An anti-attack method and system for improving the security of intelligent terminals

Abstract

The present application provides an anti-attack method and system for improving the security of smart terminals. The method extracts the parallel call features of each task process in the smart terminal from the behavioral data stream of the parallel task process in the smart terminal, and then determines the threat behavior sequence of the parallel task process in the smart terminal through the communication relationship between each parallel call feature and the task process in the smart terminal; reversely traces and locates the dependency of each threat behavior in the threat behavior sequence according to the attack tracing module of the smart terminal, and obtains multiple attack dependency nodes of the threat behavior in the smart terminal, and then generates a threat map of the attack link through all the attack dependency nodes; uses the threat map to automatically generate a hot patch for the threat behavior in the smart terminal, and then repairs the vulnerability by differentially updating the hot patch without affecting the normal service of the smart terminal. Based on the above scheme, hot patch repair of attack behavior of the smart terminal can be achieved, thereby improving the continuity of the security service of the smart terminal.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and more specifically, to an anti-attack method and system for improving the security of smart terminals. Background Art

[0002] With the popularization of smart terminals, the openness of smart terminal operating systems has increased, carrying a large amount of personal and business data, and security threats are increasing. Smart terminal security technology mainly focuses on three levels: hardware security, operating system security, and application security. Hardware security uses chip-level technology to achieve resource isolation and protection, operating system security relies on vulnerability repair, autonomous and controllable systems, and controlled updates, and application security is guaranteed by secure application stores and encryption technology.

[0003] Traditional security solutions have significant runtime protection shortcomings when dealing with new threats, especially against unknown attacks such as zero-day vulnerability exploits. Detection mechanisms that rely on feature library matching cannot identify attack features that have not yet been included, resulting in a lack of effective interception measures when vulnerabilities are exploited. Static defense strategies are difficult to adapt to dynamic attack scenarios. Attackers can easily bypass detection through code obfuscation, polymorphic deformation and other means. Traditional solutions mostly adopt a post-repair mode. There is a time difference between vulnerability exposure and patch deployment, and zero-day attacks often cause substantial damage during this window period. Therefore, how to implement hot patch repairs for smart terminal attack behaviors and thereby improve the continuity of smart terminal security services has become a difficult problem facing the industry. Summary of the Invention

[0004] The present application provides an anti-attack method and system for improving the security of smart terminals, which can implement hot patch repair of smart terminal attack behaviors, thereby improving the continuity of security services of smart terminals.

[0005] In a first aspect, the present application provides an anti-attack method for improving the security of a smart terminal, comprising:

[0006] Building a behavior monitoring engine in the kernel layer of the intelligent terminal, and using the behavior monitoring engine to collect behavior data streams of parallel task processes in the intelligent terminal;

[0007] Extracting parallel call features of each task process in the smart terminal from the behavior data stream, and then determining the threat behavior sequence of the parallel task process in the smart terminal through the communication relationship between each parallel call feature and the task process in the smart terminal;

[0008] The smart terminal attack tracing module performs reverse tracing and dependency positioning on each threat behavior in the threat behavior sequence to obtain multiple attack dependency nodes of the threat behavior in the smart terminal, and then generates a threat map of the attack chain through all the attack dependency nodes;

[0009] The threat map is used to automatically generate a hot patch for the threat behavior in the smart terminal, and then the vulnerability is repaired by differentially updating the hot patch without affecting the normal service of the smart terminal.

[0010] In some embodiments, extracting the parallel call features of each task process in the intelligent terminal from the behavior data stream specifically includes:

[0011] For each task process in the intelligent terminal, the calling information and resource occupancy information of the task process are obtained from the behavior data stream;

[0012] extracting parallel features from the call information and occupancy features from the resource occupancy information;

[0013] The parallel calling feature of the task process is determined by the parallel feature and the occupancy feature, and then the parallel calling feature of each task process in the intelligent terminal is obtained.

[0014] In some embodiments, determining the threat behavior sequence of the parallel task processes in the smart terminal through the communication relationship between each parallel call feature and the task processes in the smart terminal specifically includes:

[0015] Determine the temporal correlation score of the parallel task process in the intelligent terminal by using the parallel features in each parallel call feature;

[0016] Determine the resource contention abnormality of the parallel task processes in the intelligent terminal through the occupancy features in each parallel call feature;

[0017] Determining the credibility of the communication relationship between the parallel task processes in the intelligent terminal through the communication relationship between the task processes in the intelligent terminal;

[0018] The time sequence correlation score, the resource competition abnormality degree and the communication relationship credibility are weightedly integrated to obtain the threat behavior sequence of the parallel task process in the intelligent terminal.

[0019] In some embodiments, the smart terminal attack tracing module performs reverse tracing and dependency positioning on each threat behavior in the threat behavior sequence to obtain multiple attack dependency nodes of the threat behavior in the smart terminal, specifically including:

[0020] For each threat behavior, starting from the trigger point of the threat behavior, a data dependency graph across task processes is constructed;

[0021] Marking the likelihood value of each execution node of the threat behavior in the smart terminal through the data dependency graph;

[0022] Each likelihood value is used to filter out the attack-dependent nodes of the threat behavior from the smart terminal, and then obtain the attack-dependent nodes of each threat behavior.

[0023] In some embodiments, generating a threat graph of an attack chain through all attack-dependent nodes specifically includes:

[0024] Obtain the tracing path of each attack-dependent node, and then determine the propagation delay of each tracing path;

[0025] The threat map of the attack link is determined through all tracking paths and each propagation delay.

[0026] In some embodiments, the behavior monitoring engine is a Linux-based hybrid monitoring framework.

[0027] In some embodiments, the smart terminal is a heterogeneous computing platform based on a secure encryption engine and a multi-core processor.

[0028] In a second aspect, the present application provides an anti-attack system for improving the security of a smart terminal, including an anti-attack unit, wherein the anti-attack unit includes:

[0029] A collection module is used to build a behavior monitoring engine in the kernel layer of the intelligent terminal, and use the behavior monitoring engine to collect behavior data streams of parallel task processes in the intelligent terminal;

[0030] a processing module, configured to extract parallel call features of each task process in the smart terminal from the behavior data stream, and then determine a threat behavior sequence of the parallel task processes in the smart terminal based on the communication relationship between each parallel call feature and the task processes in the smart terminal;

[0031] The processing module is further configured to perform reverse tracing and dependency positioning of each threat behavior in the threat behavior sequence according to the smart terminal attack tracing module, obtain multiple attack dependency nodes of the threat behavior in the smart terminal, and then generate a threat map of the attack chain through all the attack dependency nodes;

[0032] An execution module is used to automatically generate a hot patch for threat behavior in the smart terminal using the threat map, and then repair the vulnerability by differentially updating the hot patch without affecting the normal service of the smart terminal.

[0033] In a third aspect, the present application provides a computer device comprising a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the computer device executes the above-mentioned anti-attack method for improving the security of smart terminals.

[0034] In a fourth aspect, the present application provides a computer-readable storage medium, which stores instructions or codes. When the instructions or codes are run on a computer, the computer implements the above-mentioned anti-attack method for improving the security of smart terminals.

[0035] The technical solutions provided by the embodiments disclosed in this application have the following beneficial effects:

[0036] The present application provides an anti-attack method and system for improving the security of smart terminals. A behavior monitoring engine is constructed in the kernel layer of the smart terminal, and the behavior monitoring engine is used to collect behavior data streams of parallel task processes in the smart terminal; parallel call features of each task process in the smart terminal are extracted from the behavior data stream, and then the threat behavior sequence of the parallel task processes in the smart terminal is determined through the communication relationship between each parallel call feature and the task process in the smart terminal; each threat behavior in the threat behavior sequence is reversely traced and dependently located according to the smart terminal attack tracing module to obtain multiple attack dependency nodes of the threat behavior in the smart terminal, and then a threat map of the attack link is generated through all the attack dependency nodes; the threat map is used to automatically generate a hot patch for the threat behavior in the smart terminal, and then the vulnerability is repaired by differentially updating the hot patch without affecting the normal service of the smart terminal.

[0037] It can be seen that in this application, the threat map is used to automatically generate hot patches for threat behaviors in smart terminals, and then the vulnerabilities are repaired by differentially updating hot patches without affecting the normal services of smart terminals; first, the threat behavior sequence can be determined to obtain an accurate set of attack behavior features, thereby providing a key target positioning basis for hot patch repair. Through in-depth analysis of parallel call features and process communication relationships, the system can identify abnormal behavior patterns, which often correspond to specific attack methods. After serializing the features of the attack methods, it can not only detect the ongoing attacks in real time, but also predict the subsequent steps of the attack, so that the system can prepare a repair plan before the attack causes substantial damage, greatly shortening the vulnerability response time, and gaining a critical time window for the subsequent hot patch generation, effectively ensuring service. The continuous availability of services; then, by determining the threat map, a complete visual attack chain can be obtained, thereby providing comprehensive path guidance for hot patch repair. By reversely tracing the threat map constructed by the attack-dependent nodes, the entry point, propagation path and key operation nodes of the attack can be clearly displayed, which helps smart terminals distinguish core vulnerabilities from secondary symptoms and ensure that repair measures are accurately applied to the most critical links. The delay weight analysis in the threat map can also reveal the attacker's operation rhythm, which helps to predict the target of their next possible attack, making the repair plan more forward-looking, avoiding the delay defects of local repairs, and blocking the attacker's subsequent operation space, fundamentally improving the service continuity guarantee capability; in summary, based on the above solution, hot patch repair of smart terminal attack behavior can be achieved, thereby improving the service continuity of smart terminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0039] Figure 1 is an exemplary flow chart of an anti-attack method for improving the security of a smart terminal according to some embodiments of the present application;

[0040] Figure 2 is a schematic diagram of a process for determining a threat map according to some embodiments of the present application;

[0041] Figure 3 is a schematic structural diagram of an anti-attack unit according to some embodiments of the present application;

[0042] Figure 4It is a structural diagram of a computer device for implementing an anti-attack method for improving the security of a smart terminal according to some embodiments of the present application. DETAILED DESCRIPTION

[0043] In order to better understand the technical solution of the present application, the technical solution of the present application will be described in detail below with reference to the accompanying drawings and specific implementation methods.

[0044] refer to Figure 1 , which is an exemplary flow chart of a method for improving the security of a smart terminal against attacks according to some embodiments of the present application. The method for improving the security of a smart terminal against attacks mainly includes the following steps:

[0045] In step 101, a behavior monitoring engine is constructed in the kernel layer of the intelligent terminal, and the behavior monitoring engine is used to collect behavior data streams of parallel task processes in the intelligent terminal.

[0046] It should be noted that in this application, the behavior data stream is a continuous monitoring data set consisting of time-serialized task process activity records, which contains the system call number, initiating thread, parameter hash value, CPU utilization, cache hit rate and DMA transfer volume in each task process; the behavior monitoring engine refers to a lightweight security agent embedded in the kernel of the smart terminal, which is responsible for multi-dimensional collection of task process runtime characteristics. The behavior monitoring engine is a hybrid monitoring framework based on Linux; the smart terminal is a heterogeneous computing platform based on a secure encryption engine and a multi-core processor; a parallel task process refers to a concurrently executed program entity that shares computing resources and has a communication or competitive relationship.

[0047] In the specific implementation, by modifying the task scheduling module of the operating system kernel, a monitoring hook is implanted when the task process context switches, and the basic operating indicators of the task process such as scheduling delay and time slice occupancy are captured in real time. Dynamic probes are deployed at the kernel system call entry and exit of the smart terminal to record the system call type, parameter characteristics and call timing relationship executed by each task process, forming call chain data with timestamps. The page table protection mechanism of the memory management unit is used to monitor the access mode of the task process to the shared memory area, including read and write frequency, data flow direction and cross-boundary access attempts. The above three layers of monitoring data are aggregated through the kernel ring buffer, and after preprocessing, a standardized data stream containing the task process behavior fingerprint is generated, and the standardized data stream is used as the behavior data stream of the parallel task process in the smart terminal.

[0048] In step 102, the parallel call features of each task process in the smart terminal are extracted from the behavior data stream, and then the threat behavior sequence of the parallel task process in the smart terminal is determined through the communication relationship between each parallel call feature and the task process in the smart terminal.

[0049] In some embodiments, extracting the parallel call features of each task process in the smart terminal from the behavior data stream can be achieved by using the following steps:

[0050] For each task process in the intelligent terminal, the calling information and resource occupancy information of the task process are obtained from the behavior data stream;

[0051] extracting parallel features from the call information and occupancy features from the resource occupancy information;

[0052] The parallel calling feature of the task process is determined by the parallel feature and the occupancy feature, and then the parallel calling feature of each task process in the intelligent terminal is obtained.

[0053] In the specific implementation, first, for each task process in the intelligent terminal, the system call number, initiating thread, parameter hash value, CPU utilization, cache hit rate and DMA transfer volume of the task process are obtained from the behavior data stream, so that the set of system call number, initiating thread and parameter hash value is used as the call information, and the set of CPU utilization, cache hit rate and DMA transfer volume is used as the resource occupancy information; then, the sliding window algorithm is used to perform timing analysis on the call information, so as to obtain all system call synchronization rates and resource contention waiting times across task processes obtained by timing analysis, so as to obtain the average of all system call synchronization rates and all resource contention waiting times. The set of mean values of waiting time is used as the parallel feature in the call information. At the same time, by statistically analyzing the periodic fluctuation law of resource occupancy information, the set of memory bandwidth contention intensity and computing unit load balance in the periodic fluctuation law is used as the occupancy feature in the resource occupancy information. Finally, a feature fusion model based on neural network is initialized, and the parallel feature and occupancy feature are used as the input features of the feature fusion model. The feature fusion model is used to fuse the parallel feature and the occupancy feature, so that the result of feature fusion is used as the parallel call feature of the task process. The parallel call features of each task process in the intelligent terminal can be obtained through the above method.

[0054] It should be noted that, in this application, the parallel call feature is a composite feature vector used to quantify the intensity of interaction between task processes; the call information is a metadata set that records the details of the interaction between the task process and the operating system; the resource occupancy information is a set of indicators that quantify the degree of hardware resource consumption by the task process; the parallel feature is an abstract pattern that reveals the temporal correlation between multiple task processes, and the parallel feature characterizes the law of collaborative behavior; the occupancy feature is a statistic that describes the abnormality of resource allocation, and the occupancy feature identifies non-competitive occupancy behavior; the feature fusion model is a multi-source feature integration framework based on deep learning, which automatically learns the nonlinear correlation between parallel features and occupancy features through neural networks. The feature fusion model uses an attention mechanism to dynamically assign feature weights, performs cross-modal interaction calculations in the feature embedding space, and finally outputs a compact feature vector that integrates the spatiotemporal dimensions. This vector can comprehensively characterize the parallel collaboration mode and resource contention relationship between processes, and provide highly discriminative feature representations for subsequent threat detection.

[0055] In some embodiments, determining the threat behavior sequence of the parallel task processes in the smart terminal through the communication relationship between each parallel call feature and the task processes in the smart terminal can be achieved by using the following steps:

[0056] Determine the temporal correlation score of the parallel task process in the intelligent terminal by using the parallel features in each parallel call feature;

[0057] Determine the resource contention abnormality of the parallel task processes in the intelligent terminal through the occupancy features in each parallel call feature;

[0058] Determining the credibility of the communication relationship between the parallel task processes in the intelligent terminal through the communication relationship between the task processes in the intelligent terminal;

[0059] The time sequence correlation score, the resource competition abnormality degree and the communication relationship credibility are weightedly integrated to obtain the threat behavior sequence of the parallel task process in the intelligent terminal.

[0060] It should be noted that, in this application, the threat behavior sequence; the timing correlation score is a quantitative indicator to measure the deviation of the task process behavior from the normal pattern in the time dimension, and the timing correlation score reflects the time characteristics of the potential attack; the resource competition anomaly degree indicates the abnormal degree of hardware resource occupation by the task process, and the resource competition anomaly degree can be used to detect covert attacks; the communication relationship credibility is to evaluate the security level of the communication behavior between task processes, and the communication relationship credibility can be used to identify illegal data exchange or authority abuse.

[0061] In the specific implementation, first, for each task process in the parallel task process, a dynamic time warping algorithm is used to compare the matching degree of the parallel features in the parallel call features of the task process with the known attack pattern library, and the deviation in the time dimension is calculated. At the same time, a hidden Markov model is introduced to analyze the transition probability of the task process execution phase, evaluate whether the behavior of the task process conforms to the normal task scheduling rules, and finally output a standardized score in the range of 0-1. This standardized score is used as the temporal correlation of the task process. Through the above method, the temporal correlation of each task process in the parallel task process can be obtained, and the set of all temporal correlations is used as the temporal correlation score of the parallel task process in the intelligent terminal. The higher the value of the temporal correlation score, the greater the possibility of temporal anomaly. Secondly, the isolation forest algorithm is used to identify outliers of each task process from the resource occupancy features. The mutation rate of resource occupancy in each outlier is calculated by combining sliding window statistics. The task process corresponding to the outlier with a mutation rate greater than the preset mutation threshold is screened out from all outliers as the abnormal task process. The set of mutation rates of all abnormal task processes is used as the resource contention anomaly degree of the parallel task process in the intelligent terminal.

[0062] Then, in the specific implementation, for each task process, the initial credibility score of the task process is obtained, and the communication data packets between the task processes are parsed to check the certificate chains, signatures and permission tags of the communicating parties. If it is found that an unauthorized task process attempts to access a highly sensitive interface or the communication content contains malicious payloads, the initial credibility score is reduced, and the reduced initial score is used as the credibility score of the task process. The credibility score of each task process can be obtained in the above manner, and the set of all credibility scores is used as the value range of the communication relationship credibility, and the communication relationship credibility of the parallel task processes in the smart terminal can be obtained; finally For each parallel task process in the intelligent terminal, the dynamic weights of the timing correlation, resource competition anomaly, and communication relationship credibility in the task process are set based on historical experience. The weighted sum of the timing correlation, resource competition anomaly, and communication relationship credibility is calculated as the comprehensive threat score of the task process. If the comprehensive threat score exceeds the adaptive threshold (initial value 1.2, adjusted with the environment), the task process is determined to constitute a threatening behavior. Through the above method, all threat behaviors can be obtained, and then all threat behaviors are arranged from large to small according to the comprehensive threat score as the threat behavior sequence of the parallel task processes in the intelligent terminal.

[0063] In step 103, each threat behavior in the threat behavior sequence is reversely traced and located according to the smart terminal attack tracing module to obtain multiple attack dependency nodes of the threat behavior in the smart terminal, and then a threat map of the attack link is generated through all the attack dependency nodes.

[0064] In some embodiments, the smart terminal attack tracing module performs reverse tracing and dependency positioning on each threat behavior in the threat behavior sequence to obtain multiple attack dependency nodes of the threat behavior in the smart terminal. The following steps can be used to achieve this:

[0065] For each threat behavior, a data dependency graph across task processes is constructed starting from the trigger point of the threat behavior.

[0066] Marking the likelihood value of each execution node of the threat behavior in the smart terminal through the data dependency graph;

[0067] Each likelihood value is used to filter out the attack-dependent nodes of the threat behavior from the smart terminal, and then obtain the attack-dependent nodes of each threat behavior.

[0068] In the specific implementation, first, for each threat behavior, the current execution node of the threat behavior is used as the trigger point of the threat behavior. Starting from the trigger point of the threat behavior, the data flow propagation path is traced backwards, recording the variable transfer between task processes, shared memory modifications, and communication relationships between cross-task processes. By combining static analysis (for example, control flow graph parsing) with dynamic instrumentation (for example, runtime taint tracking), a weighted directed graph is constructed. The nodes of the weighted directed graph represent key data operations (for example, file reading and writing, network requests), and the edges of the weighted directed graph represent data dependencies (for example, parameter transfer, return value impact). , thereby using the weighted directed graph as a data dependency graph for cross-task processes; then, a Bayesian inference model based on a neural network is initialized, and the context anomaly, data source credibility, and historical behavior baseline are used as influencing factors in the Bayesian inference model. The Bayesian inference model is used to quantify the attack likelihood of each execution node of the threat behavior, and the quantified result is used as the likelihood value of each execution node of the threat behavior in the smart terminal; finally, the execution node with a likelihood value greater than the preset vulnerability threshold is used as the attack dependency node of the threat behavior. The attack dependency node of each threat behavior can be obtained through the above method.

[0069] It should be noted that in this application, the attack dependency node is an indispensable key operation point in the attack chain, and the attack dependency node can be removed or repaired to block the execution of the attack; the data dependency graph is a directed graph used to describe the cross-process data flow relationship in the threat behavior, which can be used to visualize the attack path; the likelihood value is a probability indicator that quantifies the degree of association between a specific operation node and the attack; the Bayesian reasoning model is an intelligent analysis framework based on probability statistics, which dynamically learns the joint probability distribution of features such as context anomaly, data source credibility and historical behavior baseline through a neural network. The Bayesian reasoning model is based on prior knowledge and real-time observation data, and uses Bayes' theorem to recursively update the posterior probability of each execution node, integrating multi-dimensional security indicators into a standardized likelihood value in the range of 0-1, which quantitatively reflects the risk of the node being exploited by the attack, where the higher the value, the more critical the node is in the attack chain.

[0070] In some embodiments, a threat graph of the attack chain is generated by all attack dependent nodes, referring to Figure 2 As shown in FIG, this figure is a schematic diagram of the process of determining the threat map in some embodiments of the present application. In this embodiment, determining the threat map can be implemented by the following steps:

[0071] In step 1031, the tracing path of each attack-dependent node is obtained, and then the propagation delay of each tracing path is determined;

[0072] In step 1032, a threat map of the attack link is determined through all the tracing paths and each propagation delay.

[0073] In the specific implementation, first, for each attack-dependent node, starting from the attack-dependent node, forward and reverse tracing is performed along the edge of the data dependency graph, and the complete data flow path is recorded as the tracing path of the attack-dependent node. The tracing path of each attack-dependent node can be obtained in the above manner. For each tracing path, the delay difference between adjacent nodes in the tracing path is obtained from the record file of the smart terminal, and the sum of the absolute values of all delay differences is used as the propagation delay of the tracing path. The propagation delay of each tracing path can be obtained in the above manner; then, a graph adjustment model based on delay weighting is initialized, and the initial graph of the attack link is obtained from the console of the smart terminal as the adjustment target in the graph adjustment model, and each propagation delay is used as the adjustment weight in the graph adjustment model. The graph adjustment model is used to mark the conversion efficiency of the attack stage in the initial graph, so that the initial graph marked by the graph adjustment model is used as the threat graph of the attack link.

[0074] It should be noted that in this application, the threat graph is a topological structure of a visualized attack link, which contains node relationships and delay characteristics; the tracing path refers to the data control flow propagation trajectory between attack-dependent nodes, and the tracing path can be used to restore the attack steps; the propagation delay represents the execution time difference of the attack behavior between adjacent nodes in the path; the graph adjustment model is a computational framework for dynamically optimizing the visualization of the attack link, which automatically adjusts the topological structure of the threat graph by quantifying the influence weight of the propagation delay on the attack stage transition. The graph adjustment model takes the initial attack graph as input, converts the delay data into edge weight coefficients, and uses graph neural networks to reduce noise and strengthen high-latency paths, while compressing low-latency redundant nodes. The final output can intuitively reflect the optimized graph of the key path of attack efficiency, where the node spacing is proportional to the time consumed in the attack stage, and the edge thickness represents the strength of cross-stage dependency.

[0075] In step 104, a hotfix for the threat behavior in the smart terminal is automatically generated using the threat map, and then the vulnerability is repaired by differentially updating the hotfix without affecting the normal service of the smart terminal.

[0076] It should be noted that, in this application, a hot patch refers to a runtime vulnerability repair code unit that can take effect without restarting, and the hot patch is used to maintain service continuity; in specific implementation, the graph analysis engine of the smart terminal can be used to parse the attack dependency nodes in the threat graph, locate the specific location of the vulnerability (for example: the memory address with an out-of-bounds write vulnerability, the function entry with unchecked parameters), and match the vulnerability type with a predefined repair strategy library (for example: memory protection strategy, permission verification strategy). Binary rewriting technology is used to insert jump instructions at the target function entry to redirect the execution flow to a secure memory area, which contains the newly generated patch code while retaining the functional integrity of the original function. The patch code in the secure memory area is used as a hot patch, and the byte-level difference between the patch and the original code is calculated through the differential update engine to generate a lightweight incremental patch package. The dynamic link library hot loading mechanism provided by the operating system is used to replace the target code page in the memory while the process is running, and the thread safety of the update process is ensured through atomic operations.

[0077] In addition, in another aspect of the present application, in some embodiments, the present application provides an anti-attack system for improving the security of a smart terminal, the anti-attack system for improving the security of a smart terminal includes an anti-attack unit, Figure 3 , which is a schematic diagram of the structure of an anti-attack unit according to some embodiments of the present application. The anti-attack unit includes: a collection module 201, a processing module 202 and an execution module 203, which are described as follows:

[0078] The acquisition module 201 in this application is mainly used to build a behavior monitoring engine in the kernel layer of the intelligent terminal, and use the behavior monitoring engine to collect the behavior data stream of the parallel task process in the intelligent terminal;

[0079] Processing module 202, in this application, is used to extract the parallel call features of each task process in the smart terminal from the behavior data stream, and then determine the threat behavior sequence of the parallel task processes in the smart terminal based on the communication relationship between each parallel call feature and the task processes in the smart terminal;

[0080] It should be noted that the processing module 202 is further configured to perform reverse tracing and dependency positioning of each threat behavior in the threat behavior sequence according to the smart terminal attack tracing module, obtain multiple attack dependency nodes of the threat behavior in the smart terminal, and then generate a threat map of the attack chain through all the attack dependency nodes;

[0081] Execution module 203, in this application, execution module 203 is mainly used to use the threat map to automatically generate a hot patch for threat behavior in the smart terminal, and then repair the vulnerability by differentially updating the hot patch without affecting the normal service of the smart terminal.

[0082] The above describes in detail the examples of the anti-attack method and system for improving the security of smart terminals provided by the embodiments of the present application. It can be understood that, in order to implement the above functions, the corresponding device includes a hardware structure and / or software module corresponding to the execution of each function. It should be easily appreciated by those skilled in the art that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software driven hardware manner depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0083] In some embodiments, the present application also provides a computer device, which includes a memory and a processor, the memory is used to store computer programs, and the processor is used to call and run the computer programs from the memory, so that the computer device executes the above-mentioned anti-attack method for improving the security of smart terminals.

[0084] In some embodiments, reference Figure 4 The dotted line in the figure indicates that the unit or module is optional. The figure is a structural diagram of a computer device for implementing an anti-attack method for improving the security of a smart terminal according to an embodiment of the present application. The anti-attack method for improving the security of a smart terminal in the above embodiment can be achieved by Figure 4 The computer device shown in the figure is implemented, and the computer device includes at least one processor 301, a memory 302 and at least one communication unit 305. The computer device can be a terminal device, a server or a chip.

[0085] The processor 301 may be a general-purpose processor or a dedicated processor. For example, the processor 301 may be a central processing unit (CPU), which may be used to control the computer device, execute software programs, and process data from the software programs. The computer device may also include a communication unit 305 for inputting (receiving) and outputting (transmitting) signals.

[0086] For example, the computer device may be a chip, the communication unit 305 may be an input and / or output circuit of the chip, or the communication unit 305 may be a communication interface of the chip, and the chip may be a component of a terminal device, a network device, or other device.

[0087] For another example, the computer device may be a terminal device or a server, and the communication unit 305 may be a transceiver of the terminal device or the server, or the communication unit 305 may be a transceiver circuit of the terminal device or the server.

[0088] The computer device may include one or more memories 302, on which a program 304 is stored. The program 304 can be executed by the processor 301 to generate instructions 303, so that the processor 301 executes the method described in the above method embodiment according to the instructions 303. Optionally, data (such as a target audit model) can also be stored in the memory 302. Optionally, the processor 301 can also read data stored in the memory 302. The data can be stored at the same storage address as the program 304, or at a different storage address from the program 304.

[0089] The processor 301 and the memory 302 may be provided separately or integrated together, for example, integrated on a system on chip (SOC) of a terminal device.

[0090] It should be understood that each step of the above method embodiment can be completed by a hardware-based logic circuit or software-based instructions in the processor 301. The processor 301 can be a CPU, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, such as discrete gates, transistor logic devices, or discrete hardware components.

[0091] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0092] For example, in some embodiments, the present application also provides a computer-readable storage medium, which stores instructions or codes. When the instructions or codes are run on a computer, the computer implements the above-mentioned anti-attack method for improving the security of smart terminals.

[0093] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0094] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for improving the security of intelligent terminals against attacks, characterized in that: The steps include: Building a behavior monitoring engine in the kernel layer of the intelligent terminal, and using the behavior monitoring engine to collect behavior data streams of parallel task processes in the intelligent terminal; Extracting parallel call features of each task process in the smart terminal from the behavior data stream, and then determining the threat behavior sequence of the parallel task process in the smart terminal through the communication relationship between each parallel call feature and the task process in the smart terminal; The smart terminal attack tracing module performs reverse tracing and dependency positioning on each threat behavior in the threat behavior sequence to obtain multiple attack dependency nodes of the threat behavior in the smart terminal, and then generates a threat map of the attack chain through all the attack dependency nodes; Automatically generate hotfixes for threat behaviors in smart terminals using the threat map, and then repair vulnerabilities by differentially updating the hotfixes without affecting normal services of the smart terminals; The method of determining the threat behavior sequence of the parallel task processes in the smart terminal through the communication relationship between each parallel call feature and the task processes in the smart terminal specifically includes: Determine the temporal correlation score of the parallel task process in the intelligent terminal by using the parallel features in each parallel call feature; Determine the resource contention abnormality of the parallel task processes in the intelligent terminal through the occupancy features in each parallel call feature; Determining the credibility of the communication relationship between the parallel task processes in the intelligent terminal through the communication relationship between the task processes in the intelligent terminal; Performing weighted fusion on the time sequence correlation score, the resource competition abnormality degree, and the communication relationship credibility, thereby obtaining a threat behavior sequence of the parallel task process in the intelligent terminal; The threat map of the attack chain generated through all attack dependent nodes specifically includes: Obtain the tracing path of each attack-dependent node, and then determine the propagation delay of each tracing path; The threat map of the attack link is determined through all tracking paths and each propagation delay.

2. The method according to claim 1, wherein Extracting the parallel call features of each task process in the intelligent terminal from the behavior data stream specifically includes: For each task process in the intelligent terminal, the calling information and resource occupancy information of the task process are obtained from the behavior data stream; extracting parallel features from the call information and occupancy features from the resource occupancy information; The parallel calling feature of the task process is determined by the parallel feature and the occupancy feature, and then the parallel calling feature of each task process in the intelligent terminal is obtained.

3. The method according to claim 1, wherein The smart terminal attack tracing module performs reverse tracing and dependency positioning on each threat behavior in the threat behavior sequence, and obtains multiple attack dependency nodes of the threat behavior in the smart terminal, specifically including: For each threat behavior, starting from the trigger point of the threat behavior, a data dependency graph across task processes is constructed; Marking the likelihood value of each execution node of the threat behavior in the smart terminal through the data dependency graph; Each likelihood value is used to filter out the attack-dependent nodes of the threat behavior from the smart terminal, and then obtain the attack-dependent nodes of each threat behavior.

4. The method according to claim 1, wherein The behavior monitoring engine is a hybrid monitoring framework based on Linux.

5. The method according to claim 1, wherein The intelligent terminal is a heterogeneous computing platform based on a secure encryption engine and a multi-core processor.

6. An anti-attack system for improving the security of a smart terminal, configured to execute the anti-attack method for improving the security of a smart terminal according to any one of claims 1 to 5, the anti-attack system for improving the security of a smart terminal comprising an anti-attack unit, characterized in that: The anti-attack unit includes: A collection module is used to build a behavior monitoring engine in the kernel layer of the intelligent terminal, and use the behavior monitoring engine to collect behavior data streams of parallel task processes in the intelligent terminal; a processing module, configured to extract parallel call features of each task process in the smart terminal from the behavior data stream, and then determine a threat behavior sequence of the parallel task processes in the smart terminal based on the communication relationship between each parallel call feature and the task processes in the smart terminal; The processing module is further configured to perform reverse tracing and dependency positioning of each threat behavior in the threat behavior sequence according to the smart terminal attack tracing module, obtain multiple attack dependency nodes of the threat behavior in the smart terminal, and then generate a threat map of the attack chain through all the attack dependency nodes; An execution module is used to automatically generate a hot patch for threat behavior in the smart terminal using the threat map, and then repair the vulnerability by differentially updating the hot patch without affecting the normal service of the smart terminal.

7. A computer device, characterized in that: The computer device includes a memory and a processor, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the computer device executes the anti-attack method for improving the security of a smart terminal as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores instructions or codes, and when the instructions or codes are executed on a computer, the computer implements the anti-attack method for improving the security of a smart terminal according to any one of claims 1 to 5.

Images