Risk identification method and device, electronic equipment and computer program product

Abstract

The embodiment of the invention discloses a risk identification method and device, electronic equipment and a computer program product. The method is applied to the electronic equipment, and comprises the following steps: collecting one or more pieces of risk data of the electronic equipment in a safe operation environment; in the safe operation environment, analyzing the one or more pieces of risk data to determine a risk identification result corresponding to the electronic equipment, the risk identification result comprising a risk identification level; and executing a risk response operation corresponding to the risk identification result. According to the risk identification method and device, the electronic equipment and the computer program product, the risk condition of the electronic equipment can be accurately identified, the corresponding risk response operation is executed, the possibility of privacy data leakage is reduced, and the use safety of the electronic equipment is improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and specifically to a risk identification method, device, electronic equipment and computer program product. Background Art

[0002] With the rapid development of electronic technology, mobile phones, smart watches and other electronic devices have become an indispensable part of people's daily lives. While providing many conveniences, they also bring many security risks, such as the risks of using electronic devices for transactions and other operations. Therefore, how to accurately identify the risks of electronic devices during use has become a technical problem that needs to be solved urgently. Summary of the invention

[0003] The embodiments of the present application disclose a risk identification method, device, electronic device and computer program product, which can accurately identify the risk situation of electronic devices and perform corresponding risk response operations, reduce the possibility of privacy data leakage, and improve the safety of electronic devices.

[0004] The present application embodiment discloses a risk identification method, which is applied to electronic equipment, and the method includes:

[0005] In a safe operating environment, collecting one or more risk data of the electronic device;

[0006] In the safe operation environment, analyzing the one or more risk data to determine a risk identification result corresponding to the electronic device, the risk identification result including a risk identification level;

[0007] Execute risk response operations corresponding to the risk identification results.

[0008] The embodiment of the present application discloses a risk identification device, which is applied to an electronic device, and the device includes:

[0009] A data collection module, used for collecting one or more risk data of the electronic device in a safe operation environment;

[0010] a risk analysis module, configured to analyze the one or more risk data in the safe operation environment to determine a risk identification result corresponding to the electronic device, wherein the risk identification result includes a risk identification level;

[0011] The response module is used to execute risk response operations corresponding to the risk identification results.

[0012] An embodiment of the present application discloses an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the processor implements the method described above.

[0013] An embodiment of the present application discloses a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method described above is implemented.

[0014] An embodiment of the present application discloses a computer program product, including a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0015] The risk identification method, device, electronic device and computer program product disclosed in the embodiments of the present application collect one or more risk data of the electronic device in a safe operating environment, analyze the one or more risk data in the safe operating environment to determine a risk identification result corresponding to the electronic device, the risk identification result includes a risk identification level, and executes a risk response operation corresponding to the risk identification result. The risk identification result corresponding to the electronic device can be determined based on the one or more risk data collected for the electronic device, and the risk situation of the electronic device can be accurately identified, and corresponding risk response operations can be executed, which can effectively reduce the losses caused to users by risky behaviors. The collection and analysis of risk data are both performed in a safe operating environment, which can further reduce the possibility of privacy data leakage and improve the safety of electronic device use. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1A An application scenario diagram of a risk identification method in an embodiment;

[0018] Figure 1B is a structural diagram of an electronic device in one embodiment;

[0019] Figure 2 is a flow chart of a risk identification method in one embodiment;

[0020] Figure 3 A schematic diagram of risk response operations corresponding to different risk identification results in one embodiment;

[0021] Figure 4 is a flow chart of a risk identification method in another embodiment;

[0022] Figure 5 A flowchart of analyzing risk data to determine risk identification results in one embodiment;

[0023] Figure 6 is a flow chart of a risk identification method in another embodiment;

[0024] Figure 7 is a block diagram of a risk identification device in one embodiment;

[0025] Figure 8 is a block diagram of a risk identification device in one embodiment;

[0026] Fig. 9 FIG. 4 is a structural block diagram of an electronic device in an embodiment. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0028] It should be noted that the terms "including" and "having" and any variations thereof in the embodiments of the present application and the accompanying drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products or devices.

[0029] It is understood that the terms "first", "second", etc. used in this application may be used herein to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish a first element from another element. For example, without departing from the scope of this application, a first risk identification level may be referred to as a second risk identification level, and similarly, a second risk identification level may be referred to as a first risk identification level. Both the first risk identification level and the second risk identification level are risk identification levels, but they are not the same risk identification level. The term "plurality" used in this application refers to two or more.

[0030] Figure 1A FIG. 1 is an application scenario diagram of a risk identification method in an embodiment. Figure 1AAs shown, the risk identification method can be applied to electronic devices 100, which may include but are not limited to mobile phones, wearable devices (such as smart watches, smart glasses, etc.), vehicle-mounted terminals, tablet computers, laptops, PCs (Personal Computers), and other devices.

[0031] A secure operating environment may be provided in the electronic device 100, and risk identification may be performed in the secure operating environment. The secure operating environment may refer to an operating environment isolated from the operating system of the electronic device 100. Optionally, the secure operating environment may be implemented by a running virtual machine. For example, a KVM (Kernel-based Virtual Machine) or a pKVM (protected Kernel-based Virtual Machine) may be started and run in the electronic device 100, and risk identification may be performed in the KVM or the pKVM.

[0032] Furthermore, the virtual machine may run an operating system that is the same as or different from the operating system of the electronic device 100, and based on the operating system running in the virtual machine, risk identification is performed on the operating system sub-device running in the virtual machine. For example, the operating system running on the electronic device may be the Android system, and the operating system running in the virtual machine may be Microdroid (a minimalist version of the Android system), etc., so that the application running in the electronic device can call the API (Application Programming Interface) provided in the Microdroid system of the virtual machine. It should be noted that the operating system running on the electronic device may also be any one of Linux, IOS, Windows, etc., which is not limited here.

[0033] The electronic device 100 may collect one or more risk data of the electronic device 100 in a safe operation environment, and analyze the collected one or more risk data in the safe operation environment to determine a risk identification result corresponding to the electronic device 100. After determining the risk identification result corresponding to the electronic device 100, the electronic device 100 may perform a risk response operation corresponding to the risk identification result, and can accurately and timely identify the risks existing in the electronic device 100 to prevent user information leakage or personal numerical resources (such as money, etc.) from being damaged, thereby ensuring the safety of the use of the electronic device 100.

[0034] For example, Figure 1B FIG. 1 is a diagram showing the architecture of an electronic device in an embodiment. Figure 1BAs shown, the electronic device 100 can run an Android operating system and a virtual machine, and run a Microdroid system in the virtual machine. The electronic device 100 can be installed with one or more applications. Optionally, applications with higher permissions or higher security requirements can be placed in the Microdroid system in the virtual machine to run. For example, payment applications, banking applications, etc. can be placed in the Microdroid system in the virtual machine to run.

[0035] In some embodiments, a program related to the risk identification method provided in the embodiments of the present application can be run in the Microdroid system in the virtual machine to perform risk data collection and risk data analysis and other processing processes in the Microdroid system in the virtual machine. The Microdroid system running in the virtual machine provides a safe and isolated operating environment. While accurately identifying the risk status of the electronic device, it can ensure that privacy data such as risk data will not be leaked, thereby improving the safety of use of the electronic device.

[0036] like Figure 2 As shown, in one embodiment, a risk identification method is provided, which can be applied to the above-mentioned electronic device. The method may include the following steps:

[0037] Step 210: Collect one or more risk data of the electronic device in a safe operating environment.

[0038] The electronic device can create a secure operating environment and identify risks existing in the electronic device in the secure operating environment. Optionally, the risks existing in the electronic device may refer to security risks existing in the electronic device, for example, the risk of leakage of private information stored on the electronic device, the risk of illegal transfer of numerical resources (such as illegal transfers, illegal transactions, etc.) through the electronic device, etc., but not limited to these.

[0039] Among them, the secure operating environment may refer to an operating environment isolated from the operating system of the electronic device. The secure operating environment may have independent and complete hardware system functions, such as independent memory resources, CPU (Central Processing Unit) resources, etc. The operating system of the electronic device cannot directly access the data in the secure operating environment, or the operating system of the electronic device does not have direct access to the data in the secure operating environment.

[0040] Optionally, the secure operating environment may be implemented through a virtual machine such as KVM or pKVM.

[0041] In some embodiments, a data collection service may be run in a secure operating environment. The data collection service may be a service that runs in the background of an electronic device and is used to collect one or more risk data of the electronic device. Running in the background of an electronic device may mean that the electronic device does not display the operation of the data collection service, and the user will not perceive the operating mode of the data collection service.

[0042] Risk data may refer to relevant data used to identify whether an electronic device has risks and / or to determine the degree of risk impact of the risks existing in the electronic device. By collecting one or more risk data of the electronic device and analyzing the one or more risk data, risks of the electronic device can be identified.

[0043] For example, risk data may include application permission data, communication record data, user identity of electronic devices, etc.; among them, application permission data may include the access rights of various applications of electronic devices to various types of stored data, such as photo access rights, address book access rights, etc.; communication record data may refer to communication record data such as call records, text message records, etc. that contain abnormalities, such as suspicious phone records (sales calls, fraudulent calls, harassment calls, etc.), suspicious text messages (such as sales text messages, fraudulent text messages, harassment text messages, etc.); the user identity of electronic devices may refer to the identity of the user of electronic devices, such as whether the user is the user of the electronic device himself (such as the owner of the mobile phone himself), whether the user is trustworthy, etc.

[0044] As an implementation mode, a data collection service running in a safe operation environment can collect one or more risk data of an electronic device according to a preset collection period. For example, one or more risk data of an electronic device can be collected every 2 minutes, or one or more risk data of an electronic device can be collected every 5 minutes, etc., but not limited to this. The collection period can be set according to actual needs, and the specific duration of the collection period is not limited here. Through the data collection service running in a safe operation environment, the risk data of electronic devices can be continuously collected, thereby realizing continuous monitoring of the risks of electronic devices.

[0045] As another implementation, a data collection service running in a secure operating environment can also collect one or more risk data of an electronic device when the electronic device runs a target risk application. Among them, the target risk application may refer to an application with a high probability of risky behavior, such as one or more of payment applications, banking applications, shopping applications, etc., but not limited to this. In the process of using the target risk application, users are prone to risky behaviors, such as transferring money to criminals, conducting transactions with illegal merchants, visiting illegal phishing websites, etc., which may cause damage to the user's privacy information and / or numerical resources. Therefore, when the electronic device runs the target risk application, the data collection service running in a secure operating environment can collect one or more risk data of the electronic device, and analyze the one or more risk data, so as to identify the risks of the electronic device and ensure the safe use of the electronic device.

[0046] Step 220: Analyze the one or more risk data in a safe operation environment to determine a risk identification result corresponding to the electronic device, wherein the risk identification result includes a risk identification level.

[0047] The electronic device can analyze one or more collected risk data in a safe operating environment to determine the risk identification result corresponding to the electronic device.

[0048] Optionally, the risk identification result can be used to indicate whether there is a risk in the electronic device. Further, the risk identification result can be used to indicate the risk impact degree of the risk existing in the electronic device, that is, it can be used to characterize the current risk state of the electronic device.

[0049] Optionally, the risk identification result can be represented by a risk identification level. The higher the risk identification level, the greater the risk impact and the greater the probability of risky behavior. For example, the risk identification level may include a first risk identification level, a second risk identification level, a third risk identification level and a fourth risk identification level. The first risk identification level may be greater than the second risk identification level, the second risk identification level may be greater than the third risk identification level, and the third risk identification level may be greater than the fourth risk identification level. Among them, the first risk identification level may indicate that the electronic device is currently at high risk, indicating that there is a very high possibility that the electronic device is engaging in risky behavior; the second risk identification level may indicate that the electronic device is currently at medium risk, indicating that there is a high possibility that the electronic device is engaging in risky behavior; the third risk identification level may indicate that the electronic device is currently at low risk, indicating that there is a low possibility that the electronic device is engaging in risky behavior; the fourth risk identification level may indicate that the electronic device is currently at no risk, indicating that it is unlikely that the electronic device is engaging in risky behavior.

[0050] In some embodiments, in a safe operating environment, one or more collected risk data may be analyzed by a risk model to determine the risk identification result corresponding to the electronic device. The risk model may be an artificial intelligence model capable of analyzing risk data and providing risk identification results. The model architecture of the risk model may include but is not limited to any one of a decision tree, a random forest, a deep neural network, etc. The risk model may be trained by machine learning. The risk model may be trained based on a training data set. The training data set may include sample risk data and the annotation results corresponding to the sample risk data. The annotation results may be the risk value corresponding to the sample risk data, or the sample risk result corresponding to the sample risk data, etc., which are not limited here. By analyzing one or more collected risk data by a risk model, the risk identification result corresponding to the electronic device can be determined more accurately, and the analysis efficiency of the risk data can be improved.

[0051] In some embodiments, the risk identification results may also include risk types, which may refer to specific risks that exist in electronic devices, such as one or more of device control risks, threat guidance risks, sensitive information leakage risks, and theft risks, among which device control risk refers to the risk that the electronic device is controlled to perform risky operations; threat guidance risk refers to the risk that the user of the electronic device is guided to perform risky operations; sensitive information leakage risk refers to the risk that the electronic device has leaked sensitive information; theft risk refers to the risk that the electronic device is stolen.

[0052] Exemplarily, the risk type can be represented by one or more of numbers, letters, and symbols. For example, device control risk can be represented by the letter A, threat-directed risk can be represented by the letter B, sensitive information leakage risk can be represented by the letter C, theft risk can be represented by the letter D, etc., but not limited to this.

[0053] Step 230: Execute risk response operations corresponding to the risk identification results.

[0054] Different risk identification results may correspond to different risk response operations, which may include outputting prompt information and / or preventing user operations, etc., wherein different risk identification results may correspond to the output of different prompt information, wherein the different prompt information may be different display methods and / or different information content of the prompt information.

[0055] Exemplarily, the risk identification result may include a first risk identification level, a second risk identification level, a third risk identification level, and a fourth risk identification level. Among them, the risk response operation corresponding to the first risk identification level may be to display a red pop-up window and block the current risk behavior, such as blocking the current transfer behavior, transaction behavior, etc. Optionally, when the risk identification result is the first risk identification level, the risk response operation may also include prompting the user to process the current risk items and wait for the risk identification result to drop to a lower risk identification level (such as the second risk identification level, the third risk identification level, etc.) before the risk behavior can be performed; the risk response operation corresponding to the second risk identification level may be to output a prompt message when the user performs a risk behavior (such as a transaction, transfer, etc.) through an electronic device, and the prompt message may be used to prompt the user that there are currently many risk items, and it is recommended to process the risk items before performing the risk behavior; the risk response operation corresponding to the third risk identification level may be to output a prompt message to prompt that the electronic device currently has a certain risk, but it may not affect the risk behavior of the electronic device; the risk response operation corresponding to the fourth risk identification level may not output a prompt message, or output information to inform the user to maintain good usage habits, etc.

[0056] Among them, risk items may refer to risk vulnerabilities that have a greater impact on risk identification results, and may also be understood as risk data items with abnormalities, such as an application having photo access permissions and access is abnormal, an application using a screen recording function in the background, an electronic device setting call forwarding and the forwarding number is an unknown number, etc., but not limited to these.

[0057] For example, Figure 3 FIG. 1 is a schematic diagram of risk response operations corresponding to different risk identification results in one embodiment. Figure 3 As shown, if the risk identification result is the first risk identification level (i.e. high risk), the user can be prevented from continuing the risky behavior, and the risky behavior can only be carried out after the risk identification result is reduced to a lower risk identification level. If the risk identification result is the second risk identification level (i.e. medium risk), the user is warned not to carry out risky behavior and the risk item is processed. If the risk identification result is the third risk identification level (i.e. low risk), the user is prompted to reduce the risk item. If the risk identification result is the fourth risk identification level (i.e. no risk), no response is required.

[0058] Exemplarily, the risk identification results may also include risk types, and different risk response operations may correspond to different risk types. For example, if there is a risk of sensitive information leakage in the electronic device, the permissions of the application may be restricted to prevent the application from illegally accessing sensitive information stored in the electronic device; if there is a risk of theft in the electronic device, the electronic device may send a prompt message to the bound terminal to prompt that the electronic device is at risk of being stolen, etc., or the electronic device may be locked to prevent the electronic device from being stolen, etc., but is not limited to this.

[0059] Optionally, after the safe operation environment obtains the risk identification result, the risk identification result can be fed back to the application layer. After the application layer obtains the risk identification result, the risk application operation corresponding to the risk identification result can be executed. Further, the risk identification result can be represented by a risk identification level, and the risk identification level can be represented by any one of numbers, letters or symbols, for example, the first risk identification level can be represented by the number 4, the second risk identification level can be represented by the number 3, the third risk identification level can be represented by the number 2, and the fourth risk identification level can be represented by the number 1, etc., but not limited to this. The safe operation environment can only feed back the specific risk identification level to the application layer without feeding back the specific risk data, which can realize the desensitized use of risk data and further reduce the possibility of privacy data leakage.

[0060] Different risk response operations can be performed for different risk identification results to apply existing risk situations, so that the risks existing in electronic devices can be handled, the risks of electronic devices can be reduced, the safety of electronic devices can be improved, and the flexibility of response can be higher.

[0061] In an embodiment of the present application, in a safe operating environment, one or more risk data of an electronic device are collected, and in the safe operating environment, the one or more risk data are analyzed to determine a risk identification result corresponding to the electronic device, the risk identification result includes a risk identification level, and a risk response operation corresponding to the risk identification result is performed. The risk identification result corresponding to the electronic device can be determined based on the one or more risk data collected for the electronic device, and the risk situation of the electronic device can be accurately identified, and corresponding risk response operations can be performed, which can effectively reduce the losses caused to users by risky behaviors. The collection and analysis of risk data are both performed in a safe operating environment, which can further reduce the possibility of privacy data leakage and improve the safety of use of electronic devices.

[0062] like Figure 4 As shown, in another embodiment, a risk identification method is provided, which can be applied to the above-mentioned electronic device, and the method may include the following steps:

[0063] Step 402: In a secure operating environment, one or more risk data of the electronic device are collected based on a data dictionary.

[0064] A data dictionary may be pre-built, and the data dictionary may be used to define one or more risk data types and descriptive information of each risk data contained in each risk data type. Among them, the risk data type may refer to the risk category that the risk data may cause, and each risk data type may contain one or more risk data. The descriptive information of the risk data may be used to describe the risk data, such as one or more of the number of the risk data, the name of the risk data, and the explanation of the risk data.

[0065] In some embodiments, the one or more risk data types included in the data dictionary may include one or more of device control risk, threat guidance risk, sensitive information leakage risk, and theft risk.

[0066] Among them, the device control risk may refer to the risk that the electronic device is controlled to perform risky operations, such as criminals using the high-risk permissions of the electronic device to manipulate the electronic device to perform risky behaviors or guide users to perform risky behaviors, resulting in the leakage of users' personal privacy information or loss of data resources, etc. Optionally, the risk data included in the device control risk may include call forwarding data, barrier-free use data, screen recording data, floating window data, and abnormal power consumption data, etc.

[0067] The call forwarding data may include information such as whether the electronic device is set to call forwarding and whether the forwarding number for setting call forwarding is an unfamiliar number.

[0068] Accessibility usage data may include information such as whether the accessibility assistive function of the electronic device is turned on, whether any application is using the accessibility assistive function, and whether any application has used the accessibility assistive function in the past period of time.

[0069] The screen recording data may include information such as whether an application is using any of the screen recording, screen sharing, and screen control functions, whether an application has used any of the screen recording, screen sharing, and screen control functions over the past period of time, and so on.

[0070] The floating window data may include information such as whether an application displays a floating window in the interface, such as a lottery floating window, a welfare floating window, and other floating windows that guide users to jump to corresponding links.

[0071] The abnormal power consumption data may include information such as abnormal increase in power consumption of the electronic device over a period of time.

[0072] Threat guidance risk refers to the risk that the user of the electronic device is guided to perform risky operations, for example, whether the user of the electronic device has a history of being deceived or is targeted by criminals to perform illegal operations, etc. Optionally, the risk data included in the threat guidance risk may include call record data, SMS record data, website access data, etc.

[0073] Call record data may include whether the electronic device has a record of making and / or receiving suspicious calls, which may include fraudulent calls, sales calls, and harassing calls.

[0074] The SMS record data may include whether the electronic device has a record of receiving and / or replying to suspicious SMS messages, which may include fraudulent SMS messages, marketing SMS messages, and harassment SMS messages.

[0075] Website access data may include whether there is a record of the electronic device visiting suspicious websites.

[0076] Sensitive information leakage risk refers to the risk of electronic devices leaking sensitive information, such as illegal applications have been collecting users' personal sensitive information and uploading it in the background. Optionally, the risk data included in the sensitive information leakage risk may include photo access data, communication access data, high-risk permission data, etc.

[0077] The photo access data may include information such as whether an application has photo access rights and an abnormal number of photos read (such as reading a large number of photos in a short period of time).

[0078] The address book access data may include information such as whether an application has the permission to access the address book and the number of contacts read is abnormal (such as reading a large number of contacts in a short period of time), whether an application silently reads the address book in the background, etc.

[0079] High-risk permissions data may include information such as whether there are applications that apply for high-risk permissions and the number of permissions applied for is abnormal (such as applying for too many high-risk permissions). Among them, high-risk permissions may refer to permissions that have a significant impact on the information security of electronic devices, such as SMS reading permissions, address book access permissions, call log reading permissions, system floating window permissions, and access to the system's notification monitoring service.

[0080] The risk of misappropriation refers to the risk of electronic devices being misappropriated, for example, the current user of the electronic device is not the user himself, and the current user of the electronic device is a minor, an elderly person, or a stranger, etc. The risk data included in the risk of misappropriation may include the current user data of the electronic device. The user information may include whether the user is the user of the electronic device himself, the age group of the user if the user is not the user of the electronic device himself, the relationship between the user and the user of the electronic device, etc. Among them, the age group of the user may include minors, the elderly, etc., and the relationship between the user and the user of the electronic device may include relatives, friends, strangers, etc., but is not limited to this.

[0081] Optionally, user usage data of the electronic device can be collected, such as interaction data with the display screen (such as one or more of touch position, touch frequency, touch distance, etc.), applications used, etc., and the user usage data of the electronic device can be analyzed through an artificial intelligence model to identify whether the current user is the user of the electronic device, and if the user is not the user of the electronic device, identify the user's age group and the relationship between the user and the user of the electronic device.

[0082] For example, the data dictionary may be as shown in Table 1:

[0083] Table 1

[0084]

[0085]

[0086] It should be noted that the content shown in Table 1 is only used to illustrate the data dictionary of the embodiment of the present application, and is not used to limit the specific data dictionary. The risk data can be classified and defined through the data dictionary, and the risk data types defined in the data dictionary may include one or more of equipment control risk, threat guidance risk, sensitive information leakage risk and misappropriation risk, etc. The rich types make the collected risk data more comprehensive and improve the accuracy of risk identification.

[0087] In some embodiments, the data dictionary may be constructed by the manufacturer of the electronic device by collecting abnormal data when risks occur in a large number of electronic devices, or it may be constructed by each electronic device based on the collected historical risk data and abnormal data when risks occur. The data dictionaries constructed by different electronic devices may be the same or different, and this is not limited here.

[0088] When it is necessary to identify the risks of electronic devices, one or more risk data can be collected in a safe operation environment based on each risk data type defined in the data dictionary and the description information of each risk data contained in each risk data type, thereby improving the accuracy of data collection and further improving the accuracy of subsequent risk data analysis. Optionally, the one or more risk data collected can be real-time risk data of the electronic device or risk data of a historical time period, which is not limited here.

[0089] Step 404: Analyze the one or more risk data in a safe operation environment to determine a risk identification result corresponding to the electronic device.

[0090] Step 406: Execute risk response operations corresponding to the risk identification results.

[0091] The description of steps 404 to 406 may refer to the relevant description in the above embodiment, and will not be repeated here.

[0092] It should be noted that the constructed data dictionary is not only suitable for risk identification involved in the embodiments of the present application, but also suitable for providing risk data to other applications or services. When other applications or services need risk data, the data acquisition interface can be called in a safe operating environment. After collecting risk data in the safe operating environment, the data can be fed back to the other application or service, thereby ensuring the security of the risk data and the accuracy of collection.

[0093] In an embodiment of the present application, one or more risk data can be collected in a safe operating environment based on each risk data type defined in a data dictionary and the descriptive information of each risk data contained in each risk data type, thereby improving the accuracy of data collection and further improving the accuracy of subsequent risk data analysis.

[0094] like Figure 5 As shown, in one embodiment, the step of analyzing the one or more risk data to determine the risk identification result corresponding to the electronic device may include the following steps:

[0095] Step 502: Analyze the one or more risk data using a risk model to obtain a risk value corresponding to each risk data.

[0096] After collecting one or more risk data of an electronic device in a safe operating environment, the one or more risk data can be analyzed through a risk model to obtain risk values ​​corresponding to each risk data. The risk values ​​corresponding to the risk data can be used to characterize the degree of impact corresponding to the risk data. For example, the larger the risk value, the deeper the risk impact generated by the risk data and the greater the risk.

[0097] In some embodiments, the risk model can be trained based on a training data set, which may include multiple sample risk data, and a labeled risk value corresponding to each sample risk data, etc., and further, may also include information such as the risk data number corresponding to each sample risk data. In the process of training the risk model, the sample risk data can be input into the risk model to be trained, and the input sample risk data is analyzed by the risk model to obtain a predicted risk value, and the loss is calculated based on the predicted risk value and the labeled risk value corresponding to the input sample risk data, and the parameters of the risk model are adjusted according to the loss until the risk model meets the convergence conditions, such as the number of training times is greater than the preset number of times, or the loss is less than the loss threshold, etc., then it is determined that the risk model training is completed.

[0098] For different items of risk data, the method of determining the risk value may be different.

[0099] For example, for call forwarding data, if the electronic device has not set up call forwarding, the risk value may be 0; if the electronic device has set up call forwarding and the forwarding number for call forwarding is not an unfamiliar number, the risk value may be 1; if the electronic device has set up call forwarding and the forwarding number for call forwarding is an unfamiliar number, the risk value may be 2.

[0100] For accessibility usage data, the risk value can be determined based on the usage time of the accessibility assistive function and the number of applications using the assistive function. For example, the longer the usage time and the greater the number of applications using the assistive function, the greater the risk value.

[0101] For screen recording data, the risk value can be determined based on the recording frequency and recording duration in the past period of time. For example, the higher the recording frequency and the longer the recording duration, the greater the risk value. Furthermore, the past period of time can be divided into multiple time windows, such as within 1 hour, 6 hours, 24 hours, etc. The recording frequency and recording duration of each time window can be counted to obtain the risk value of each time window. Then, based on the risk value of each time window and the weight assigned to each time window, the risk value corresponding to the screen recording data can be determined.

[0102] For floating window data, the risk value can be determined based on the display time of the floating window, the type of application that displays the floating window, etc. For example, the longer the display time of the floating window, the application that displays the floating window is a target risk application, etc., the greater the risk value; or, the longer the display time of the floating window, the application that displays the floating window is a recently downloaded application, etc., the greater the risk value.

[0103] For abnormal power consumption data, the risk value can be determined based on the application running data. The application running data includes the length of time the application is used in the background, the frequency of CPU usage, the size of memory occupied, etc. The larger the application running data, the greater the risk value.

[0104] For call record data, the risk value can be determined based on the records of making and / or receiving suspicious calls in the past period of time. For example, the risk value can be determined based on the number of suspicious calls made and / or received in the past period of time. The greater the number of suspicious calls made and / or received in the past period of time, the greater the risk value. Further, the past period of time can be divided into multiple time windows, such as within 1 hour, 6 hours, 24 hours, etc. The records of making and / or receiving suspicious calls in each time window can be counted to obtain the risk value of each time window, and then the risk value corresponding to the call record data is determined based on the risk value of each time window and the weight assigned to each time window. Further, the risk value of making a suspicious call can be greater than the risk value of receiving a suspicious call.

[0105] For SMS record data, the risk value can be determined based on the number of suspicious SMS messages received and / or replied to by the electronic device in the past period of time. For example, the more suspicious SMS messages received and / or replied to by the electronic device, the greater the risk value. Furthermore, the past period of time can be divided into multiple time windows, and the number of suspicious SMS messages received and / or replied to in each time window is counted to obtain the risk value of each time window, and then the risk value corresponding to the SMS record data is determined based on the risk value of each time window and the weight assigned to each time window.

[0106] For website access data, the risk value can be determined based on the number of times the electronic device visited suspicious websites in the past period of time. For example, the more times the electronic device visited suspicious websites, the greater the risk value. Furthermore, the past period of time can be divided into multiple time windows, and the number of visits to suspicious websites in each time window is counted to obtain the risk value of each time window. Then, based on the risk value of each time window and the weight assigned to each time window, the risk value corresponding to the SMS record data is determined.

[0107] For photo access data, the risk value can be determined based on the number of photos read by the application and the number of times the photos were read in the past period of time. For example, the more photos the application reads and the more times the photos are read, the greater the risk value. Furthermore, the past period of time can be divided into multiple time windows, and the number of photos read by the application and the number of times the photos are read in each time window are counted to determine the risk value of each time window. Then, based on the risk value of each time window and the weight assigned to each time window, the risk value corresponding to the photo access data is determined.

[0108] For address book access data, the risk value can be determined based on the number of address books read by the application and the number of reads in the past period of time. For example, the more address books the application reads and the more reads, the greater the risk value. Furthermore, the past period of time can be divided into multiple time windows, and the number of address books read by the application and the number of reads in each time window are counted to determine the risk value of each time window. Then, based on the risk value of each time window and the weight assigned to each time window, the risk value corresponding to the address book access data is determined.

[0109] For high-risk permission data, the risk value may be determined according to the number of high-risk permissions applied for by the application. For example, the more high-risk permissions applied for by the application, the greater the risk value.

[0110] For various risk data included in the risk of theft, the user information can be identified and the risk value can be determined based on the user information. If the user is not the user of the electronic device and is a minor or an elderly person, the risk value is relatively large.

[0111] In some embodiments, before analyzing the risk data through the risk model, each item of risk data may be preprocessed, and optionally, the preprocessing may include one or more of cleaning each item of risk data, normalizing each item of risk data, extracting data features of each item of risk data, etc. Among them, cleaning each item of risk data may refer to removing abnormal data from the risk data, and the abnormal data may refer to erroneous data that affects risk identification; normalizing each item of risk data may refer to converting each item of risk data into the same numerical range for subsequent calculation.

[0112] Since the methods of determining risk values ​​are different for different items of risk data, the extracted data features may be different for different items of risk data. For example, for call forwarding data, the extracted data features may include function activation features (used to indicate whether call forwarding is enabled), call forwarding forwarding number features, etc.; for high-risk permission data, the extracted data features may include features of applications applying for high-risk permissions, features of the number of high-risk permissions applied for by applications, etc., which are not listed one by one here.

[0113] The risk model can analyze the preprocessed risk data to obtain the risk value corresponding to each risk data, which can improve the accuracy of the risk value corresponding to each risk data output, thereby improving the accuracy of the risk identification results.

[0114] In some embodiments, the risk model may be continuously optimized based on the collected risk data, identified risk identification results, user feedback, etc., to improve the accuracy of the risk model.

[0115] Step 504: Determine a risk identification result corresponding to the electronic device according to the risk value corresponding to each risk data.

[0116] After the risk values ​​corresponding to the various risk data are determined through the risk model, the risk identification result corresponding to the electronic device can be determined according to the risk values ​​corresponding to the various risk data.

[0117] As an implementation method, the risk values ​​corresponding to each risk data may be accumulated to obtain the device risk value, and the risk identification result corresponding to the electronic device may be determined based on the device risk value. Optionally, multiple risk thresholds may be pre-set to divide multiple risk value intervals, each of which may have a corresponding risk identification level. For example, three risk thresholds and four risk value intervals may be set, and the four risk value intervals may correspond to the first risk identification level, the second risk identification level, the third risk identification level, and the fourth risk identification level, respectively. The device risk value may be compared with multiple risk thresholds to determine the risk value interval in which the device risk value is located, and the risk identification level corresponding to the risk value interval in which the device risk value is located is determined as the risk identification result corresponding to the electronic device.

[0118] As another implementation, the device risk value can be obtained according to the risk value and the corresponding weight corresponding to each risk data, and the risk identification result corresponding to the electronic device can be determined according to the device risk value. Corresponding weights can be set for each risk data, and the weights corresponding to each risk data can be configured according to the actual business needs. The configuration method can be a default configuration according to a fixed weight, or a dynamically adjusted configuration method, which is not limited here.

[0119] Furthermore, a weighted average calculation may be performed based on the risk values ​​and corresponding weights corresponding to each risk data item to obtain the equipment risk value. For example, the equipment risk value may be calculated using the following formula:

[0120]

[0121] Where n represents the total number of risk data collected, X i represents the risk value corresponding to the i-th risk data, Risk i It represents the weight corresponding to the i-th risk data, and P represents the equipment risk value.

[0122] After determining the device risk value, the device risk value can be compared with multiple risk thresholds to determine the risk value interval in which the device risk value is located, and the risk identification level corresponding to the risk value interval in which the device risk value is located is determined as the risk identification result corresponding to the electronic device.

[0123] In this implementation, a device risk value is obtained based on the risk values ​​and corresponding weights corresponding to each risk data. Based on the device risk value, a risk identification result corresponding to the electronic device is determined, which can improve the accuracy of the determined device risk value, thereby improving the accuracy of the risk identification result.

[0124] In some embodiments, the risk identification result may also include a risk type. After determining the risk value corresponding to each risk data, the type risk value corresponding to each risk data type may be determined based on the risk value of each risk data type contained in each risk data type defined in the data dictionary. For example, the risk values ​​of each risk data type contained in each risk data type may be accumulated, or the risk values ​​of each risk data type contained in each risk data type may be weighted averaged to obtain the type risk value corresponding to each risk data type. The risk data type with the largest type risk value may be determined as the risk type of the electronic device. In this way, the risk type of the electronic device may be accurately identified.

[0125] In an embodiment of the present application, the collected risk data can be analyzed through a risk model to obtain risk values ​​corresponding to each risk data, and the risk identification results corresponding to the electronic device can be determined based on the risk values ​​corresponding to each risk data. This can improve the accuracy of the risk identification results, improve the efficiency of analyzing the risk data, and ensure the timeliness of risk application.

[0126] like Figure 6 As shown, in another embodiment, a risk identification method is provided, which can be applied to the above electronic device, and the method may include the following steps:

[0127] Step 602: In a secure operating environment, collect one or more risk data of the electronic device based on a data dictionary.

[0128] The description of step 602 may refer to the relevant description in the above embodiment, and will not be repeated here.

[0129] Step 604: In the safe operation environment, identify that the electronic device is in a risky behavior scenario, and determine the risk emergency level based on scenario information of the risky behavior scenario.

[0130] The electronic device can identify whether it is currently in a risky behavior scenario in a safe operating environment. The risky behavior scenario may refer to a scenario in which risky behavior is performed. Optionally, the risky behavior scenario may include a numerical resource transfer scenario. The numerical resource transfer scenario may refer to a scenario in which numerical resource transfer is performed. The numerical resources may include funds, virtual currency resources, etc. For example, the numerical resource transfer scenario may include one or more of a payment scenario, a transfer scenario, a recharge scenario, a shopping scenario, a payment code swiping scenario, etc., but is not limited thereto.

[0131] In some embodiments, the current active interface of the target risk application may be obtained in a safe operation environment. If the active interface is a target risk behavior interface, it may be determined that the electronic device is in a risk behavior scenario.

[0132] The electronic device may first determine whether the target risk application is currently running in the safe operation environment. If the target risk application is currently running, the current active interface of the target risk application may be obtained, wherein the current active interface of the target risk application may refer to the interface currently displayed by the target risk application or the interface to be displayed, etc. Optionally, a screenshot operation may be performed on the current active interface of the target risk application in the safe operation environment to obtain an interface image, so as to obtain the current active interface of the target risk application.

[0133] It can be determined whether the current active interface of the target risk application is the target risk behavior interface, where the target risk behavior interface may refer to an interface used to perform risk behaviors, such as one or more of a payment interface, a transfer interface, a chat interface, a product ordering interface, a payment code interface, etc., but not limited to these.

[0134] As an implementation method, the interface image corresponding to the current active interface of the target risk application can be matched with multiple target risk behavior interfaces pre-stored in the database. If the match is successful, the current active interface of the target risk application can be determined as the target risk behavior interface.

[0135] As another implementation method, the interface image can also be identified to determine whether there are sensitive marks corresponding to risky behaviors in the interface image, such as sensitive icons and sensitive texts corresponding to risky behaviors. For example, it can be identified whether the interface image contains sensitive texts such as "transfer" and "recharge". If there are sensitive marks corresponding to risky behaviors in the interface image, it can be determined that the current active interface of the target risk application is the target risk behavior interface.

[0136] If the current active interface of the target risk application is the target risk behavior interface, it means that the user is likely to be engaging in risky behavior, and it can be determined that the electronic device is in a risky behavior scenario. Through the current active interface of the target risk application, it is possible to accurately and conveniently identify whether the electronic device is currently in a risky behavior scenario.

[0137] When it is determined that the electronic device is in a risky behavior scenario, scenario information of the risky behavior scenario may be obtained, and a risk urgency level may be determined based on the scenario information. The risk urgency level may characterize the urgency and / or danger level of the risky behavior.

[0138] Optionally, the risk behavior scenario includes a numerical resource transfer scenario, and the scenario information of the numerical resource transfer scenario may include one or more of the scenario type of the numerical resource transfer scenario, the transferred numerical resource value, the association relationship between the target transfer object and the user of the electronic device, etc.

[0139] Among them, the scenario type of the numerical resource transfer scenario can be used to indicate a specific numerical resource transfer scenario, such as a payment scenario, a transfer scenario, a recharge scenario, a shopping scenario, a payment code swiping scenario, etc. The transferred numerical resource value refers to the specific value of the numerical resource to be transferred, such as the specific amount of the transfer, etc. The target transfer object can refer to the object that receives the numerical resource to be transferred, and the association relationship between the target transfer object and the user of the electronic device can be used to indicate the degree of intimacy between the target transfer object and the user of the electronic device, such as a stranger, a newly added friend, a frequently contacted friend, etc.

[0140] The risk urgency level can be determined based on the scenario information of the risk behavior scenario, and the risk urgency level can be used to determine the risk identification result together with the target risk level obtained after analyzing the risk data. Optionally, the larger the risk urgency level, the more urgent the risk behavior. The risk urgency level can be represented by any number, letter or symbol, for example, the risk urgency level can include a first urgency level, a second urgency level and a third urgency level, wherein the first urgency level can be represented by the number 2, the second urgency level can be represented by the number 1, and the third urgency level can be represented by the number 0, wherein the first urgency level indicates a high degree of urgency, the second urgency level indicates a medium degree of urgency, and the third urgency level indicates a low degree of urgency, etc., but is not limited thereto.

[0141] Step 606: Analyze the one or more risk data in a safe operation environment to obtain a target risk level.

[0142] In some embodiments, in a safe operating environment, the one or more risk data can be analyzed through a risk model to obtain risk values ​​corresponding to each risk data, and the device risk value can be determined based on the risk value corresponding to each risk data, and the target risk level can be determined based on the device risk value.

[0143] It should be noted that the risk model is used to analyze the one or more risk data to obtain the risk values ​​corresponding to each risk data, and the method of determining the equipment risk value based on the risk values ​​corresponding to each risk data can be referred to the relevant description in the above embodiment, and will not be repeated here.

[0144] In some embodiments, multiple risk thresholds may be pre-set to divide multiple risk value intervals, each risk value interval may have a corresponding risk level, for example, 2 risk thresholds and 3 risk value intervals may be set, and the 3 risk value intervals may correspond to the first risk level, the second risk level, and the third risk level, respectively. Optionally, the risk level may be represented by any one of numbers, letters, or symbols, for example, the first risk level may be represented by the number 2, the second risk level may be represented by the number 1, and the third risk level may be represented by the number 0, wherein the first risk level represents high risk, the second risk level represents medium risk, and the third risk level represents low risk.

[0145] The device risk value may be compared with a plurality of risk thresholds to determine the risk value interval in which the device risk value is located, and the risk level corresponding to the risk value interval in which the device risk value is located is determined as the target risk level.

[0146] Step 608: Determine the risk identification result corresponding to the electronic device according to the target risk level and the risk emergency level.

[0147] The target risk level and the risk emergency level may be combined to jointly determine the risk identification result corresponding to the electronic device. Optionally, the target risk level and the risk emergency level may be accumulated, and the accumulated result is used as the risk identification level to obtain the risk identification result corresponding to the electronic device.

[0148] For example, if the determined target risk level is the second risk level (indicated by 1), and the risk emergency level is the first risk level (indicated by 2), then the accumulated risk identification level is 3, indicating the second risk identification level. In this way, the risk identification result corresponding to the electronic device can be determined more accurately, and the calculation method is also relatively simple, which can reduce the computing resources occupied.

[0149] Step 610: Execute risk response operations corresponding to the risk identification results.

[0150] The description of step 610 may refer to the relevant description in the above embodiments, and will not be repeated here.

[0151] In some embodiments, after determining the risk identification result corresponding to the electronic device, one or more risk data collected may be deleted and the risk identification result may be stored. After the electronic device determines the risk identification result in a safe operating environment, it may not save the collected risk data, but only save the risk identification result. Since the risk identification result is represented by any one of numbers, letters and symbols, it will not contain the user's private data (such as location information, application package name, phone number, etc.), which can further reduce the possibility of privacy information leakage.

[0152] In some embodiments, the risk identification results may be encrypted and the encrypted risk identification results may be stored in a database. The encryption method is not limited in the embodiments of the present application. For example, symmetric encryption, asymmetric encryption, SQLCipher and other encryption technologies may be used to encrypt the risk identification results and then store the encrypted risk identification results in a database.

[0153] Optionally, the encrypted risk identification results can be stored in an independent database corresponding to the secure operating environment, which is not shared with the operating system of the electronic device. When any application needs to obtain the risk identification results, it can initiate a request to the operating system of the secure operating environment. The operating system of the secure operating environment can authenticate the application that initiates the request and only feedback the risk identification results after the verification is passed, which can further improve information security and avoid information leakage.

[0154] In an embodiment of the present application, it is possible to identify an electronic device in a risky behavior scenario in a safe operating environment, and determine the risk urgency level based on the scenario information of the risky behavior scenario. The risk urgency level and the target risk level obtained by analyzing the various risk data collected can be combined to determine the risk identification result corresponding to the electronic device, which can further improve the accuracy and timeliness of the determined risk identification result.

[0155] like Figure 7 As shown, in one embodiment, a risk identification device 700 is provided, which can be applied to the above-mentioned electronic device. The risk identification device 700 may include a data collection module 710, a risk analysis module 720 and a response module 730.

[0156] The data collection module 710 is used to collect one or more risk data of the electronic device in a safe operation environment.

[0157] The risk analysis module 720 is used to analyze the one or more risk data in a safe operation environment to determine a risk identification result corresponding to the electronic device, where the risk identification result includes a risk identification level.

[0158] The response module 730 is used to execute risk response operations corresponding to the risk identification results.

[0159] like Figure 8 As shown, in one embodiment, the risk identification device 700 may include a scene identification module 740 in addition to the data collection module 710 , the risk analysis module 720 and the response module 730 .

[0160] The scenario recognition module 740 is used to recognize that the electronic device is in a risky behavior scenario in a safe operation environment, and determine the risk emergency level according to the scenario information of the risky behavior scenario.

[0161] The risk analysis module 720 is further used to analyze the one or more risk data to obtain a target risk level; and determine a risk identification result corresponding to the electronic device according to the target risk level and the risk emergency level.

[0162] In one embodiment, the scene recognition module 740 is further used to obtain the current active interface of the target risk application in the safe operation environment; if the active interface is the target risk behavior interface, it is determined that the electronic device is in a risk behavior scene.

[0163] In one embodiment, the risk behavior scenario includes a numerical resource transfer scenario, and the scenario information includes one or more of a scenario type of the numerical resource transfer scenario, a transferred numerical resource value, and an association relationship between a target transfer object and a user of the electronic device.

[0164] In one embodiment, the risk analysis module 720 is further used to analyze the one or more risk data through a risk model to obtain a risk value corresponding to each risk data; and determine a risk identification result corresponding to the electronic device according to the risk value corresponding to each risk data.

[0165] In one embodiment, the risk analysis module 720 is further used to obtain a device risk value according to the risk value and the corresponding weight corresponding to each risk data; and determine a risk identification result corresponding to the electronic device according to the device risk value.

[0166] In one embodiment, the scene recognition module 740 is also used to collect one or more risk data of the electronic device based on a data dictionary in a safe operating environment; the data dictionary is used to define one or more risk data types and descriptive information of each risk data contained in each risk data type.

[0167] In one embodiment, the one or more risk data types include one or more of device control risk, threat guidance risk, sensitive information leakage risk, and misappropriation risk;

[0168] Among them, device control risk refers to the risk that electronic devices may be controlled to perform risky operations; threat guidance risk refers to the risk that users of electronic devices may be guided to perform risky operations; sensitive information leakage risk refers to the risk that electronic devices may leak sensitive information; and theft risk refers to the risk that electronic devices may be stolen.

[0169] In one embodiment, the risk identification device 700 further includes a storage module.

[0170] The saving module is used to delete the one or more risk data and store the risk identification results.

[0171] The saving module is also used to encrypt the risk identification results and store the encrypted risk identification results in the database.

[0172] In an embodiment of the present application, in a safe operating environment, one or more risk data of an electronic device are collected, and in the safe operating environment, the one or more risk data are analyzed to determine a risk identification result corresponding to the electronic device, the risk identification result includes a risk identification level, and a risk response operation corresponding to the risk identification result is performed. The risk identification result corresponding to the electronic device can be determined based on the one or more risk data collected for the electronic device, and the risk situation of the electronic device can be accurately identified, and corresponding risk response operations can be performed, which can effectively reduce the losses caused to users by risky behaviors. The collection and analysis of risk data are both performed in a safe operating environment, which can further reduce the possibility of privacy data leakage and improve the safety of use of electronic devices.

[0173] Fig. 9 FIG. 1 is a structural block diagram of an electronic device in an embodiment. Fig. 9 As shown, the electronic device 900 may include one or more of the following components: a processor 910, and a memory 920 coupled to the processor 910, wherein the memory 920 may store one or more computer programs, and the one or more computer programs may be configured to implement the methods described in the above embodiments when executed by one or more processors 910.

[0174] The processor 910 may include one or more processing cores. The processor 910 uses various interfaces and lines to connect various parts of the entire electronic device 900, and executes various functions and processes data of the electronic device 900 by running or executing instructions, programs, code sets or instruction sets stored in the memory 920, and calling data stored in the memory 920. Optionally, the processor 910 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 910 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 910, but may be implemented separately through a communication chip.

[0175] The memory 920 may include a random access memory (RAM) or a read-only memory (ROM). The memory 920 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 920 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc. The data storage area may also store data created by the electronic device 900 during use, etc.

[0176] It can be understood that the electronic device 900 may include more or fewer structural elements than those in the above structural block diagram, for example, a radio frequency module, a power module, physical buttons, a WiFi (Wireless Fidelity) module, a speaker, a Bluetooth module, a sensor, etc., and no limitation is made here.

[0177] An embodiment of the present application discloses a computer-readable storage medium storing a computer program, wherein the computer program implements the methods described in the above embodiments when executed by a processor.

[0178] An embodiment of the present application discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program can be executed by a processor to implement the methods described in the above embodiments.

[0179] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a ROM, etc.

[0180] As used herein, any reference to memory, storage, database, or other medium may include nonvolatile and / or volatile memory. Suitable nonvolatile memory may include ROM, programmable ROM (Programmable ROM, PROM), erasable PROM (Erasable PROM, EPROM), electrically erasable PROM (Electrically Erasable PROM, EEPROM), or flash memory. Volatile memory may include random access memory (RAM), which is used as an external cache memory. By way of illustration and not limitation, RAM may be in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), memory bus direct RAM (RDRAM) and direct memory bus dynamic RAM (DRDRAM).

[0181] It should be understood that the "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. Those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required for the present application.

[0182] In the various embodiments of the present application, it should be understood that the size of the serial numbers of the above-mentioned processes does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0183] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0184] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0185] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0186] The above is a detailed introduction to a risk identification method, device, electronic device and computer program product disclosed in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for those of ordinary skill in the art, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A risk identification method, characterized in that: Applied to electronic equipment, the method comprises: In a safe operating environment, collecting one or more risk data of the electronic device; In the safe operation environment, analyzing the one or more risk data to determine a risk identification result corresponding to the electronic device, the risk identification result including a risk identification level; Execute risk response operations corresponding to the risk identification results.

2. The method according to claim 1, characterized in that Before analyzing the one or more risk data to determine a risk identification result corresponding to the electronic device, the method further includes: In the safe operation environment, identifying that the electronic device is in a risky behavior scenario, and determining a risk emergency level according to scenario information of the risky behavior scenario; The analyzing the one or more risk data to determine a risk identification result corresponding to the electronic device includes: Analyze the one or more risk data to obtain a target risk level; A risk identification result corresponding to the electronic device is determined according to the target risk level and the risk urgency level.

3. The method according to claim 2, characterized in that The step of identifying, in the secure operating environment, that the electronic device is in a risky behavior scenario includes: In the secure operating environment, obtaining a current active interface of a target risk application; If the active interface is a target risk behavior interface, it is determined that the electronic device is in a risk behavior scenario.

4. The method according to claim 2, characterized in that: The risk behavior scenario includes a numerical resource transfer scenario, and the scenario information includes one or more of a scenario type of the numerical resource transfer scenario, a transferred numerical resource value, and an association relationship between a target transfer object and a user of the electronic device.

5. The method according to any one of claims 1 to 4, characterized in that: The analyzing the one or more risk data to determine a risk identification result corresponding to the electronic device includes: Analyze the one or more risk data through a risk model to obtain a risk value corresponding to each risk data; According to the risk values ​​corresponding to the various risk data, a risk identification result corresponding to the electronic device is determined.

6. The method according to claim 5, characterized in that The step of determining the risk identification result corresponding to the electronic device according to the risk value corresponding to each item of risk data includes: Obtaining the equipment risk value according to the risk value and the corresponding weight corresponding to each item of risk data; A risk identification result corresponding to the electronic device is determined according to the device risk value.

7. The method according to claim 1, characterized in that The collecting one or more risk data of the electronic device in the safe operation environment includes: In a safe operation environment, one or more risk data of the electronic device are collected based on a data dictionary; the data dictionary is used to define one or more risk data types and descriptive information of each risk data contained in each risk data type.

8. The method according to claim 7, characterized in that The one or more risk data types include one or more of device control risk, threat guidance risk, sensitive information leakage risk, and theft risk; Among them, the device control risk refers to the risk that the electronic device is controlled to perform risky operations; the threat guidance risk refers to the risk that the user of the electronic device is guided to perform risky operations; the sensitive information leakage risk refers to the risk that the electronic device leaks sensitive information; and the theft risk refers to the risk that the electronic device is stolen.

9. The method according to any one of claims 1 to 4, 6 to 8, characterized in that: After analyzing the one or more risk data to determine a risk identification result corresponding to the electronic device, the method further includes: The one or more risk data are deleted, and the risk identification result is stored.

10. The method according to claim 9, characterized in that The storing of the risk identification result includes: The risk identification result is encrypted and stored in a database.

11. A risk identification device, characterized in that: Applied to electronic equipment, the device comprises: A data collection module, used for collecting one or more risk data of the electronic device in a safe operation environment; a risk analysis module, configured to analyze the one or more risk data in the safe operation environment to determine a risk identification result corresponding to the electronic device, wherein the risk identification result includes a risk identification level; The response module is used to execute risk response operations corresponding to the risk identification results.

12. An electronic device, characterized in that: The electronic device comprises a memory, a processor and a transceiver unit. The memory stores a computer program. When the computer program is executed by the processor, the electronic device implements the method according to any one of claims 1 to 10.

13. A computer program product, characterized in that The method comprises a computer program, and when the computer program is executed by a processor in an electronic device, the electronic device implements the method according to any one of claims 1 to 10.

Images