Security deduction method and device based on trusted computing

Abstract

The invention relates to a secure deduction method and device based on trusted computing, and the method comprises the steps: collecting target data in a real environment through a trusted terminal in a deduction model which is obtained through training based on real historical data, the target data is subjected to credibility verification all the time according to credibility parameters and credibility states in the data circulation process; performing feature matching on the target data and a preset target feature library, and predicting a threat event in the target data; and determining a defense strategy corresponding to the threat event according to a preset defense scheme, and executing the defense strategy. On the basis that the deduction model has authenticity and security, active defense of threat events is realized.

Description

Technical Field

[0001] The present application relates to the field of trusted technology, and in particular to a secure deduction method and device based on trusted computing. Background Art

[0002] Security simulation is a type of exercise that simulates actual combat. It aims to test and improve the information system owners' coping capabilities and emergency response mechanisms when facing security threats by simulating security incidents. By simulating actual combat scenarios, participants can learn and master coping strategies in actual operations, thereby improving their ability to actually respond to security incidents.

[0003] For example, information system owners usually use network security simulations to promptly discover security issues and weak links in the target network, comprehensively evaluate the overall security protection level of the network, test the emergency response capabilities of operation and maintenance managers, and the effectiveness of security protection measures. Through network security simulations, information system owners can also test and optimize their network security plans to ensure that they can respond quickly and effectively when real security incidents occur, reducing the impact of security incidents on systems and data. Network security simulations help to discover and prevent potential security risks in advance, effectively reduce the possibility of power systems being attacked, enhance security precautions, and ensure the safe and stable operation of power systems.

[0004] At present, there are three main ways to conduct security simulations: one is to conduct security simulations directly in a real environment; the second is to conduct security simulations by using simulation technology to build an experimental environment that is similar to the real environment; the third is to conduct desktop security simulations using a variety of information collected in the early stage. Common problems with these three methods are:

[0005] 1. Using a real environment for security simulations can easily affect business continuity, etc. Once a business is attacked and cannot run, serious consequences will occur.

[0006] 2. There is no suitable deduction method for some important application systems and destructive attack methods. Generally, deduction is not carried out in a real environment, and the experimental environment cannot be highly consistent with the real environment. There are certain differences between the two, and there is no data linkage between the real environment, so it is impossible to synchronize the environment with the real environment, and it is impossible to directly update the security protection strategy verified by security deduction to the real environment in a timely manner.

[0007] 3. Desktop security simulation mainly relies on scenario setting and on-site expert assessment, and does not conduct real attacks and defenses. Its authenticity and usability need to be further strengthened.

[0008] As a result, current security exercises fail to reconcile authenticity, business stability, and defense effectiveness. Summary of the invention

[0009] The present application provides a secure deduction method and device based on trusted computing to solve the problem that secure deduction cannot solve various drawbacks.

[0010] In a first aspect, the present application provides a secure deduction method based on trusted computing, the method comprising:

[0011] Collect target data in the real environment through the trusted terminal in the deduction model, wherein the deduction model is trained based on real historical data, and the target data is always verified based on the trusted parameters and trusted status during the data flow process;

[0012] Predicting threat events in the target data by matching the target data with a preset target feature library;

[0013] Determine the defense strategy corresponding to the threat event according to the preset defense plan, and execute the defense strategy.

[0014] Optionally, the target feature library includes an operation instruction set, an instruction feature set, and a threat feature set, and by performing feature matching between the target data and a preset target feature library, the threat events in the target data are predicted to include:

[0015] Performing feature matching on the target data with the operation instruction set and the instruction feature set, wherein the operation instruction set includes a plurality of compliance operation instructions, and the instruction feature set includes compliance messages and compliance rules;

[0016] If the match fails, the target data is compared with a threat feature set, wherein the threat feature set includes abnormal messages, abnormal rules, and abnormal features;

[0017] If the target data matches the threat feature set, determining that the target data is a known threat;

[0018] If the target data does not conform to the threat feature set, the target data is determined to be an unknown threat.

[0019] Optionally, the threat event is an unknown threat, and determining a defense strategy corresponding to the threat event according to a preset defense solution includes:

[0020] Determining a threat behavior category by analyzing the behavior of the unknown threat;

[0021] Determine the defense strategy corresponding to the threat behavior category according to the pre-built association relationship;

[0022] New threats and changes in attack patterns are collected in real time through intelligence sharing, and intelligent learning algorithms are used to adaptively adjust existing defense strategies based on dynamic measurements of trusted computing.

[0023] Optionally, after determining that the threat event is an unknown threat, the method further includes:

[0024] The learned characteristic parameters of unknown threats are incorporated into the learning library through an intelligent learning algorithm, so that the learning library updates the target characteristic library according to the learned and adapted new security threats.

[0025] Optionally, the method further comprises:

[0026] An intelligent learning algorithm is used to learn the similarities between different attack patterns, and the metric parameters of the deduction model are adaptively adjusted to transfer the experience accumulated according to a specific type of attack pattern to other types of attack patterns.

[0027] Optionally, the training process of the deduction model includes:

[0028] Extracting sample data containing specific features from real historical data based on the trusted terminal, and building an initial feature library based on the sample data, wherein the sample data is trusted and verified according to trusted parameters and trusted status during data flow;

[0029] The sample data is divided into normal events and threat events by using the initial verification rules in the initial feature library, and the initial feature library is enriched by the latest threats learned and adapted by the learning library;

[0030] Generate an initial defense strategy based on the threat events obtained from the initial feature library, and use an intelligent learning algorithm to improve the initial defense strategy;

[0031] Among them, the metric function of the deduction model is used to determine whether the sample data of each link is credibly verified, whether the generated defense strategy can prevent threat events, and whether the learning library can identify and adapt to new threat patterns.

[0032] In a second aspect, the present application provides a secure deduction model system based on trusted computing, the system comprising a collection module, a deduction module and a management control module;

[0033] The acquisition module is used to collect target data in a real environment through a trusted terminal in the deduction model, wherein the deduction model is trained based on real historical data, and the target data is always verified based on trusted parameters and trusted states during the data flow process;

[0034] The deduction module is used to predict threat events in the target data by performing feature matching between the target data and a preset target feature library;

[0035] The management control module is used to determine the defense strategy corresponding to the threat event according to a preset defense plan, and execute the defense strategy.

[0036] In a third aspect, the present application provides a secure deduction device based on trusted computing, the device comprising:

[0037] A collection module is used to collect target data in a real environment through a trusted terminal in the deduction model, wherein the deduction model is trained based on real historical data, and the target data is always verified based on trusted parameters and trusted states during the data flow process;

[0038] A prediction module, used to predict threat events in the target data by matching the target data with a preset target feature library;

[0039] The execution module is used to determine the defense strategy corresponding to the threat event according to a preset defense plan and execute the defense strategy.

[0040] In a fourth aspect, the present application provides an electronic device comprising: at least one communication interface; at least one bus connected to the at least one communication interface; at least one processor connected to the at least one bus; and at least one memory connected to the at least one bus.

[0041] In a fourth aspect, the present application also provides a computer storage medium storing computer executable instructions, wherein the computer executable instructions are used to execute the secure deduction method based on trusted computing as described in any one of the above items of the present application.

[0042] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: the deduction model deduces the target data in the real environment. Since the deduction model is trained based on real historical data, the deduction process will not affect the real business, and the high consistency between the test environment and the real environment can be guaranteed. Then, during the data flow, the data is always verified based on the trusted parameters and trusted status, so that the data is trusted throughout the process and the overall security of the model is improved. Finally, the threat event is predicted through feature matching, and the defense strategy corresponding to the threat event is determined and executed to ensure that the deduction model can actively defend against the threat event. The present application realizes active defense against threat events on the basis of the authenticity and security of the deduction model. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0045] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0046] Figure 1 A flow chart of a method for security deduction based on trusted computing provided in an embodiment of the present application;

[0047] Figure 2 A schematic diagram of a security deduction model system based on trusted computing provided in an embodiment of the present application;

[0048] Figure 3 A schematic diagram of the framework of the adaptive deduction measurement technology provided in the embodiment of the present application;

[0049] Figure 4 A flow chart from data collection to feature extraction provided in the embodiment of the present application;

[0050] Figure 5 A flowchart of detecting threat events provided by an embodiment of the present application;

[0051] Figure 6 A flowchart of determining and executing a defense strategy provided in an embodiment of the present application;

[0052] Figure 7 A schematic diagram of the structure of a secure deduction device based on trusted computing provided in an embodiment of the present application;

[0053] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0055] The disclosure below provides many different embodiments or examples to realize the different structures of the present application. In order to simplify the disclosure of the present application, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present application. In addition, the present application can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0056] In order to solve the problems mentioned in the background technology, according to one aspect of the embodiments of the present application, a secure deduction method based on trusted computing is provided, which is applied to a deduction model, such as Figure 1 As shown, the specific steps are as follows:

[0057] Step 101: Collect target data in a real environment through a trusted terminal in the deduction model, wherein the deduction model is trained based on real historical data, and the target data is always verified based on trusted parameters and trusted states during the data flow process;

[0058] Step 102: Predicting threat events in the target data by matching the target data with a preset target feature library;

[0059] Step 103: Determine a defense strategy corresponding to the threat event according to a preset defense plan, and execute the defense strategy.

[0060] The deduction model in the embodiment of the present application performs security deduction based on trusted computing and is applicable to multiple application scenarios, including but not limited to network security, equipment operation security, financial transaction security, cloud computing security, intelligent transportation safety, etc.

[0061] The deduction model is a comprehensive system that combines hardware and software algorithms. The hardware part is a trusted terminal for collecting data, and the software part is an algorithm for adaptive deduction and management of defense strategies. The model aims to establish a trust chain at the hardware and software levels to ensure the full trustworthiness of the entire process from terminal equipment, data collection, model structure to algorithm, thereby improving the security and reliability of the model.

[0062] Each trusted terminal contains a trusted module, which specifically includes the OS (Operating System) layer: trusted components, the boot layer: trusted boot, the firmware: trusted BIOS (Basic Input / Output System) and the hardware: trusted root TPCM (Trusted Platform Control Module). The trusted root uses domestic cryptographic algorithms SM2, SM3, and SM4. It is a management system that provides cryptographic services and keys. It has cryptographic services that support trusted computing identity authentication, state measurement, and confidentiality storage. It can ensure the security and reliability of the terminal's system hardware and software, startup, and operation. The trusted root is the origin of the trust chain and can ensure the security of the hardware and the model.

[0063] This application collects target data through the standardized interface of the trusted terminal. The collected target data includes a trusted state. In the subsequent circulation of the data, the trusted parameters and trusted state are used as important parameters of the target data in the model algorithm, so that the data at each stage is encrypted and verified based on the trusted root to ensure the integrity of the data and prevent tampering. This application is based on the trusted module, and is based on trust from various aspects such as terminal equipment, data, model structure, and algorithm. By establishing a trust chain at the hardware and software levels, full trust is achieved, that is, trusted collection, trusted feature library, trusted identification, trusted strategy, and trusted model are guaranteed through trusted computing, thereby improving overall security.

[0064] Among them, trusted parameters refer to a set of special parameters introduced in the model algorithm, which are used to ensure the security and credibility of the data processing process. Trusted parameters usually include but are not limited to: encryption keys, signature verification, and access control lists. Trusted state refers to a secure state of data during its operation. This state is guaranteed to be trustworthy through a series of mechanisms. Trusted states are divided into trusted and untrustworthy.

[0065] After the deduction model performs preprocessing operations such as cleaning and normalization on the collected data, it obtains the target data, and then compares the target data with the preset target feature library, which contains the feature patterns of known threats and security events. Based on the results of feature matching, the deduction model can identify abnormal behaviors in the data and classify them as potential threat events. The deduction model automatically selects the most suitable defense strategy for the current threat event.

[0066] For example, in the power monitoring system, there are a large number of power monitoring devices, and it is impossible to intuitively and clearly grasp the network security status of the assets. Therefore, the trusted devices in the deduction model collect network traffic logs and user behavior records, and then compare them based on the target feature library to predict threat events such as malicious code attacks and data leaks, and automatically execute defense strategies such as blocking abnormal behaviors and blocking suspicious IPs.

[0067] In this application, the deduction model deduces the target data in the real environment. Since the deduction model is trained based on real historical data, the deduction process will not affect the real business, and the test environment and the real environment can be highly consistent. Then, during the data flow, the data is always verified based on the trusted parameters and trusted status to achieve full data trust and improve the overall security of the model. Finally, the threat event is predicted through feature matching, and the defense strategy corresponding to the threat event is determined and executed to ensure that the deduction model can actively defend against threat events. This application realizes active defense against threat events on the basis of the authenticity and security of the deduction model.

[0068] As an optional implementation, in step 102, predicting threat events in the target data by matching the target data with a preset target feature library includes the following steps:

[0069] Step S11: feature matching the target data with the operation instruction set and the instruction feature set, wherein the operation instruction set includes a plurality of compliant operation instructions, and the instruction feature set includes compliant messages and compliant rules;

[0070] Step S12: If the match fails, the target data is compared with the threat feature set, wherein the threat feature set includes abnormal messages, abnormal rules and abnormal features;

[0071] Step S13: If the target data meets the threat feature set, the target data is determined to be a known threat;

[0072] Step S14: If the target data does not conform to the threat feature set, the target data is determined to be an unknown threat.

[0073] The target feature library includes an operation instruction set, an instruction feature set, and a threat feature set. The functions of each set are as follows.

[0074] Operation instruction set: contains a variety of compliant operation instructions, which cover the standard commands that are allowed to be executed in the system and related permission control information. For example, file reading, writing, and deleting; process starting and stopping; network connection establishment and disconnection and other legal operations.

[0075] Instruction feature set: includes multiple compliance messages and multiple compliance rules. Compliance messages refer to data packets that conform to the standard protocol format; compliance rules involve user rights management operations, such as granting and revoking access rights for specific users; configuration change instructions, such as adjusting firewall rules, etc.

[0076] Threat signature set: contains abnormal messages, abnormal rules, and abnormal features, which are used to identify known attack patterns and potential threats. Abnormal messages refer to data packets that exhibit abnormal features, such as abnormal connection requests, abnormal data transmission rates, etc.; abnormal rules refer to unauthorized attempts to escalate privileges, abnormal process creation behaviors, etc. Abnormal features refer to behavioral features extracted from major security incidents that have occurred in the past, which serve as a reference for future detection.

[0077] The deduction model compares the collected target data with the operation instruction set and instruction feature set to confirm whether the data is within the allowed operation range. If the match is successful, it is considered a normal operation and no further processing is required.

[0078] If the target data fails to match the operation instruction set or instruction feature set, it is determined that a threat event has occurred, and then the target data is compared with the threat feature set. The idea of ​​black and white is used here. The model will check whether the target data conforms to the abnormal message, abnormal rule or abnormal feature in the threat feature set. The behavior that conforms to the threat feature library is a known threat, and the behavior that is not in the threat feature library is an unknown threat, thereby achieving the effect of accurately identifying security threats. Specifically, in the process of comparing threat events, the known threat matching module can accurately identify known threats by polling the abnormal message library and the abnormal rule library, and the operation matching module can accurately identify erroneous operations by polling the abnormal message library and the abnormal rule library. The remaining behaviors that are not in the threat feature library are unknown threats.

[0079] Compared with the situation that the traditional security defense system is difficult to discover unknown threats, this application has fully and deeply identified and filtered the threat events, and can accurately discover the unknown threats in the system. For the unknown threats discovered, they are usually divided into two situations. One unknown threat is the features and rules that are not mastered. The unknown threat is a threat that already exists but has not been entered into the target feature library; the other unknown threat is a "0-day" vulnerability that has not been discovered in the system. The vulnerability refers to a new attack method that is discovered for the first time and has no solution yet. For the first type of unknown threat, it can be divided into normal features and normal rules that are not mastered and abnormal features and abnormal rules that are not mastered through the research of technical personnel. The normal features and normal rules that are not mastered can be timely stored in the library and converted into normal features and normal rules after review. The abnormal features and abnormal rules that are not mastered can be timely stored in the library and converted into known threats after review. "0-day" vulnerabilities are for security personnel to research solutions.

[0080] As an optional implementation, in step 103, different defense strategies need to be formulated for unknown threats and known threats respectively, and then determining the defense strategy corresponding to the threat event includes the following two methods.

[0081] 1. The threat event is a known threat. Determining the defense strategy corresponding to the threat event based on the preset defense plan includes: using preset thresholds and rules to determine the category of the known threat, and the model automatically executes the defense strategy corresponding to the category, so that the defense mechanism can issue an early warning before the attack occurs.

[0082] 2. The threat event is an unknown threat. Determining the defense strategy corresponding to the threat event based on the preset defense plan includes: determining the threat behavior category by analyzing the behavior of the unknown threat; determining the defense strategy corresponding to the threat behavior category according to the pre-built association relationship; collecting new threats and changes in attack patterns in real time through intelligence sharing, and using intelligent learning algorithms to adaptively adjust existing defense strategies based on the dynamic measurement of trusted computing.

[0083] The deduction model analyzes the behavior of unknown threats and determines the threat behavior categories, such as implanting malicious hardware components, denial of service attacks, cross-site scripting attacks or phishing attacks, etc. Each threat behavior category is also pre-set with a corresponding defense strategy. The system automatically issues strategies based on the preset defense strategies for unknown threats to quickly and effectively respond to network attacks. Pre-set defense strategies include: automatically blocking abnormal behaviors, isolating terminals with abnormal trusted status, blocking suspicious IPs, isolating infected systems, limiting abnormal traffic, updating rules, and notifying administrators through emails, text messages, etc.

[0084] In order to quickly understand new unknown threats, the deduction model also integrates multiple intelligence sources, and regularly captures the latest intelligence data from these intelligence sources through API interfaces or automated scripts, including the latest vulnerability reports, malware samples, attack method descriptions, etc., to help the system quickly understand the current new threats and changes in attack patterns. The system uses intelligent learning algorithms to analyze newly collected intelligence, extract new threat features, and add them to the existing target feature library. These new features are formally included in the feature library after full verification, and become an important basis for future threat detection. Based on the latest intelligence and data analysis results, the system automatically adjusts the existing defense strategy to ensure that it is always in the best condition. The dynamic measurement function allows the system to monitor changes in itself and the network environment in real time, and dynamically adjust internal parameters (such as weights, thresholds, etc.) to adapt to the ever-changing threat environment.

[0085] By collecting new threat intelligence in real time, the system can detect and respond to emerging security threats in the shortest time, minimize security risks, and protect the security and stability of the network environment. At the same time, the application of intelligent learning algorithms enables the system to quickly adapt to new attack patterns and dynamically adjust defense strategies to ensure that it always maintains efficient protection capabilities in a complex and changing network environment.

[0086] Traditional models are usually static, but this application can adaptively adjust defense strategies according to changes in network environment and attack patterns, and can use the dynamic measurement function of trusted computing to dynamically defend against various attacks, detect threats in a timely manner and block them in a timely manner, thereby achieving adaptive delivery of corresponding security strategies while ensuring security and trustworthiness.

[0087] As an optional implementation method, in addition to using intelligent learning algorithms when determining defense strategies, this application also expands the feature library through intelligent learning algorithms, which specifically includes the following contents: When the system determines that a threat event is an unknown threat, the system first conducts an in-depth analysis of the unknown threat and extracts its key feature parameters, such as abnormal behavior patterns, specific data packet structures, etc. The verified unknown threat feature parameters are formally included in the learning library as part of the new knowledge. Among them, the learning library is a dynamically updated knowledge base that contains the features of all known threats and new threat features accumulated through intelligent learning algorithms. Based on the new knowledge in the learning library, the system will regularly update the target feature library to ensure that it always contains the latest threat features.

[0088] By timely incorporating the characteristic parameters of unknown threats into the learning library, the system can identify and respond to new threats in the shortest time and reduce potential security risks. The learning library dynamically updates the target characteristic library based on the new security threats learned and adapted, so that the system can continuously adapt and improve its ability to respond to future unknown threats.

[0089] In addition, the intelligent learning algorithm can identify the similarities and differences between different attack patterns by learning from a large amount of historical data. These similarities may be reflected in behavioral patterns, data flow characteristics, time series, etc., helping the system understand the commonalities and differences between different types of attacks. Based on the learned similarities, the system automatically adjusts internal measurement parameters (such as weights, thresholds, etc.) to minimize prediction errors and improve classification accuracy. The adaptive adjustment mechanism enables the system to respond quickly to new or unknown attack patterns without retraining the entire model, reducing the cost and time of repeated learning. The system can apply the experience accumulated for a specific type of attack pattern to other types of attack patterns, realize the reuse of cross-domain knowledge, and improve the generalization ability of the model, so that the system can flexibly respond to various types of attack patterns, especially when facing new or unknown threats. It shows stronger adaptability. For example, the experience accumulated in detecting one type of malware can help improve the detection ability of other types of malware.

[0090] The adaptive deduction algorithm also includes a feedback learning mechanism, which learns from each attack event and continuously optimizes and improves the defense strategy. This mechanism enables the algorithm to adapt to new attacks, optimize its own defense strategy, and improve its defense capabilities against future threats. Through the combination of trusted computing and machine learning, the system can learn from each attack, update the feature library in a timely manner, and ensure the credibility of feature updates. By continuously optimizing detection and response strategies, timely adjusting or forming new strategies, and executing and issuing new strategies, we can respond to ever-changing network threats.

[0091] In this application, the deduction model combines trusted computing technology with adaptive defense strategies to build a security system that can both proactively defend and adaptively respond to changing threat events. The model achieves full trust by establishing a trust chain at the hardware and software levels. Data at each stage needs to be encrypted and verified based on a trusted root to prevent tampering and ensure data integrity, thereby ensuring model security and data security.

[0092] As an optional implementation, the training process of the deduction model includes the following process:

[0093] Step S21: extracting sample data containing specific features from real historical data based on a trusted terminal, and building an initial feature library based on the sample data, wherein the sample data is trusted and verified based on trusted parameters and trusted status during data flow;

[0094] Step S22: using the initial verification rules in the initial feature library to divide the sample data into normal events and threat events, and enriching the initial feature library with the latest threats learned and adapted by the learning library;

[0095] Step S23: Generate an initial defense strategy based on the threat events obtained from the initial feature library, and use an intelligent learning algorithm to improve the initial defense strategy.

[0096] Among them, the measurement function of the deduction model is used to determine whether the sample data of each link can be credibly verified, whether the generated defense strategy can prevent threat events, and whether the learning library can recognize and adapt to new threat patterns.

[0097] 1. Trusted terminal collection: Trusted terminals collect a large amount of real historical data through standardized interfaces. These data cover network traffic logs, user behavior records, system status information, etc. Each terminal contains a trusted module to ensure that the collected data is encrypted and verified according to trusted parameters and trusted status during transmission, ensuring the integrity and security of the data.

[0098] 2. Sample data extraction: Through pre-processing operations such as cleaning and normalization of the collected real historical data, noise and redundant information are removed, and key data points that are helpful for analysis are retained. Specific features are extracted to form a preliminary sample data set.

[0099] 3. Build an initial feature library: Use the extracted sample data to build an initial feature library as the basis for subsequent threat detection. According to the initial verification rules in the initial feature library, classify the sample data into normal events and threat events. Normal events refer to behaviors that comply with compliance operation instructions and compliance rules; threat events refer to behaviors that show abnormal characteristics or potential threats.

[0100] 4. Learning library update: Conduct in-depth analysis of data marked as unknown threats, extract new threat features from them using intelligent learning algorithms, and incorporate them into the learning library. The learning library is a dynamically updated knowledge base that contains the features of all known threats and new threat features accumulated through intelligent learning algorithms. New threat features are formally incorporated into the initial feature library after being fully verified, so that it is continuously enriched and improved.

[0101] 5. Generate initial defense strategy: Based on the threat events identified in the initial feature library, the system automatically generates an initial defense strategy covering common attack modes and their response measures.

[0102] 6. Intelligent learning improvement: The generated initial defense strategy is adjusted using an intelligent learning algorithm. The adaptive adjustment mechanism enables the system to respond quickly to new or unknown attack patterns without retraining the entire model.

[0103] The measurement function of the deduction model has the following functions: ensuring strict and credible verification at every link of data flow to prevent unauthorized tampered or forged data from entering the system; evaluating the effectiveness of the generated defense strategy to ensure that it can successfully prevent the occurrence and development of threat events; monitoring the performance of the learning library to ensure that it can identify and adapt to new threat patterns in a timely manner and maintain the system's cutting-edge protection capabilities.

[0104] This application provides a secure deduction model system based on trusted computing, such as Figure 2 As shown, the system includes a collection module, a deduction module and a management and control module.

[0105] The acquisition module (trusted terminal or trusted system) is used to collect data based on the trusted module. Each terminal or system is marked as trusted, which means that the data has been trusted and verified during the transmission process to ensure the authenticity and integrity of the data.

[0106] The deduction module uses the information in the feature library to perform real-time threat detection on the collected data, and continuously updates and optimizes the feature library through intelligent learning algorithms to adapt to new threat patterns. The entire threat detection process also emphasizes credibility to ensure the accuracy and reliability of the detection results.

[0107] The management and control module generates corresponding defense strategies according to the threat situation, and continuously optimizes the defense strategies through intelligent learning algorithms to improve the system's adaptability.

[0108] The deduction model closely combines software algorithms, trusted computing technology, and trusted hardware, and can continuously adapt to risks, conduct real-time dynamic analysis of security threats, and continuously optimize its own security defense mechanism. At the same time, the system architecture ensures the credibility of data, the accuracy of threat detection, and the effectiveness of defense strategies through multi-level intelligence collection, intelligent learning, and dynamic adjustment mechanisms. It not only improves the overall security of the system, but also enhances the ability to respond to new and unknown threats through continuous self-learning and optimization, providing users with more reliable security protection.

[0109] The deduction model has multiple deduction algorithms built in, and the model can adapt to different deduction algorithms according to different data characteristics. Figure 3 As shown in the figure, the theoretical framework of adaptive deduction measurement technology mainly includes: data collection, threat detection, policy execution, intelligent learning and other links, which effectively improves the effect and accuracy of network security protection. Each deduction algorithm has different functions and application scenarios. They work together to improve the overall security protection capabilities and the ability to cope with complex and changing network environments. The following are the main functions of these algorithms.

[0110] Threat identification algorithms: These are used to specifically detect and classify various security threats in the network. For example, when the system detects a piece of malware that has never been seen before, the threat identification algorithm will mark it as an unknown threat and trigger further in-depth analysis.

[0111] Adaptive algorithm: It is responsible for dynamically adjusting the behavior mode and parameter configuration of the model according to the current system operation status and changes in the external environment. For example, if the system observes a sudden increase in the frequency of certain types of attacks, the adaptive algorithm may strengthen the monitoring of such attacks and adjust the relevant defense strategies.

[0112] Optimization algorithm: used to improve the overall efficiency and accuracy of the model and reduce the false positive rate and false negative rate. By optimizing the model structure, parameter settings, and the selection of metric functions, the model can maintain efficient and stable output quality while processing massive data.

[0113] Trusted control detection and deduction algorithm: used to ensure the security and reliability of the entire network security deduction process, and prevent unauthorized operations or data tampering. Using trusted computing technology, a trust chain is established at the hardware and software levels to ensure that every link from data collection to final result output is strictly verified and protected.

[0114] This application can improve the generalization ability of the deduction model by introducing multiple deduction algorithms and adaptively adjusting metric functions and model parameters, so that the deduction model can adapt more quickly and provide predictions when facing new threats.

[0115] In this application, the inference model includes a data acquisition layer, a data preprocessing layer, a feature extraction layer, a detection layer and a decision layer. Each data layer is described in detail below.

[0116] Data collection layer: The deduction model can collect data intelligently. The collected data is encrypted based on the trusted root of the trusted terminal and then reported. Trusted verification is required during the data flow process.

[0117] Data preprocessing layer: remove noise and redundant information by performing preprocessing operations such as cleaning and normalization on the collected data.

[0118] Feature extraction layer: Extract useful feature parameters from massive and complex data based on preset extraction rules. Figure 4 It is a flow chart from data collection to feature extraction.

[0119] Detection layer: The feature library adopts a mechanism that combines whitelist and blacklist mechanisms. The collected data is compared with the operation instruction set and instruction feature set to screen out threat events. The threat events are compared with the threat feature set. Behaviors that match the threat feature library are known threats, and behaviors that are not in the threat feature library are unknown threats. Figure 5 It is a flow chart of detecting threat events.

[0120] Decision-making layer: For known threats, corresponding defense strategies can be formulated based on algorithms, and the system automatically executes strategies to respond to network attacks quickly and effectively. For unknown threats, pre-processed security policies are automatically issued based on preset security policies for unknown threats. After that, new threats can be quickly understood based on intelligence sharing, real-time collection and other means, so as to quickly adjust defense strategies. Figure 6 is a flow chart for determining and executing a defense strategy.

[0121] In this application, the deduction model can analyze and judge risks in real time, predict and warn; the deduction model can ensure the security of the deduction environment, the model, and the deduction data based on trusted computing technology; the deduction model can dynamically adjust the deduction model according to the actual operation of the system to improve the accuracy of prediction; the deduction model has a strong learning ability, can mine potential security threats from the data, and provide an effective security protection strategy for the system; the deduction model is real-time, can quickly respond to security incidents, and reduce security risks. The deduction model has multiple built-in deduction algorithms, and can adapt to different deduction algorithms according to different data characteristics.

[0122] For example, in a network security system, the deduction model uses advanced intelligent analysis and prediction capabilities to efficiently process massive and complex security data, and uses advanced technologies such as deep learning and natural language processing for in-depth mining and analysis. Through deep integration of trusted computing capabilities, it can grasp the security status of assets within the network in real time, achieve trusted monitoring and evaluation of the status of assets within the network, analyze the network security risks currently faced by assets, and predict potential network security threats, whether known or unknown threats. It can quickly detect attack attempts and status anomalies and immediately block them, effectively blocking malicious code and program attack behaviors, and achieving all-weather, uninterrupted monitoring and protection, protecting the safe operation of information systems, ensuring the continuous security of the network environment, and being real-time without affecting business continuity or the security and stability of the network.

[0123] In addition, this application creates a trusted security foundation for the deduction model by deeply integrating the capabilities of trusted computing. At the same time, the algorithm adds trusted parameters to give the deduction model the ability of autonomous immunity. It can conduct a comprehensive security check on the deduction model itself to ensure its own security and reliability. At the same time, it conducts a comprehensive security check on the network equipment, network environment, etc. to ensure the overall security and reliability of the system. On the premise of ensuring the security of the system itself, security protection is carried out at the data level, and trusted protection is carried out on the entire process of data collection, processing, storage, analysis, and judgment to prevent tampering, improve readiness, and improve security.

[0124] Based on the same technical concept, the present application provides a secure deduction device based on trusted computing, such as Figure 7 As shown, the device comprises:

[0125] The collection module 701 is used to collect target data in a real environment through a trusted terminal in the deduction model, wherein the deduction model is trained based on real historical data, and the target data is always verified based on trusted parameters and trusted states during the data flow process;

[0126] Prediction module 702, used to predict threat events in the target data by matching the target data with a preset target feature library;

[0127] The execution module 703 is used to determine the defense strategy corresponding to the threat event according to the preset defense plan, and execute the defense strategy.

[0128] Optionally, the target feature library includes an operation instruction set, an instruction feature set, and a threat feature set, and the prediction module 702 is used to:

[0129] Feature matching of the target data with the operation instruction set and the instruction feature set, wherein the operation instruction set includes a plurality of compliance operation instructions, and the instruction feature set includes compliance messages and compliance rules;

[0130] If the match fails, the target data is compared with the threat feature set, where the threat feature set includes abnormal messages, abnormal rules, and abnormal features;

[0131] If the target data meets the threat feature set, the target data is determined to be a known threat;

[0132] If the target data does not conform to the threat signature set, the target data is determined to be an unknown threat.

[0133] Optionally, if the threat event is an unknown threat, the execution module 703 is used to:

[0134] Determine threat behavior categories by analyzing the behavior of unknown threats;

[0135] Determine the defense strategy corresponding to the threat behavior category according to the pre-built association relationship;

[0136] New threats and changes in attack patterns are collected in real time through intelligence sharing, and intelligent learning algorithms are used to adaptively adjust existing defense strategies based on dynamic measurements of trusted computing.

[0137] Optionally, the device is also used for:

[0138] The characteristic parameters of unknown threats learned are incorporated into the learning library through intelligent learning algorithms, so that the learning library can update the target characteristic library according to the new security threats learned and adapted.

[0139] Optionally, the device is also used for:

[0140] An intelligent learning algorithm is used to learn the similarities between different attack patterns, and the metric parameters of the deduction model are adaptively adjusted to transfer the experience accumulated based on a specific type of attack pattern to other types of attack patterns.

[0141] Optionally, the device is also used for:

[0142] Extract sample data containing specific features from real historical data based on trusted terminals, and build an initial feature library based on the sample data. The sample data is verified based on trusted parameters and trusted status during data flow.

[0143] The sample data is divided into normal events and threat events using the initial verification rules in the initial feature library, and the initial feature library is enriched with the latest threats learned and adapted by the learning library;

[0144] Generate an initial defense strategy based on the threat events obtained from the initial feature library, and use an intelligent learning algorithm to improve the initial defense strategy;

[0145] Among them, the measurement function of the deduction model is used to determine whether the sample data of each link can be credibly verified, whether the generated defense strategy can prevent threat events, and whether the learning library can recognize and adapt to new threat patterns.

[0146] like Figure 8 As shown, an embodiment of the present application provides an electronic device, including a processor 801, a communication interface 802, a memory 803 and a communication bus 804, wherein the processor 801, the communication interface 802, and the memory 803 communicate with each other through the communication bus 804.

[0147] The memory 803 is used to store computer programs.

[0148] In one embodiment of the present application, the processor 801 is used to implement the secure deduction method based on trusted computing provided by any one of the aforementioned method embodiments when executing the program stored in the memory 803.

[0149] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the secure deduction method based on trusted computing provided in any of the aforementioned method embodiments are implemented.

[0150] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0151] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0152] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0153] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.

Claims

1. A security deduction method based on trusted computing, characterized in that: The method comprises: Collect target data in the real environment through the trusted terminal in the deduction model, wherein the deduction model is trained based on real historical data, and the target data is always verified based on the trusted parameters and trusted status during the data flow process; Predicting threat events in the target data by matching the target data with a preset target feature library; Determine the defense strategy corresponding to the threat event according to the preset defense plan, and execute the defense strategy.

2. The method according to claim 1, characterized in that The target feature library includes an operation instruction set, an instruction feature set, and a threat feature set. By matching the target data with a preset target feature library, the threat events in the target data are predicted to include: Performing feature matching on the target data with the operation instruction set and the instruction feature set, wherein the operation instruction set includes a plurality of compliance operation instructions, and the instruction feature set includes compliance messages and compliance rules; If the match fails, the target data is compared with a threat feature set, wherein the threat feature set includes abnormal messages, abnormal rules, and abnormal features; If the target data matches the threat feature set, determining that the target data is a known threat; If the target data does not conform to the threat feature set, the target data is determined to be an unknown threat.

3. The method according to claim 2, characterized in that The threat event is an unknown threat, and the defense strategy corresponding to the threat event is determined according to the preset defense scheme, including: Determining a threat behavior category by analyzing the behavior of the unknown threat; Determine the defense strategy corresponding to the threat behavior category according to the pre-built association relationship; New threats and changes in attack patterns are collected in real time through intelligence sharing, and intelligent learning algorithms are used to adaptively adjust existing defense strategies based on dynamic measurements of trusted computing.

4. The method according to claim 2, characterized in that: After determining that the threat event is an unknown threat, the method further includes: The learned characteristic parameters of unknown threats are incorporated into the learning library through an intelligent learning algorithm, so that the learning library updates the target characteristic library according to the learned and adapted new security threats.

5. The method according to claim 1, characterized in that: The method further comprises: An intelligent learning algorithm is used to learn the similarities between different attack patterns, and the metric parameters of the deduction model are adaptively adjusted to transfer the experience accumulated according to a specific type of attack pattern to other types of attack patterns.

6. The method according to claim 1, characterized in that The training process of the deduction model includes: Extracting sample data containing specific features from real historical data based on the trusted terminal, and building an initial feature library based on the sample data, wherein the sample data is trusted and verified according to trusted parameters and trusted status during data flow; The sample data is divided into normal events and threat events by using the initial verification rules in the initial feature library, and the initial feature library is enriched by the latest threats learned and adapted by the learning library; Generate an initial defense strategy based on the threat events obtained from the initial feature library, and use an intelligent learning algorithm to improve the initial defense strategy; Among them, the metric function of the deduction model is used to determine whether the sample data of each link is credibly verified, whether the generated defense strategy can prevent threat events, and whether the learning library can identify and adapt to new threat patterns.

7. A secure deduction model system based on trusted computing, characterized in that: The system includes a collection module, a deduction module and a management and control module; The acquisition module is used to collect target data in a real environment through a trusted terminal in the deduction model, wherein the deduction model is trained based on real historical data, and the target data is always verified based on trusted parameters and trusted states during the data flow process; The deduction module is used to predict threat events in the target data by performing feature matching between the target data and a preset target feature library; The management control module is used to determine the defense strategy corresponding to the threat event according to a preset defense plan, and execute the defense strategy.

8. A security deduction device based on trusted computing, characterized in that: The device comprises: A collection module is used to collect target data in a real environment through a trusted terminal in the deduction model, wherein the deduction model is trained based on real historical data, and the target data is always verified based on trusted parameters and trusted states during the data flow process; A prediction module, used to predict threat events in the target data by matching the target data with a preset target feature library; The execution module is used to determine the defense strategy corresponding to the threat event according to a preset defense plan and execute the defense strategy.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing any of the methods described in claims 1-6 when executing a program stored in a memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images