A secure sandbox-based device admission control method and system

Abstract

The application discloses a kind of based on secure sandbox equipment access control method and system, using advanced virtualization technology, constructs a highly isolated operating environment, combined with deep packet inspection, system call interception and process running logic analysis etc., comprehensive monitoring sandbox process accesses the behavior of virtual equipment, assesses equipment security and credibility, prevents illegal process on access terminal running, to realize the safe access control of equipment. Monitoring includes packet content, protocol filtering, threat detection, system call interception, process creation, execution and termination behavior monitoring etc. Combined with trust evaluation algorithm, collect and extract behavior data features, apply machine learning model to trust score, and dynamically adjust equipment trust level and access strategy according to score. The application relies on secure sandbox management program and authentication server, unified management, quickly deploy access control strategy. After equipment identity authentication, increase real-time monitoring of process dynamic behavior in equipment running process, aiming at further improving the security of equipment in data exchange process.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field, in particular to a device access control method and system based on a secure sandbox. BACKGROUND

[0002] Under the background of the rapid development of current network technology, ensuring the access security of network resources and the legitimacy of device identity has become the core issue of network security management. It is responsible for verifying whether the device to be exchanged is in line with the security policy, so as to prevent unauthorized devices from accessing network resources. However, traditional device access control technologies, such as password verification, digital certificate and MAC address filtering, although to some extent guarantee the security of the network, but they each have some problems.

[0003] Password verification is vulnerable to attack, increases user burden, and lacks verification of the device itself, posing a risk of password leakage. Digital certificates face problems such as certificate credibility, complex updating and maintenance, and high management costs. MAC address filtering is easily spoofed, is not suitable for dynamic networks, and cannot identify the real identity of the device. In addition, there are privacy leakage risks, difficulties in identifying malicious devices, complex management, and other problems, as well as insufficient flexibility, poor scalability, poor compatibility, and poor user experience.

[0004] Traditional device access control methods rely on static rule matching and black list mechanisms, and existing device access control methods mostly lack dynamic monitoring and evaluation of device behavior, and do not have real-time monitoring of processes. SUMMARY

[0005] The purpose of the present application is to provide a device access control method and system based on a secure sandbox to solve the problems raised in the background.

[0006] To achieve the above purpose, the present application provides the following technical solution: a device access control method based on a secure sandbox, at least comprising:

[0007] S100. Initiating an identity authentication request from the secure sandbox management program to the authentication server;

[0008] S200. After successful identity authentication, the authentication server issues an initial access control policy to the secure sandbox management program;

[0009] S300. The secure sandbox management program deploys the initial access control policy to the corresponding sandbox container;

[0010] S400. The secure sandbox management program monitors the access behavior of the process in the sandbox to the virtual device, specifically including:

[0011] S410. Process behavior monitoring: network communication data analysis, system call interception, and process running logic analysis on processes in the sandbox;

[0012] S420. Process trust evaluation: extracting network communication, system call, and process running logic features and inputting them into a machine learning model to evaluate device trust score, and dynamically adjusting device trust level and access control strategy;

[0013] S500. Constructing process execution behavior portrait according to extracted features and known security rules;

[0014] S600. The security sandbox manager compares the real-time execution behavior of the process with the pre-constructed process execution behavior portrait, and blocks the abnormal behavior of the process when detecting abnormal behavior of the process and pushes the alarm to the authentication management platform.

[0015] Preferably, the S410 process behavior monitoring at least includes: S411. Network communication data analysis: involving deep packet inspection technology, analyzing the data packets sent and received by the sandbox container, identifying the content, protocol and potential threat of the data packets;

[0016] S412. System call interception: monitoring system calls in the sandbox and intercepting suspicious or illegal operations;

[0017] S413. Process running logic analysis: analyzing process creation, execution and termination behavior in the sandbox, and identifying abnormal behavior patterns.

[0018] Preferably, the S420 process trust evaluation at least includes: S421. Collecting network communication, system call and process running logic data;

[0019] S422. Extracting network communication, system call and process running logic features;

[0020] S423. Inputting the extracted network communication, system call and process running logic features into a machine learning model to obtain the trust score of the virtual device;

[0021] S424. According to the trust score result, dynamically adjusting the trust level of the device, and deciding whether to allow the device to access the network according to the trust level, and dynamically adjusting the access control strategy.

[0022] Preferably, the machine learning model can be a decision tree model, a random forest model or a neural network model.

[0023] A device access control system based on a security sandbox includes an authentication request module for initiating an identity authentication request to an authentication server by a security sandbox manager;

[0024] The policy issuing receiving module is configured to receive and analyze the security policy issued from the authentication server and deliver the security policy to the local policy deployment module.

[0025] The policy deployment module is configured to apply the received security policy to the sandbox.

[0026] The process behavior monitoring module is configured to analyze network communication data, intercept system calls and analyze process running logic of the processes in the sandbox.

[0027] The process trust evaluation module is configured to extract network communication, system call and process running logic features and input the features into a machine learning model to evaluate a device trust score, and then dynamically adjust the device trust level and access control policy.

[0028] The process execution behavior portrait construction module is configured to construct a process execution behavior portrait according to the extracted features and known security rules.

[0029] The abnormal behavior blocking and alarming module is configured to immediately take measures to block the abnormal behavior and issue an alarm notification when the abnormal behavior is detected.

[0030] The device access control method and system based on the security sandbox have the following beneficial effects:

[0031] 1. The application adopts advanced virtualization technology to construct a highly isolated running environment, i.e., a security sandbox.

[0032] 2. After the device identity authentication, the application increases real-time monitoring of the dynamic behavior of processes during device running, aiming to further improve the security of the device during data exchange.

[0033] 3、The application combines deep packet inspection, system call interception and process running logic analysis technology, comprehensively monitors the access behavior of processes in the sandbox to the virtual device, evaluates the security and credibility of the device, prevents illegal processes from running on the access terminal, and thus realizes the security access control of the device. The monitoring includes packet content, protocol filtering, threat detection, system call interception, process creation, execution and termination behavior monitoring, etc. Combined with the trust evaluation algorithm, the behavior data features are collected and extracted, the machine learning model is applied for trust scoring, and the device trust level and access strategy are dynamically adjusted according to the score, so as to prevent the spread of security threats. BRIEF DESCRIPTION OF DRAWINGS

[0034] Fig. 1 The device access control method of the application is shown in the flow chart.

[0035] Fig. 2 The device access control system block diagram of the application is shown. DETAILED DESCRIPTION

[0036] The technical solutions in the embodiments of the application will be described clearly and completely in the embodiments of the application combined with the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the application.

[0037] Please refer to Figs. 1-2 The application provides a technical solution: a device access control method based on a secure sandbox, at least including:

[0038] S100. Initiating an identity authentication request to an authentication server by a secure sandbox management program;

[0039] The secure sandbox management program is a key component in the whole security system, which first needs to send an identity authentication request to a special authentication server to verify its legality and authenticity.

[0040] This process is similar to the input of username and password by individuals when logging in to some security systems, except that here it is the interaction between the program and the server based on specific authentication protocols and mechanisms. The secure sandbox management program uses digital certificates or pre-shared keys to send authentication request data packets containing its own identification information to the specified port of the authentication server. Some environment information such as the host address and running state of the program will be attached to the authentication request to enable the authentication server to conduct more comprehensive identity verification.

[0041] S200. After the identity authentication is successful, the authentication server issues an initial access control strategy for the secure sandbox management program;

[0042] When the authentication server receives the authentication request of the secure sandbox manager, it verifies and audits the information provided by the manager. If the authentication is successful, it means that the manager is confirmed to be legal and trusted. At this time, the authentication server generates and issues the corresponding initial access control policy for the secure sandbox manager according to the pre-set rules and strategies. These policies specify the operation range, resource types that can be accessed, and interaction permissions with other system components that the secure sandbox manager can perform in subsequent operations. For example, the access control policy can specify the number of sandbox containers that the secure sandbox manager can manage, the specific permissions of resource allocation and monitoring operations on processes in the sandbox, and the way of cooperation with other security-related systems (such as firewalls and intrusion detection systems).

[0043] S300. The secure sandbox manager deploys the initial access control policy to the corresponding sandbox container.

[0044] After receiving the initial access control policy issued by the authentication server, the secure sandbox manager converts these policies into specific configuration parameters and deploys them to the corresponding sandbox container.

[0045] The specific configuration parameters include allocating independent virtual resources for each device to be accessed using hardware virtualization technology, including VCPU, memory, and network interface; deploying a lightweight operating system and necessary services inside the sandbox to simulate a real network environment; and achieving logical isolation between the sandbox and the external network through network virtualization technology to ensure that all activities of the device in the sandbox do not leak to the external network.

[0046] The secure sandbox manager will fine-tune the network access rules, file system access permissions, and process execution permissions of the sandbox container according to the access control policy. For example, if the access control policy specifies that the processes in a sandbox container can only access specific network service ports, the secure sandbox manager will set the corresponding firewall rules in the network configuration of the container to only allow communication connections with these specified ports.

[0047] S400. The secure sandbox manager monitors the access behavior of the processes in the sandbox to the virtual device.

[0048] After the deployment of the control policy of the sandbox container is completed, the secure sandbox manager will start comprehensive monitoring of the processes in the sandbox, especially the calling and accessing behavior of the processes to the virtual device.

[0049] S410. Process behavior monitoring: network communication data analysis, system call interception, and process running logic analysis of the processes in the sandbox.

[0050] S411. Network communication data analysis: involves deep packet inspection technology to analyze the data packets sent and received by the sandbox container, identifying the content, protocol, and potential threats of the packets;

[0051] For sandbox containers, deep packet inspection (DPI) can check whether the transmitted data contains malicious code or sensitive information. For example, check whether malicious scripts (such as JavaScript) are transmitted outside the container, or whether the container is sending files containing company secrets outside. By parsing the data part of the data packet, DPI can identify common malicious code patterns such as SQL injection, cross-site scripting (XSS) code, etc. DPI can help monitor the behavior of applications within the sandbox container. By analyzing the network traffic generated by the application, understand its normal communication pattern. For example, a normal office software may only synchronize data with the company's internal server at certain times. If DPI detects that the software frequently sends a large amount of data outside during non-working hours, it may be abnormal behavior, indicating that the application may be maliciously exploited or malfunctioning.

[0052] Deep packet inspection (DPI) identifies the protocols used by the sandbox container for incoming and outgoing traffic: for example, in a secure sandbox manager, DPI can determine whether the container is communicating using unauthorized protocols. If the sandbox is designed to only allow HTTP / HTTPS protocols for data interaction, DPI can detect any attempt to use other protocols (such as FTP or SMTP), and promptly discover potential violations.

[0053] Threat detection and prevention functions of deep packet inspection (DPI): intrusion detection: DPI can be used as an intrusion detection mechanism in a secure sandbox, monitoring abnormal traffic patterns, and marking potential intrusion attempts such as a large number of connection requests from the same external IP address and data containing suspicious instruction sequences. Malware communication blocking: DPI can detect communication between the sandbox container and known malicious IP addresses or domain names, and after discovery, the manager can block the link to prevent the spread or reception of instructions by malicious software.

[0054] S412. System call interception: monitor and intercept suspicious or illegal system calls in the sandbox;

[0055] In a secure sandbox manager, system call interception can strictly control the access permissions of processes within the sandbox container to system resources. For example, an application in a sandbox should not normally have the permission to directly access the root directory of the host file system. By intercepting system calls, when the application attempts to make a system call similar to "open a sensitive configuration file in the root directory", the manager can immediately prevent this operation, preventing the application from accessing sensitive resources.

[0056] System call interception can help establish a baseline of normal application behavior within the sandbox container. By monitoring the system call patterns of an application over a long period of time, including the function name called, parameter range, frequency of calls, etc., a baseline of normal behavior can be established. For example, a text editing application might normally involve mostly file read and write related system calls, and the file paths involved in these calls are usually within the user specified document directory. Any abnormal system calls, such as frequent calls to encryption related functions or access to other non-document related directories, can be considered as deviating from normal behavior. During runtime, system call interception continuously monitors the system call behavior within the sandbox container and compares it against the pre-established baseline of normal behavior. If a process exhibits significantly different system call behavior from the baseline, such as calling a high risk system function that has never been called before (such as a function that directly manipulates kernel memory) or a sudden large increase in system call frequency, the security sandbox manager can take immediate action, such as suspending the process and conducting a thorough inspection.

[0057] S413. Process runtime logic analysis: Analyze the process creation, execution and termination behavior of the device within the sandbox, and identify abnormal behavior patterns.

[0058] Process creation monitoring: The security sandbox manager can monitor the process creation behavior to ensure that every process launched within the sandbox container is legitimate. For example, in a sandbox dedicated for web browsing, only browser related processes (such as the browser main process, plugin processes, etc.) are allowed to be created. If a process related to a checksum software is detected trying to create, this is obviously abnormal behavior. The manager can judge the legitimacy of process creation based on a pre-defined list of allowed processes (whitelist) or a list of prohibited processes (blacklist).

[0059] Process execution monitoring: During the execution of a process, the sequence of instructions it executes is analyzed. Normal applications usually have a relatively fixed pattern of instruction execution. For example, a text editing software when opening a file, will execute a series of instructions related to file reading, memory allocation, interface display. If within the sandbox container, a process executes a large number of instructions related to encryption and network sending, which is not consistent with the original function of the process (such as a simple calculator application), this can be abnormal behavior, and can be malicious software stealing user data and sending it out.

[0060] It also includes monitoring the resource usage during the process execution. Different processes have certain ranges of resource usage when they are normally executed, such as CPU, memory, disk I / O, and network bandwidth. For example, an image viewer process will have a relatively stable memory occupation and CPU usage when it is normally loading and displaying pictures. If in the sandbox, this process suddenly starts to occupy a large amount of CPU resources and frequently performs disk write operations, it may be abnormal behavior, which may be that the process is maliciously tampered with.

[0061] Process termination monitoring: pay attention to the abnormal termination of the process. Normally, a process will terminate normally after completing the task according to the predetermined logic, or exit in a specific way and return an error code when an error is encountered. If in the sandbox container, a process suddenly terminates abnormally, for example, the process directly disappears without any error prompt, or repeatedly starts and terminates abnormally, which may be the result of external attacks or internal errors. The hypervisor can record the information of these abnormally terminated processes, including process ID, termination time, etc., and analyze the behavior of other processes related to it when a process terminates abnormally.

[0062] S420. Process trust evaluation: extract network communication, system call and process running logic features and input into machine learning model to evaluate device trust score, and then dynamically adjust device trust level and access control strategy; evaluate the security and credibility of the device;

[0063] The specific implementation steps include:

[0064] S421. Collect network communication, system call and process running logic data;

[0065] Network communication data collection: the secure sandbox hypervisor collects network communication data of the sandbox container through deep packet inspection (DPI). Including source IP address, destination IP address, port number, protocol type, packet size and frequency, etc.

[0066] System call data collection: use system call interception mechanism to record the system calls made by the processes in the sandbox container. Including the function name, parameters, return value, etc. For example, when a process frequently calls system calls to modify system critical files, it may be a sign of malicious behavior. The hypervisor will use these system call data as an important basis for evaluating the security of the device.

[0067] Process running logic data collection: Analyze the creation, execution, and termination behavior of processes within the sandbox container using process running logic. Record information such as process name, start time, execution path, resource consumption, etc. For example, if a new process starts at an unexpected time and consumes a large amount of CPU resources, it may indicate a security issue. The hypervisor integrates these process running logic data into the evaluation dataset.

[0068] S422. Extract network communication, system call, and process running logic features;

[0069] Network communication feature extraction: Extract features from collected network communication data. For example, extract periodicity features of communication, if a device always communicates with a specific IP address at fixed time intervals, it may be a normal update operation; while irregular frequent communication may be abnormal. Also, extract features such as average packet size, data transfer rate, etc. For suspicious communication patterns, such as high-frequency large packet transmission to external unknown addresses, these features can help identify potential security threats.

[0070] System call feature extraction: Feature extraction on system call data. Frequency features of system calls can be extracted, such as the number of occurrences of a high-risk system call (such as direct access to kernel memory) within a unit of time. Combination features of system calls can also be extracted, such as a specific sequence of system calls that may represent a certain attack behavior of malware (such as first obtaining system privileges, then modifying critical files). These features can reflect the security status of the device at the system level.

[0071] Process running logic feature extraction: Extract features from process running logic data. For example, extract process lifecycle features, including process survival time, startup frequency, etc. A process that frequently starts and stops may be suspicious. Resource usage features of processes can also be extracted, such as CPU usage peak and average, memory usage changes, etc. These features help assess whether a process has abnormal behavior, and thus determine the security of the device.

[0072] S423. Input the extracted network communication, system call, and process running logic features into the machine learning model to obtain the trust score of the virtual device;

[0073] According to the characteristics of the collected and extracted data, select a suitable machine learning model. Here, Behavior Baseline Analysis is used: use machine learning algorithms to model normal device behavior, identify abnormal behavior patterns through real-time monitoring and comparative analysis.

[0074] Risk Assessment Model: Use algorithms such as fuzzy logic, decision trees, neural networks, etc. to quantitatively evaluate the trustworthiness of devices to determine their access permissions.

[0075] For example, if the data has strong logicality and interpretability, a decision tree model may be a good choice. It can clearly show which features are used to judge the security of the device. If the data is complex and requires high accuracy, a random forest or neural network model may be more suitable. These models can handle a large number of feature combinations and mine potential patterns in the data. Input the extracted feature data into the selected machine learning model to get the trust score of the device. For example, in a 0-100 scoring system, 0 means completely untrustworthy, and 100 means completely trustworthy. If a device has a lot of suspicious external connections in network communication, contains high-risk operations in system calls, and has abnormal process behavior, it may get a lower trust score.

[0076] S424. According to the trust score result, dynamically adjust the trust level of the device, and decide whether to allow the device to access the network, and dynamically adjust the access control policy.

[0077] According to the trust score result, set multiple trust levels, and dynamically adjust according to the trust level of the device and the current security situation of the network. Here we use the dynamic access control policy: according to the real-time network security situation and device risk assessment result, automatically adjust the access control policy, realize flexible and efficient access management. For example, if the trust score of the device is lower than a certain threshold (such as 30), its trust level can be adjusted from "normal" to "suspicious". If the behavior of the device improves in subsequent monitoring, the trust score increases, and the trust level can also be improved accordingly. According to the trust level of the device, decide whether to allow it to access the network. For devices with low trust level, network access can be restricted, such as only allowing access to internal secure resources, or completely prohibiting network access until its security is verified. This can effectively prevent potential security threats from spreading from the sandbox container to other network environments. Realize the automatic deployment and update of access control policy to quickly respond to new security threats and business needs.

[0078] In a virtualized environment, processes inside the sandbox can interact with the outside world through virtual device interfaces of the virtualization layer, including virtual network interface cards, virtual disks, virtual memory, etc. The secure sandbox hypervisor tracks and records the operations of the processes on these virtual devices in real time, such as whether the process attempts to access unauthorized virtual disk areas, whether it makes abnormal network connection attempts through the virtual network interface, etc. Through such monitoring, potential security threats can be discovered in a timely manner to prevent processes from using virtual devices for illegal data theft, malware propagation, or other malicious behavior.

[0079] S500. According to the extracted features and known security rules, construct a process execution behavior portrait.

[0080] In the process of continuously monitoring the processes inside the sandbox, the secure sandbox hypervisor collects a large amount of data about the execution behavior of the processes, including system call sequences, resource usage patterns, file and device access patterns, etc. Based on these rich data, the secure sandbox hypervisor constructs an execution behavior portrait of the sandbox process. This portrait is like a "behavior characteristic fingerprint" of a process, which can accurately describe the behavior patterns and characteristics of the process in a normal running state. For example, for a normal web server process, its behavior portrait may include frequently listening to port 80 or 443 in a certain time period, periodically reading and updating configuration files in a certain directory, running with relatively stable CPU and memory usage, etc. By establishing such a behavior portrait, subsequent abnormal changes in process behavior can be more easily identified, thereby quickly discovering potential security problems.

[0081] S600. The secure sandbox hypervisor compares the real-time execution behavior of the process with the pre-constructed process execution behavior portrait, and blocks the abnormal behavior of the process and pushes an alarm to the authentication management platform when an abnormal behavior of the process is detected.

[0082] Specifically, the hypervisor will block the abnormal behavior of the process according to the pre-set security rules to prevent it from further damaging the system. For example, if a process suddenly starts to occupy a large amount of CPU resources and attempts to connect to a suspicious IP address outside, the secure sandbox hypervisor will immediately terminate the process's network connection to the outside and limit its CPU resource usage, putting it into a restricted running state. At the same time, the hypervisor will also push an alarm to the authentication management platform with detailed information about the abnormal behavior, such as process ID, abnormal behavior description, time of occurrence, etc. The authentication management platform, upon receiving the alarm, can further analyze and handle the security event, such as notifying the security administrator for in-depth investigation, or starting higher-level security defense measures to protect the security and stability of the entire system.

[0083] A secure sandbox-based device access control system includes an authentication request module for initiating an identity authentication request to an authentication server by a secure sandbox hypervisor, verifying the legitimacy of a user or service, and ensuring that only authorized entities can access system resources;

[0084] A policy issuance receiving module for receiving and parsing security policies issued from the authentication server and passing them to a local policy deployment module;

[0085] A policy deployment module for applying the received security policies to the sandbox, ensuring correct execution and updating of the policies;

[0086] A process behavior monitoring module for analyzing network communication data, intercepting system calls, and analyzing process running logic for processes within the sandbox;

[0087] A process trust evaluation module for extracting network communication, system call, and process running logic features and inputting them into a machine learning model to evaluate device trust scores, and dynamically adjusting device trust levels and access control policies;

[0088] A process execution behavior profile construction module for constructing process execution behavior profiles based on extracted features and known security rules;

[0089] An abnormal behavior blocking and alerting module for immediately taking measures to block the behavior and issuing an alert notification when abnormal behavior is detected.

[0090] Although embodiments of the present application have been shown and described, it is to be understood that various modifications, substitutions, replacements and variations can be made to these embodiments without departing from the principles and spirit of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A secure sandbox based device admission control method, characterized by: At least comprising: S100. Initiating an identity authentication request to the authentication server by the secure sandbox manager; S200. After the identity authentication is successful, the authentication server issues an initial access control policy for the secure sandbox manager; S300. The secure sandbox manager deploys the initial access control policy to the corresponding sandbox container; S400. The secure sandbox manager monitors the access behavior of the process in the sandbox to the virtual device, specifically including: S410. Process behavior monitoring: network communication data analysis, system call interception, and process running logic analysis are performed on the processes in the sandbox; S420. Process trust evaluation: network communication, system call, and process running logic features are extracted and input into a machine learning model to evaluate the device trust score, and then the device trust level and access control policy are dynamically adjusted; S500. According to the extracted features and known security rules, a process execution behavior profile is constructed; S600. The secure sandbox manager compares the real-time execution behavior of the process with the pre-constructed process execution behavior profile, and blocks the abnormal behavior of the process and pushes an alarm to the authentication management platform when an abnormal behavior of the process is detected; The S420 process trust evaluation at least includes: S421. Collecting network communication, system call, and process running logic data; S422. Extracting network communication, system call, and process running logic features; S423. Inputting the extracted network communication, system call, and process running logic features into a machine learning model to obtain a trust score of the virtual device; S424. According to the trust score result, dynamically adjusting the trust level of the device, and deciding whether to allow the device to access the network, and dynamically adjusting the access control policy.

2. The secure sandbox-based device admission control method of claim 1, wherein: The S410 process behavior monitoring at least includes: S411. Network communication data analysis: involving deep packet inspection technology, analyzing the data packets sent and received by the sandbox container, identifying the content, protocol, and potential threats of the data packets; S412. System call interception: monitoring system calls in the sandbox and intercepting suspicious or illegal operations; S413. Process running logic analysis: analyzing process creation, execution, and termination behavior in the sandbox to identify abnormal behavior patterns.

3. The method of claim 1, wherein: The machine learning model can be a decision tree model, a random forest model, or a neural network model.

4. The system of claim 1, wherein: An authentication request module is configured to initiate an identity authentication request to the authentication server by the secure sandbox manager; A policy issuance receiving module is configured to receive and parse the security policy issued from the authentication server, and pass it to the local policy deployment module; A policy deployment module is configured to apply the received security policy to the sandbox; A process behavior monitoring module is configured to perform network communication data analysis, system call interception, and process running logic analysis on the processes in the sandbox; A process trust evaluation module is configured to extract network communication, system call, and process running logic features and input them into a machine learning model to evaluate the device trust score, and then dynamically adjust the device trust level and access control policy; A process execution behavior profile construction module is configured to construct a process execution behavior profile according to the extracted features and known security rules; Anomaly behavior blocking and alerting module for taking immediate action to block the behavior and issue an alert notification upon detecting the anomaly behavior.

Images