU usage, memory usage, etc. These data reflect the current operating status of the system.

[0024] User behavior data includes login attempts, file access records, etc., which provide information about the user's operations on the system.

[0025] Security event data includes virus detection records, intrusion detection alerts, etc., which indicate the security threats faced by the system.

[0026] System configuration includes network configuration, service configuration, security policy, etc. These data define the system's operating environment and security requirements.

[0027] Configure the host system and apply the acquired system configuration information to the host system. This includes updating network settings, adjusting service configurations, strengthening security policies, etc., so that the system can run in accordance with the predetermined security requirements. The configured host system is set as a real-time operating system, that is, the system will continue to run according to the new configuration and accept real-time monitoring and protection of the host martial law method.

[0028] The system automatically triggers the UEFI-based boot process to trigger the execution of the host martial law method. Comprehensive data collection obtains the basic data of the host, including operation data, user behavior data, security event data and system configuration, providing a basis for subsequent security analysis and configuration. System configuration update updates the host system based on the collected system configuration information so that the system runs according to the predetermined security policy. Real-time operation system setting sets the configured host system as a real-time operation system for continuous monitoring and protection.

[0029] Through the above steps, step S101 provides a solid foundation for the entire host martial law method, so that the host system is in a safe and protected state when it is started, and is ready for subsequent real-time monitoring and abnormal behavior identification.

[0030] Step S102, obtaining the operation data of the real-time operation system, extracting data features from the operation data of the real-time operation system, and matching the data feature extraction results in a preset host martial law knowledge base to obtain host martial law configuration information corresponding to the operation data of the real-time operation system; In step S102, the UEFI-based host curfew method obtains the operating data of the real-time operating system, extracts data features, and then matches the feature extraction results with the preset host curfew knowledge base to obtain the host curfew configuration information corresponding to the real-time operating system operating data. The following is a detailed analysis of this step: Continuously collects real-time operation data from the configured host system, covering all aspects of the system, such as system processes, network activities, file operations, etc., which is a comprehensive reflection of the current operating status of the system.

[0031] After obtaining the real-time operation data, the method will perform feature extraction on the data. Feature extraction is a step in data preprocessing, which aims to extract features that can represent the essence and information of the data from the raw data. These features include system performance indicators, network activity patterns, file operation frequencies, etc. The host martial law knowledge base is a database containing information such as known security threats, abnormal behavior patterns, and normal behavior baselines. The knowledge base is the basis for the method to accurately identify and respond to potential security threats.

[0032] The extracted data features are matched with the preset host martial law knowledge base. This process aims to identify whether there are features in the real-time operation data that match known security threats or abnormal behavior patterns. Through matching, the method can quickly locate potential security risk points.

[0033] According to the matching results, the method will extract the host martial law configuration information corresponding to the real-time running system operation data from the host martial law knowledge base. These configuration information include but are not limited to security policies, behavior rules, response measures, etc., which will guide the method on how to respond to and handle potential security threats.

[0034] Improve the efficiency and accuracy of data analysis through feature extraction, and provide strong support for subsequent matching and response. Use the preset host martial law knowledge base to quickly identify potential security threats and improve the response speed and accuracy of the method. Extract the corresponding host martial law configuration information based on the matching results to provide specific guidance for subsequent security protection.

[0035] Through step S102, the host martial law method based on UEFI can achieve continuous monitoring and dynamic protection of the real-time running system and effectively deal with potential security threats.

[0036] Step S103, loading the host martial law configuration information into the real-time operation system, using the real-time operation system after loading the host martial law configuration information to monitor the system data, obtaining real-time monitoring data, receiving the behavior model analysis target information, matching the behavior model analysis target information in a preset algorithm model knowledge base, obtaining the algorithm model corresponding to the behavior model analysis target information, using the algorithm model corresponding to the behavior model analysis target information as a model to be trained, using the real-time monitoring data to train the model to be trained, obtaining a behavior pattern recognition model and a behavior baseline, the behavior pattern recognition model is used to identify programs that cross the line behavior and cannot match the behavior baseline; In step S103, the UEFI-based host martialing method further deepens the security protection strategy. By loading host martialing configuration information, real-time monitoring of system data, training behavior pattern recognition models, etc., a security protection system that can identify and respond to abnormal behaviors is constructed. The following is a detailed analysis of this step: Loading host martial law configuration information to the real-time running system, in this step, the host martial law configuration information previously extracted from the host martial law knowledge base is loaded into the real-time running system. These configuration information include security policies, behavior rules, response measures, etc., which provide clear security protection guidance for the system.

[0037] The loaded real-time running system is used to monitor the system data. The real-time running system loaded with the host martial law configuration information begins to monitor the system data comprehensively. The monitored data types are wide-ranging, including but not limited to system processes, network activities, file operations, etc., and all the operating information of the system can be captured.

[0038] By continuously monitoring system data, the method can obtain a large amount of real-time monitoring data. This data is the basis for subsequent behavior pattern recognition model training and is also a true reflection of the system security status. According to the needs of security protection, the method will receive specific behavior model analysis target information. This information is usually related to specific security threats or abnormal behavior patterns and is used to guide subsequent behavior pattern recognition model training.

[0039] Matching is performed in the preset algorithm model knowledge base. The received behavior model analysis target information will be matched in the preset algorithm model knowledge base. The knowledge base contains a variety of algorithm models, each of which targets a specific behavior pattern or security threat. Through matching, the algorithm model that best matches the target information can be found.

[0040] The matching algorithm model is used as the model to be trained. After the matching algorithm model is found, it is determined as the model to be trained. The model to be trained will be used in the subsequent training process to generate a behavior pattern recognition model that can accurately identify a specific behavior pattern.

[0041] Use real-time monitoring data to train the model to be trained. Use the real-time monitoring data previously acquired to train the model to be trained. The training process includes multiple links such as data input, model calculation, and parameter adjustment, aiming to enable the model to accurately identify cross-line behaviors and programs that cannot match the behavioral baseline.

[0042] After training, the behavior pattern recognition model and behavior baseline are obtained. The behavior pattern recognition model is the core component of the method, which can identify and judge the behavior in the system in real time. The behavior baseline is the baseline of normal system behavior, which is used to judge whether the real-time system behavior deviates from the normal track.

[0043] Load configuration information and run the system in real time to protect according to the preset security policy. Capture all the system operation information to provide data support for subsequent behavior pattern recognition. Through matching the algorithm model knowledge base and training the model to be trained, a behavior pattern recognition model that can accurately identify abnormal behavior is constructed. Establish a behavior baseline as a benchmark for judging whether the system behavior is normal, and improve the accuracy and efficiency of security protection.

[0044] By implementing step S103, the host martial law method based on UEFI builds an efficient and accurate security protection system, which can effectively deal with abnormal behaviors and potential security threats in the system.

[0045] Step S104, obtaining real-time behavior information in the host system, using the behavior pattern recognition model to recognize the real-time behavior information in the host system, obtaining recognized behavior information, matching the recognized behavior information with the behavior baseline, obtaining a program that crosses the line or cannot match the behavior baseline, and generating warning information for the program that crosses the line or cannot match the behavior baseline; In step S104, the UEFI-based host curfew method further refines the monitoring and analysis process of real-time behavior information in the host system. Through the use of the behavior pattern recognition model, this step can accurately identify abnormal behavior in the system and generate corresponding warning information. The following is a detailed analysis of this step: First, obtain the real-time behavior information in the host system. This information includes but is not limited to process startup, file operations, network connections, system calls, etc., which together constitute a dynamic picture of system operation. Use the previously trained behavior pattern recognition model to identify the acquired real-time behavior information. The behavior pattern recognition model can quickly and accurately classify and judge the input behavior information based on its internal learning algorithm and logic.

[0046] After the recognition of the behavior pattern recognition model, the method can obtain a series of recognized behavior information. This information has been screened and verified by the model and has high accuracy and credibility.

[0047] The identified behavior information is then matched with the previously constructed behavior baseline. The behavior baseline represents the baseline of the normal behavior of the system, which helps to determine whether the current behavior deviates from the normal track.

[0048] Procedures for determining whether there is cross-line behavior or unmatched behavior baseline: Through the matching process, the method can determine whether there are cross-line behaviors or programs that cannot match the behavior baseline. Cross-line behaviors refer to abnormal behaviors that obviously deviate from normal behavior patterns, while programs that cannot match the behavior baseline are unknown security threats or potential risks.

[0049] When a behavior that crosses the line or a program that fails to match the behavior baseline is found, the method will immediately generate an early warning message. The early warning message usually contains the specific details of the behavior, the time of occurrence, the potential risks, etc., so that the system administrator can respond quickly and take necessary measures.

[0050] Real-time behavior information acquisition: Capture all behaviors occurring in the system.

[0051] Behavior pattern recognition: Use advanced behavior pattern recognition models to accurately classify and judge behaviors in the system.

[0052] Behavioral baseline matching: Improve the accuracy and efficiency of abnormal behavior identification through the use of behavioral baselines.

[0053] Early warning information generation: Generate early warning information in a timely manner to provide system administrators with a basis for rapid response and disposal.

[0054] Through the implementation of step S104, the UEFI-based host martial law method can achieve effective monitoring and analysis of real-time behavior information in the host system, and timely discover and warn of potential security threats and risks.

[0055] Step S105 , when a program that has crossed the line or cannot match the behavior baseline is generated during the system operation, data corresponding to the program that has crossed the line or cannot match the behavior baseline is isolated.

[0056] In step S105, the UEFI-based host martial law method takes decisive measures to deal with potential security threats that occur during system operation. When the system detects cross-line behaviors or programs that cannot match the behavior baseline, the method immediately isolates the data corresponding to these abnormal programs or behaviors to prevent them from further spreading or causing greater damage. The following is a detailed analysis of this step: The real-time behavior information in the system is identified through the behavior pattern recognition model and matched with the behavior baseline. When an out-of-line behavior or a program that cannot match the behavior baseline is detected, it indicates that the system has been subjected to unknown security threats or potential risks.

[0057] When an abnormal program or behavior is detected, the method will immediately isolate the corresponding data. Isolation measures include moving data to an isolated storage area, modifying file or database access permissions, limiting access to abnormal programs or behaviors, and cutting off network connections for abnormal programs. These measures are intended to prevent the further spread of abnormal programs or behaviors and protect other parts of the system from being affected.

[0058] While performing the isolation operation, the method will also record the isolation operation information in detail, including isolation time, isolation object, isolation measures, etc. This information is helpful for subsequent security analysis and auditing. In addition, the method will generate isolation warning information and notify the system administrator in a timely manner through system notifications, emails or text messages. The warning information usually contains specific details of abnormal programs or behaviors, the situation of isolation operations, and potential risk warnings, so that the system administrator can quickly understand and take further disposal measures.

[0059] Data isolation is not the final solution, but an emergency response measure. After isolating abnormal programs or behaviors, the method will continue to monitor the system operation status to ensure that the abnormal behavior does not spread further or have other adverse effects. At the same time, system administrators also need to further analyze the causes and sources of abnormal behaviors based on warning information and isolation operation records, and take corresponding security reinforcement and repair measures to prevent similar incidents from happening again.

[0060] Through the implementation of step S105, the host martial law method based on UEFI can effectively deal with potential security threats that occur during system operation and protect the data security and stable operation of the system.

[0061] Specifically, the host martial law method based on UEFI of the present invention, step S101 includes: When the host system starts, the UEFI unified extensible firmware interface layer is first loaded and initialized, and when it receives the system startup information, it starts to execute the subsequent steps; After the system startup information is received, the basic data of the host is obtained. The basic data of the host includes system operation data, user behavior data, security event data and system configuration. The system operation data includes CPU usage and memory usage. The user behavior data includes login attempts and file access records. The security event data includes virus detection records and intrusion detection alarms. The system configuration includes network configuration, service configuration and security policy. Apply the acquired system configuration information to the host system, the system configuration information including updating network settings, adjusting service configurations, and strengthening security policies; After the system configuration is applied, the host system will be updated to the configured state, and the configured host system will be set as the real-time running system.

[0062] In the UEFI-based host martial law method, the following is a detailed analysis of the steps: When the host system starts, the UEFI (Unified Extensible Firmware Interface) layer is loaded and initialized first. As the boot interface of modern computer systems, UEFI replaces the traditional BIOS and provides a faster, safer and more flexible boot method.

[0063] When the UEFI layer completes initialization, it will receive the system startup information. This step marks the official start of the host system startup process.

[0064] After receiving the system startup information, the method will obtain the basic data of the host, including: System operation data: such as CPU usage, memory usage, etc. These data reflect the current operating status and resource usage of the system.

[0065] User behavior data: such as login attempts, file access records, etc., these data help to understand users' operating habits and behavior patterns.

[0066] Security event data: such as virus detection records, intrusion detection alerts, etc., these data are crucial for identifying and responding to potential security threats.

[0067] System configuration: including network configuration, service configuration and security policy, etc. These configuration information determine the system's network connection mode, service operation status and security protection level.

[0068] Application system configuration information: After obtaining the host basic data, the method will apply the system configuration information to the host system, including updating network settings, adjusting service configurations, and strengthening security policies, so that the system can run according to the predetermined security requirements.

[0069] Update the host system status: After the system configuration is applied, the host system will be updated to the configured state, which reflects the latest security requirements and operating parameters of the system.

[0070] Set up the real-time operating system: Finally, the configured host system is set as a real-time operating system, which means that the system has completed the boot and configuration process and can start running normally and accept user operation instructions.

[0071] Specifically, the host martial law method based on UEFI of the present invention, step S102 includes: continuously acquiring operation data from the configured host system, preprocessing the acquired operation data, extracting features from the preprocessed data, and combining the extracted data features into a feature set; The constructed data features are combined into a feature set and matched with the preset host martial law knowledge base, which includes a database of known security threats, abnormal behavior patterns, and normal behavior baseline information. Through matching, it is determined whether the operating data of the real-time operating system matches the known security threats or abnormal behavior patterns; According to the matching result, the host martial law configuration information corresponding to the real-time running system operation data is extracted from the host martial law knowledge base, and the host martial law configuration information includes security policies, behavior rules and response measures.

[0072] In the UEFI-based host martial law method, step S102 is a crucial link, which involves continuous monitoring, preprocessing, feature extraction and matching of host system operation data with a preset knowledge base to identify potential security threats or abnormal behavior patterns. The following is a detailed analysis of this step: Step S102: Operation data monitoring and feature matching: The method will continuously obtain real-time operation data from the configured host system. These data cover all aspects of the system, such as process operation, network activity, file operation, etc., which are important bases for judging the system status and behavior mode.

[0073] The raw operating data obtained contains noise, redundancy or inconsistent formats, so it needs to be preprocessed. The preprocessing steps include data cleaning, format conversion, deduplication and other operations to improve the accuracy and efficiency of subsequent analysis.

[0074] In the preprocessed data, the method will extract feature information. These features are numerical (such as CPU usage, memory usage, etc.) and non-numerical (such as process name, file path, etc.). The purpose of feature extraction is to convert raw data into more representative and discriminative information to facilitate subsequent analysis and matching.

[0075] The extracted features will be combined into a feature set. This feature set is a multidimensional vector that describes the current system operation status and contains feature information extracted from multiple dimensions.

[0076] The constructed feature set will be matched with the preset host curfew knowledge base. The host curfew knowledge base is a database containing known security threats, abnormal behavior patterns, and normal behavior baseline information. Through matching, the method can determine whether the current system's operating data matches the known security threats or abnormal behavior patterns.

[0077] Through the implementation of step S102, the host martial law method based on UEFI can realize real-time monitoring and intelligent analysis of the operating status of the host system, providing a strong guarantee for the security protection of the system.

[0078] Specifically, the host martial law method based on UEFI of the present invention, step S103 includes: Use a real-time running system loaded with host martial law configuration information to monitor system data, including system processes, network activities, and file operations; Continuously obtain real-time monitoring data from the system monitoring process, and determine the target information for behavior model analysis based on the host martial law requirements. The target information for model analysis includes specific types of system behaviors and abnormal behavior patterns; Matching the received behavior model analysis target information in a preset algorithm model knowledge base, using the matched algorithm model as a to-be-trained model, and using the to-be-trained model in a subsequent training process to generate a behavior pattern recognition model capable of recognizing a specific behavior pattern; Training the behavior pattern recognition model. The training process includes data input, model calculation, and parameter adjustment. After training, a behavior pattern recognition model is generated. The behavior pattern recognition model identifies cross-line behaviors and programs that cannot match the behavior baseline based on real-time monitoring data. During the training process, a behavior baseline is also constructed. The behavior baseline is the baseline of normal system behavior and is used to determine whether the real-time system behavior deviates from the normal track. The behavior baseline includes the normal range of system performance indicators and the normal pattern of network activities. The generated behavior pattern recognition model and behavior baseline are deployed to the real-time operation system to monitor and identify abnormal behaviors in real time.

[0079] In the UEFI-based host martial law method, step S103 is the step of building and deploying a behavior pattern recognition model, which involves in-depth monitoring of system data, model training, and building a behavior baseline. The following is a detailed analysis of this step: Use the real-time running system that has loaded the host martial law configuration information to comprehensively monitor the system data. The monitored data includes but is not limited to system processes, network activities, and file operations, which are the basis for judging whether the system behavior is normal.

[0080] Real-time monitoring data is continuously obtained from the system monitoring process, and the target information for behavior model analysis is determined based on the specific needs of the host. This target information usually includes specific types of system behaviors (such as process startup, access to specific files, etc.) and abnormal behavior patterns (such as abnormal network connections, unauthorized file operations, etc.).

[0081] The received behavior model analysis target information is matched in a preset algorithm model knowledge base. The algorithm model knowledge base contains a variety of algorithm models for behavior pattern recognition. Through matching, the algorithm model that best suits the current analysis target can be found as the model to be trained.

[0082] The training model is trained using real-time monitoring data. The training process includes data input, model calculation, and parameter adjustment, aiming to enable the model to accurately identify specific behavior patterns. After training, the generated behavior pattern recognition model will have the ability to identify cross-line behaviors and programs that cannot match the behavior baseline based on real-time monitoring data.

[0083] While the model is being trained, a behavior baseline is constructed. The behavior baseline is the baseline of normal system behavior, which includes information such as the normal range of system performance indicators and the normal pattern of network activities. The behavior baseline is used to determine whether the real-time system behavior deviates from the normal track and is an important basis for identifying abnormal behavior.

[0084] The generated behavior pattern recognition model and behavior baseline are deployed to the real-time operation system. In this way, the system can monitor and identify abnormal behaviors in real time, providing strong support for subsequent early warning and isolation measures.

[0085] Through the implementation of step S103, the UEFI-based host martial law method can build an efficient and accurate behavior pattern recognition model and behavior baseline, providing strong technical support for the security protection of the system.

[0086] Specifically, the host martial law method based on UEFI of the present invention, step S104 includes: Capture behavioral information from the host system in real time, including process launches, file operations, network connections, and system calls; Input the acquired real-time behavior information into the constructed behavior pattern recognition model, extract the recognized behavior information, and extract the recognized behavior information from the output of the behavior pattern recognition model, the behavior information including the type of behavior, timestamp, and objects involved in the behavior; Load the constructed behavior baseline from the storage system. The behavior baseline includes the normal behavior pattern of the host system. The normal behavior pattern is the benchmark for judging whether the real-time behavior is abnormal. Match the identified behavior information with the loaded behavior baseline. The matching process compares the characteristics of the behavior information with the corresponding standards of the behavior baseline to determine whether the behavior deviates from the normal track. Procedures for determining whether there is cross-border behavior or unmatched behavioral baselines; Based on the matching results, determine whether there is any cross-line behavior or program that cannot match the behavior baseline in the identified behavior information; If there is a program that crosses the line or cannot match the behavioral baseline, the corresponding warning information will be generated according to the preset warning rules. The warning information includes behavior information, time of occurrence of the behavior, and potential risks of the behavior.

[0087] Capture behavior information from the host system in real time, including but not limited to process startup, file operations, network connections, and system calls, etc. This information is an important basis for judging whether the system behavior is normal.

[0088] The captured real-time behavior information is input into the previously constructed behavior pattern recognition model. The model processes and analyzes this information and extracts the recognized behavior information. This information usually includes the type of behavior, timestamp, and objects involved in the behavior.

[0089] Load the built behavior baseline from the storage system. The behavior baseline represents the normal behavior pattern of the host system and is the benchmark for judging whether the real-time behavior is abnormal. It contains information such as the normal range of system performance indicators and the normal pattern of network activities.

[0090] The identified behavior information is matched with the loaded behavior baseline. The matching process compares the characteristics of the behavior information with the corresponding standards of the behavior baseline to determine whether the behavior deviates from the normal track.

[0091] Based on the matching results, determine whether there are any cross-border behaviors or programs that cannot match the behavior baseline in the identified behavior information. Cross-border behaviors refer to those behaviors that are beyond the normal behavior range, and programs that cannot match the behavior baseline are potential malware or unknown threats.

[0092] If there is a program that crosses the line or fails to match the behavior baseline, the corresponding warning information will be generated according to the preset warning rules. The warning information usually includes the behavior information, the time when the behavior occurred, and the potential risk of the behavior, so that the system administrator can understand and respond to potential security threats in a timely manner.

[0093] Through the implementation of step S104, the UEFI-based host martial law method can achieve real-time monitoring of host system behavior and abnormal behavior detection, providing a strong guarantee for the security protection of the system.

[0094] Specifically, the host martial law method based on UEFI of the present invention, step S105 includes: Monitor the system operation process in real time and use the behavior pattern recognition model to continuously identify the behavior in the host system. When the behavior pattern recognition model identifies the program that crosses the line or fails to match the behavior baseline, the isolation mechanism is triggered; Mark the identified cross-line behaviors or programs that cannot match the behavior baseline, and record the process ID, program name, and trigger time information; According to the marked abnormal program or behavior, the marked abnormal program or behavior includes files, database records and network connection data created, modified or accessed by the program; Perform isolation operations on the data corresponding to the marked abnormal programs or behaviors. Isolation measures include moving the data to an isolated storage area, modifying the access rights of files or databases, restricting the access of abnormal programs or behaviors, and cutting off the network connection of abnormal programs.

[0095] The behavioral pattern recognition model is used to continuously identify the behavior in the host system and monitor the system behavior in real time, which is the basis for timely detection and isolation of abnormal behavior.

[0096] When the behavior pattern recognition model identifies a program that crosses the line or fails to match the behavior baseline, the isolation mechanism is immediately triggered. This is a step to prevent abnormal behavior from continuing to endanger system security.

[0097] Mark the identified cross-line behaviors or programs that cannot match the behavior baseline, and record their process ID, program name, trigger time, etc. This information is helpful for subsequent analysis and tracking.

[0098] Based on the marked abnormal programs or behaviors, their impact scope can be further tracked, including files, database records, and network connection data created, modified, or accessed by the program.

[0099] Isolate the data corresponding to the marked abnormal programs or behaviors. Isolation measures include moving data to an isolated storage area, modifying file or database access permissions to limit access by abnormal programs, and cutting off network connections of abnormal programs. These measures are designed to prevent abnormal behaviors from continuing to affect system security while protecting important data from being destroyed or leaked.

[0100] Through the implementation of step S105, the UEFI-based host martial law method can achieve rapid response and effective isolation of abnormal behaviors, providing strong support for the security protection of the system. At the same time, this also reflects the flexibility and effectiveness of the method in dealing with unknown threats and new attacks.

[0101] Specifically, the host martial law method based on UEFI of the present invention, step S105 includes: The isolation operation information is recorded in data, including the isolation time, isolation object and isolation measures, and isolation warning information is generated; Notify system administrators of quarantine warning information via system notification, email or SMS; Isolation warning information includes the discovery of programs that cross the line or fail to match the behavioral baseline and the status of data isolation. After the isolation operation is implemented, the system operation status is continuously monitored.

[0102] When isolation measures are taken for abnormal programs or behaviors, the system will record the isolation operation information in detail. This information includes but is not limited to the isolation time (i.e. the specific time point when the isolation operation is performed), the isolation object (the specific name or identifier of the isolated program or behavior), and the isolation measures (such as data movement, access permission modification, network connection disconnection, etc.). The purpose of recording isolation operation information is to provide complete data support for subsequent security audits and event tracking.

[0103] Based on the recorded isolation operation information, the system will automatically generate isolation warning information. The warning information includes the discovery of programs that cross the line or fail to match the behavior baseline, the data isolation measures taken, and the existing security risks or impact assessments. The generation of warning information helps system administrators quickly understand the current security status of the system and take corresponding countermeasures.

[0104] The system will promptly notify the system administrator of the quarantine warning information through various means (such as system notification, email or SMS). This enables the administrator to be informed of the system security incidents at the first time and take appropriate measures. The diversity of notification methods helps to improve the accessibility and timeliness of information, so that the administrator will not miss any important security warnings.

[0105] After the isolation operation is implemented, the system does not stop monitoring the operation status. Instead, it continues to use the behavior pattern recognition model to continuously identify and analyze the behavior in the host system. The purpose of continuous monitoring is to effectively isolate abnormal behaviors and prevent new security threats from emerging. At the same time, it also provides system administrators with the ability to monitor and respond to security incidents in real time.

[0106] Through the implementation of step S105, the host martial law method based on UEFI can not only effectively isolate abnormal behaviors, but also enable system administrators to be informed of security events in a timely manner and respond, thereby fully enhancing the security protection capabilities of the system.

[0107] The UEFI-based host martial law method provided by the present invention effectively solves the problem that the existing system has loopholes and even backdoors, which makes the system vulnerable to network attacks and the system cannot operate normally after encountering network attacks. The specific solution is as follows: When the system starts, the UEFI unified extensible firmware interface layer is first loaded and initialized to put the system in a secure boot environment. After receiving the system startup information, the basic data of the host is obtained, including system operation data, user behavior data, security event data, and system configuration. The obtained system configuration information (such as network configuration, service configuration, and security policy) is applied to the host system, and the system status is updated to the configured real-time running system.

[0108] Continuously obtain operation data from the configured host system, and perform data preprocessing and feature extraction. Combine the extracted data features into a feature set, match it with the preset host martial law knowledge base, and identify known security threats or abnormal behavior patterns. Based on the matching results, load the host martial law configuration information into the real-time operation system to monitor the system data in real time.

[0109] Receive the target information of the behavior model analysis, and find the corresponding algorithm model in the preset algorithm model knowledge base as the model to be trained. Use the real-time monitoring data to train the model to be trained, and generate the behavior pattern recognition model and behavior baseline. The behavior pattern recognition model is used to identify the cross-line behavior and the program that cannot match the behavior baseline.

[0110] Capture behavioral information from the host system in real time, including process launches, file operations, network connections, system calls, and more.

[0111] Use the behavior pattern recognition model to identify real-time behavior information and obtain the identified behavior information. Match the identified behavior information with the behavior baseline to determine whether there is any cross-line behavior or a program that cannot match the behavior baseline.

[0112] When a program that crosses the line or fails to match the behavior baseline is identified, an early warning message is generated, including behavior information, behavior occurrence time, behavior potential risk, etc. The isolation mechanism is triggered to isolate the data corresponding to the identified abnormal program or behavior, including moving the data to an isolated storage area, modifying the access rights of files or databases, restricting access to abnormal programs or behaviors, and cutting off the network connection of abnormal programs. The isolation operation information is recorded, and an isolation early warning message is generated, which is notified to the system administrator via system notification, email, or SMS. After the isolation operation is implemented, the system operation status is continuously monitored to ensure stable system operation.

[0113] Through the above technical scheme, the UEFI-based host martial law method provided by the present invention can monitor the operating status of the system in real time, identify and prevent the intrusion of any new programs and the out-of-bounds actions of existing programs, effectively prevent network attacks, and protect the normal operation of the system.

Claims

1. A host martial law method based on UEFI, characterized in that: include: Step S101, receiving system startup information. After receiving the system startup information, obtaining host basic data, the host basic data includes system operation data, user behavior data, security event data and system configuration, configuring the system in the host system, obtaining the configured host system, and using the configured host system as the real-time operation system; Step S102, obtaining the operation data of the real-time operation system, extracting data features from the operation data of the real-time operation system, and matching the data feature extraction results in a preset host martial law knowledge base to obtain host martial law configuration information corresponding to the operation data of the real-time operation system; Step S103, loading the host martial law configuration information into the real-time operation system, using the real-time operation system after loading the host martial law configuration information to monitor the system data, obtaining real-time monitoring data, receiving the behavior model analysis target information, matching the behavior model analysis target information in a preset algorithm model knowledge base, obtaining the algorithm model corresponding to the behavior model analysis target information, using the algorithm model corresponding to the behavior model analysis target information as a model to be trained, using the real-time monitoring data to train the model to be trained, obtaining a behavior pattern recognition model and a behavior baseline, the behavior pattern recognition model is used to identify programs that cross the line behavior and cannot match the behavior baseline; Step S104, obtaining real-time behavior information in the host system, using the behavior pattern recognition model to recognize the real-time behavior information in the host system, obtaining recognized behavior information, matching the recognized behavior information with the behavior baseline, obtaining a program that crosses the line or cannot match the behavior baseline, and generating warning information for the program that crosses the line or cannot match the behavior baseline; Step S105 , when a program that has crossed the line or cannot match the behavior baseline is generated during the system operation, data corresponding to the program that has crossed the line or cannot match the behavior baseline is isolated.

2. The host martial law method based on UEFI as claimed in claim 1, characterized in that: The step S101 includes: When the host system starts, the UEFI unified extensible firmware interface layer is first loaded and initialized, and when it receives the system startup information, it starts to execute the subsequent steps; After the system startup information is received, the basic data of the host is obtained. The basic data of the host includes system operation data, user behavior data, security event data and system configuration. The system operation data includes CPU usage and memory usage. The user behavior data includes login attempts and file access records. The security event data includes virus detection records and intrusion detection alarms. The system configuration includes network configuration, service configuration and security policy. Apply the acquired system configuration information to the host system, the system configuration information including updating network settings, adjusting service configurations, and strengthening security policies; After the system configuration is applied, the host system will be updated to the configured state, and the configured host system will be set as the real-time running system.

3. The host martial law method based on UEFI as claimed in claim 1, characterized in that: The step S102 includes: continuously acquiring operation data from the configured host system, preprocessing the acquired operation data, extracting features from the preprocessed data, and combining the extracted data features into a feature set; The constructed data features are combined into a feature set and matched with the preset host martial law knowledge base, which includes a database of known security threats, abnormal behavior patterns, and normal behavior baseline information. Through matching, it is determined whether the operating data of the real-time operating system matches the known security threats or abnormal behavior patterns; According to the matching result, the host martial law configuration information corresponding to the real-time running system operation data is extracted from the host martial law knowledge base, and the host martial law configuration information includes security policies, behavior rules and response measures.

4. The host martial law method based on UEFI as claimed in claim 1, characterized in that: The step S103 includes: Use a real-time running system loaded with host martial law configuration information to monitor system data, including system processes, network activities, and file operations; Continuously obtain real-time monitoring data from the system monitoring process, and determine the target information for behavior model analysis based on the host martial law requirements. The target information for model analysis includes specific types of system behaviors and abnormal behavior patterns; Matching the received behavior model analysis target information in a preset algorithm model knowledge base, using the matched algorithm model as a to-be-trained model, and using the to-be-trained model in a subsequent training process to generate a behavior pattern recognition model capable of recognizing a specific behavior pattern; Training the behavior pattern recognition model. The training process includes data input, model calculation, and parameter adjustment. After training, a behavior pattern recognition model is generated. The behavior pattern recognition model identifies cross-line behaviors and programs that cannot match the behavior baseline based on real-time monitoring data. During the training process, a behavior baseline is also constructed. The behavior baseline is the baseline of normal system behavior and is used to determine whether the real-time system behavior deviates from the normal track. The behavior baseline includes the normal range of system performance indicators and the normal pattern of network activities. The generated behavior pattern recognition model and behavior baseline are deployed to the real-time operation system to monitor and identify abnormal behaviors in real time.

5. The host martial law method based on UEFI as claimed in claim 1, characterized in that: The step S104 includes: Capture behavioral information from the host system in real time, including process launches, file operations, network connections, and system calls; Input the acquired real-time behavior information into the constructed behavior pattern recognition model, extract the recognized behavior information, and extract the recognized behavior information from the output of the behavior pattern recognition model, the behavior information including the type of behavior, timestamp, and objects involved in the behavior; Load the constructed behavior baseline from the storage system. The behavior baseline includes the normal behavior pattern of the host system. The normal behavior pattern is the benchmark for judging whether the real-time behavior is abnormal. The identified behavior information is matched with the loaded behavior baseline. The matching process compares the characteristics of the behavior information with the corresponding standards of the behavior baseline to determine whether the behavior deviates from the normal track; Procedures for determining whether there is cross-border behavior or unmatched behavioral baselines; Based on the matching results, determine whether there is any cross-line behavior or program that cannot match the behavior baseline in the identified behavior information; If there is a program that crosses the line or fails to match the behavioral baseline, the corresponding warning information will be generated according to the preset warning rules. The warning information includes the behavior information, the time when the behavior occurred, and the potential risks of the behavior.

6. The host martial law method based on UEFI as claimed in claim 1, characterized in that: The step S105 includes: Monitor the system operation process in real time and use the behavior pattern recognition model to continuously identify the behavior in the host system. When the behavior pattern recognition model identifies the program that crosses the line or fails to match the behavior baseline, the isolation mechanism is triggered; Mark the identified cross-line behaviors or programs that cannot match the behavior baseline, and record the process ID, program name, and trigger time information; According to the marked abnormal program or behavior, the marked abnormal program or behavior includes files, database records and network connection data created, modified or accessed by the program; Perform isolation operations on the data corresponding to the marked abnormal programs or behaviors. Isolation measures include moving the data to an isolated storage area, modifying the access rights of files or databases, restricting the access of abnormal programs or behaviors, and cutting off the network connection of abnormal programs.

7. The host martial law method based on UEFI as claimed in claim 6, characterized in that: The step S105 includes: The isolation operation information is recorded in data, including isolation time, isolation object and isolation measures, and isolation warning information is generated; Notify system administrators of quarantine warning information via system notification, email or SMS; Isolation warning information includes the discovery of programs that cross the line or fail to match the behavioral baseline and the status of data isolation. After the isolation operation is implemented, the system operation status is continuously monitored.

Images