Android terminal multi-level collaborative network security defense system and method

Abstract

The invention discloses a multi-level collaborative network security defense system and method for an Android terminal, and relates to the technical field of network security, the system comprises an active defense module which is responsible for actively identifying potential attacks and timely taking blocking measures through preposed threat intelligence collection, behavior monitoring and anomaly detection; the passive defense module is started immediately when the active defense module fails to completely defend the attack, and is responsible for reducing attack hazards by means of vulnerability repair, system reinforcement, data backup and recovery and user notification and guaranteeing system security and data integrity; and the feedback and optimization module is responsible for providing a basis for optimization of the active defense module and the passive defense module through deep analysis of various information and user feedback in the active defense and passive defense processes, and promoting continuous iteration upgrading of the whole system. According to the method, various network attacks can be effectively resisted, and the system security and data integrity of the Android terminal are guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and specifically to an Android terminal multi-level collaborative network security defense system and method. Background Art

[0002] In today's digital age, Android terminals have become an important part of the cloud terminal device field due to their extensive user base and open ecosystem. However, with the deep penetration of mobile Internet applications and the iterative upgrade of network attack technologies, Android terminals are facing increasingly severe security threats. Attack events such as malware intrusion, data leakage, and privilege abuse occur frequently, seriously threatening user privacy security and business continuity. Traditional network security technologies have exposed many deficiencies in dealing with these threats.

[0003] At the attack detection level, traditional methods mostly rely on static code analysis technologies, which can only check the static structure, syntax rules, and known vulnerability characteristics of program codes. For example, by scanning the code for defects in fixed patterns such as hard-coded passwords and unclosed debugging interfaces, but they cannot capture security vulnerabilities generated during program runtime. In actual application scenarios, runtime threats such as dynamic privilege abuse and memory injection attacks occur frequently - malicious programs may take advantage of system privilege management vulnerabilities during runtime to illegally obtain operation permissions beyond the authorized scope; or inject malicious code into the memory space to tamper with the program execution logic. These dynamic attack behaviors have a high degree of concealment and real-time variability, beyond the detection capabilities of static analysis technologies.

[0004] In terms of defense measures, traditional security protection systems exhibit passivity and singularity. When an attack behavior is detected, existing solutions often can only take simple blocking measures, such as blocking the attack source IP and closing the affected service ports, lacking proactive defense and multi-level response strategies. This passive defense mode cannot effectively deal with complex and variable attack means, neither can it predict potential threats in advance and take preventive measures, nor can it dynamically optimize and adjust defense strategies after an attack occurs, resulting in serious deficiencies in the protection capabilities of terminal devices when facing new or persistent attacks, and it is difficult to ensure the network security and data asset security of cloud terminal devices. Summary of the Invention

[0005] In view of the requirements and deficiencies in the current technology development, the present invention provides an Android terminal multi-level collaborative network security defense system and method.

[0006] In the first aspect, the present invention provides an Android terminal multi-level collaborative network security defense system, and the technical solutions adopted to solve the above technical problems are as follows:

[0007] An Android terminal multi-level collaborative network security defense system, which includes:

[0008] An active defense module, responsible for actively identifying potential attacks through pre-emptive threat intelligence collection, behavior monitoring and anomaly detection, and taking blocking measures in a timely manner;

[0009] A passive defense module, which is immediately activated when the active defense module fails to fully resist the attack, and is responsible for reducing the harm of the attack through means such as vulnerability repair, system strengthening, data backup and recovery, and notifying the user, to ensure system security and data integrity;

[0010] A feedback and optimization module, which runs through the whole process of active defense and passive defense, and is responsible for deeply analyzing various types of information and user feedback in the process of active defense and passive defense, providing a basis for the optimization of the active defense module and the passive defense module, and promoting the continuous iteration and upgrade of the entire system, so as to more effectively respond to the constantly changing network security threats.

[0011] Optionally, the active defense module specifically includes a threat intelligence collection and analysis unit, a behavior monitoring and anomaly detection unit, and an active blocking and counterattack unit, where:

[0012] The threat intelligence collection and analysis unit continuously obtains the latest attack methods, malware samples and vulnerability intelligence by docking multi-channel data sources, and uses natural language processing and data mining technologies to clean, classify and correlate the collected intelligence, and accurately extracts three key information: attack characteristics, attack source distribution and attack trend prediction, providing data support for the formulation of defense strategies;

[0013] The behavior monitoring and anomaly detection unit monitors the running behavior, network traffic behavior and user operation behavior of applications on the Android terminal in real time, and builds a normal behavior baseline based on historical behavior data with the help of machine learning algorithms. Once the monitored behavior deviates from the baseline, the system immediately triggers an alarm to identify potential attack signs;

[0014] When an attack behavior is detected, the active blocking and counterattack unit is quickly activated to perform at least one of the operations of disconnecting the network, closing the suspicious application and restricting the preset permissions, and record the corresponding information.

[0015] Further optionally, when an attack behavior is detected, the active blocking and counterattack unit is quickly activated to perform a network disconnection operation, including: immediately cutting off the connection between the threatened terminal and the external network, and at the same time recording the disconnection time, the current network connection status, and the affected network service information, to prevent the attacker from further stealing data or expanding the attack scope;

[0016] When an attack behavior is detected, the active blocking and counterattack unit is quickly activated to close suspicious applications, including: by identifying malicious processes and abnormally running applications, forcibly terminating their operation, and recording in detail the application name, process ID, shutdown time, and application behavior log information to prevent malicious code from continuing to execute;

[0017] When an attack behavior is detected, the active blocking and counterattack unit is quickly activated to restrict preset permissions, including: for sensitive permissions such as camera, microphone, address book, and file access, dynamically adjusting the permission allocation strategy according to the attack type and risk assessment results, and recording the time, object of permission adjustment, and permission status before and after adjustment at the same time, reducing the risk of attackers using permission vulnerabilities to carry out attacks.

[0018] Optionally, the involved passive defense module specifically includes a vulnerability repair unit, a system strengthening unit, a data backup and recovery unit, and a user notification unit, where:

[0019] The vulnerability repair unit is responsible for evaluating the severity of vulnerabilities when the system detects vulnerabilities in application programs or system components, determining the repair priority in combination with the exploitation difficulty and impact scope of the vulnerabilities; for publicly known vulnerabilities, the vulnerability repair unit automatically downloads the corresponding patch package from the official channel and installs it silently during the device idle period, and backs up the system key files at the same time to avoid system failures caused by patch installation; for zero-day vulnerabilities for which no solution has been made public, the vulnerability repair unit will temporarily take avoidance measures until the official release of the repair solution;

[0020] The system strengthening unit is responsible for enhancing the system security of Android terminals by setting up security access controls and strengthening encryption mechanisms;

[0021] The data backup and recovery unit is responsible for regularly performing full or incremental backups of the user's important data, and the backup data is stored in a local secure storage device or a cloud encrypted storage space; when the terminal is attacked and data is lost or damaged, the user can quickly restore the corresponding version of the data according to the backup timestamp through the data backup and recovery unit, thereby reducing business interruptions and losses caused by data loss;

[0022] The user notification unit is responsible for establishing effective communication with the user, and is responsible for pushing a detailed attack report to the user at the first time of an attack event, including information such as the attack type, attack occurrence time, affected system components or application programs, and possible impacts; at the same time, it is responsible for providing clear operation guidelines to guide the user to participate in the security protection process and improve the overall defense effect.

[0023] Optionally, the involved feedback and optimization module specifically includes a recording and analysis unit and an optimized defense unit, where:

[0024] The recording and analysis unit is responsible for comprehensively collecting the network disconnection information, application shutdown records, and permission restriction logs of the active defense module, the vulnerability repair records, system hardening configuration changes, and data backup and recovery details of the passive defense module, as well as the attack reports pushed to users at the first time when an attack event occurs. Using big data analysis and visualization technologies, it deeply mines the collected data, quantitatively evaluates from multiple dimensions such as the effectiveness of defense measures, response timeliness, and resource occupancy, and identifies the weak links in the defense system;

[0025] The optimization defense unit is responsible for optimizing and adjusting the active defense module and the passive defense module according to the analysis and evaluation results of the recording and analysis unit, further improving the passive defense and active defense measures, and enhancing the security protection ability of the Android terminal.

[0026] In a second aspect, the present invention provides a multi-level collaborative network security defense method for Android terminals. The technical solutions adopted to solve the above technical problems are as follows:

[0027] A multi-level collaborative network security defense method for Android terminals, which includes the following steps:

[0028] S1. Through prepositional threat intelligence collection, behavior monitoring, and anomaly detection, actively identify potential attacks and promptly take blocking measures;

[0029] S2. When the active defense in step S1 fails to fully resist the attack, immediately start passive defense, and reduce the attack harm through means such as vulnerability repair, system hardening, data backup and recovery, and notifying users, to ensure network security and data integrity;

[0030] S3. Deeply analyze various types of information and user feedback in the active defense and passive defense processes, provide a basis for the optimization of active defense and passive defense, and promote the continuous iteration and upgrade of defense measures, so as to more effectively respond to the ever-changing network security threats.

[0031] Optionally, the specific steps of step S1 include operations at three levels: threat intelligence collection and analysis, behavior monitoring and anomaly detection, and active blocking and counterattack. Among them:

[0032] In the aspect of threat intelligence collection and analysis, by docking with multi-channel data sources, continuously obtain the latest attack means, malware samples, and vulnerability intelligence, and use natural language processing and data mining technologies to clean, classify, and correlate and analyze the collected intelligence, and accurately extract three key pieces of information: attack characteristics, attack source distribution, and attack trend prediction, to provide data support for the formulation of active defense strategies;

[0033] At the level of behavior monitoring and anomaly detection, the running behaviors, network traffic behaviors, and user operation behaviors of applications on Android terminals are monitored in real time. With the help of machine learning algorithms, a normal behavior baseline is constructed based on historical behavior data. Once the monitored behavior deviates from the baseline, an early warning is immediately triggered to identify potential signs of attack;

[0034] When an attack behavior is detected, the active blocking and counterattack level is quickly activated, and at least one of the operations of disconnecting the network, closing suspicious applications, and restricting preset permissions is executed, and the corresponding information is recorded.

[0035] Further optionally, when an attack behavior is detected, the active blocking and counterattack level is quickly activated to execute a network disconnection operation, including: immediately cutting off the connection between the threatened terminal and the external network, and at the same time recording the network disconnection time, the current network connection status, and the affected network service information to prevent the attacker from further stealing data or expanding the attack scope;

[0036] When an attack behavior is detected, the active blocking and counterattack level is quickly activated to close suspicious applications, including: by identifying malicious processes and abnormally running application programs, forcibly terminating their operations, and detailedly recording the application name, process ID, closing time, and application behavior log information to prevent malicious code from continuing to execute;

[0037] When an attack behavior is detected, the active blocking and counterattack level is quickly activated to restrict preset permissions, including: for sensitive permissions such as cameras, microphones, address books, and file access, according to the attack type and risk assessment results, dynamically adjust the permission allocation strategy, and at the same time record the time, object of permission adjustment, and the permission status before and after adjustment to reduce the risk of attackers using permission vulnerabilities to carry out attacks.

[0038] Optionally, step S2 is executed. When the active defense fails to completely resist the attack, the passive defense is immediately activated, and the attack harm is reduced by means of vulnerability repair, system hardening, data backup and recovery, and notifying users to ensure network security and data integrity, where:

[0039] When a vulnerability is detected in an application program or system component, a vulnerability repair operation is executed. The severity of the vulnerability is evaluated, and the repair priority is determined by combining the exploitation difficulty and impact scope of the vulnerability; for publicly known vulnerabilities, the corresponding patch package is automatically downloaded from the official channel and silently installed during the device idle period, and at the same time, the system key files are backed up to avoid system failures caused by patch installation; for zero-day vulnerabilities for which no solution has been publicly released, temporary avoidance measures are taken until the official release of the repair solution;

[0040] Execute the system hardening operation to improve the system security of the Android terminal by setting up security access control and strengthening the encryption mechanism;

[0041] Perform data backup and recovery operations, regularly perform full or incremental backups of users' important data, and store the backup data in local secure storage devices or encrypted cloud storage spaces; when the terminal is attacked and data is lost or damaged, the user performs data backup and recovery operations, and can quickly recover by selecting the corresponding version of the data according to the backup timestamp, thereby reducing business interruptions and losses caused by data loss;

[0042] Perform the operation of notifying the user, establish effective communication with the user, and be responsible for pushing a detailed attack report to the user at the first time of the attack event, including attack type, attack occurrence time, affected system components or applications, and possible impacts; at the same time, be responsible for providing clear operation guidelines to guide the user to participate in the security protection process and improve the overall defense effect.

[0043] Optionally, the specific steps involved in step S3 include:

[0044] Comprehensively collect the network disconnection information, application shutdown records, and permission restriction logs in the active defense process, the vulnerability repair records, system hardening configuration changes, and data backup and recovery details in the passive defense process, as well as the attack report pushed to the user at the first time of the attack event, and use big data analysis and visualization technologies to deeply mine the collected data and quantitatively evaluate it from multiple dimensions such as the effectiveness of defense measures, response timeliness, and resource occupancy to identify weak links in the defense system;

[0045] According to the analysis and evaluation results, optimize and adjust the active defense process and passive defense process, further improve the passive defense and active defense measures, and improve the security protection ability of the Android terminal.

[0046] A multi-level collaborative network security defense system and method for an Android terminal according to the present invention has the following beneficial effects compared with the prior art:

[0047] 1. In the active defense process of the present invention, through threat intelligence collection, behavior monitoring and anomaly detection, potential threats can be identified in advance before an attack occurs, and attack behaviors can be actively blocked; in the passive defense process, after the attack breaks through the active defense, operations such as vulnerability repair, system hardening, and data backup and recovery are performed in a timely manner to reduce the damage caused by the attack; the two cooperate with each other to form an all-round protection system from attack prevention to attack response, effectively resisting various network attacks and ensuring the security of the Android terminal system and data integrity;

[0048] 2. The active defense process of the present invention. The real-time monitoring and active blocking of the active defense module, combined with the rapid response mechanism of the passive defense process, can make a dynamic and timely response to attack behaviors. Facing different types and stages of attacks, corresponding defense measures can be quickly taken. When abnormal permission usage of an application is detected, the suspicious application can be promptly closed, greatly improving the response speed and processing efficiency for attacks;

[0049] 3. By deeply analyzing various types of information generated during the active defense and passive defense processes and user feedback, the present invention identifies problems and deficiencies in the defense system; based on the analysis results, the defense strategy is optimized and adjusted, continuously improving the functions and performance of the active defense measures and passive defense measures; this mechanism of continuous optimization and iteration enables the entire defense system to adapt to constantly changing network security threats and always maintain high-efficiency protection capabilities;

[0050] 4. By reducing the probability of attacks through active defense, reducing the impact caused by attacks using passive defense, and continuously improving the defense system with the help of feedback optimization, the present invention can significantly reduce the security risks faced by Android terminals, reduce losses such as data loss, service interruption, and privacy leakage caused by network attacks, and provide more reliable network security protection for users and enterprises. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Attached Figure 1 is a block diagram of module connections in Embodiment 1 of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0052] To make the technical solutions, technical problems solved, and technical effects of the present invention clearer and more understandable, the following describes the technical solutions of the present invention clearly and completely in combination with specific embodiments.

[0053] Embodiment 1:

[0054] Combined with Attached Figure 1 , this embodiment proposes a multi-level collaborative network security defense system for Android terminals, which includes:

[0055] An active defense module, responsible for actively identifying potential attacks through pre-emptive threat intelligence collection, behavior monitoring, and anomaly detection, and taking blocking measures in a timely manner;

[0056] A passive defense module, which is immediately activated when the active defense module fails to fully resist an attack, and is responsible for reducing the harm of the attack through means such as vulnerability repair, system hardening, data backup and recovery, and notifying the user, to ensure system security and data integrity;

[0057] The feedback and optimization module runs through the entire process of active defense and passive defense. It is responsible for deeply analyzing various types of information and user feedback during the active defense and passive defense processes, providing a basis for optimizing the active defense module and the passive defense module, promoting the continuous iteration and upgrade of the entire system, and thus more effectively coping with the ever-changing network security threats.

[0058] In this embodiment, the involved active defense module specifically includes a threat intelligence collection and analysis unit, a behavior monitoring and anomaly detection unit, and an active blocking and counterattack unit, where:

[0059] The threat intelligence collection and analysis unit continuously obtains the latest attack methods, malware samples, and vulnerability intelligence by docking with multiple data sources. Using natural language processing and data mining technologies, it cleans, classifies, and conducts correlation analysis on the collected intelligence, and accurately extracts three key pieces of information: attack characteristics, attack source distribution, and attack trend prediction, providing data support for the formulation of defense strategies;

[0060] The behavior monitoring and anomaly detection unit real-time monitors the running behavior, network traffic behavior, and user operation behavior of applications on Android terminals. With the help of machine learning algorithms, it constructs a normal behavior baseline based on historical behavior data. Once the monitored behavior deviates from the baseline, the system immediately triggers an alarm to identify potential attack signs;

[0061] When an attack behavior is detected, the active blocking and counterattack unit is quickly activated to perform at least one of the operations of disconnecting the network, closing suspicious applications, and restricting preset permissions, and record the corresponding information. Specifically:

[0062] (a) Performing a network disconnection operation, including: immediately cutting off the connection between the threatened terminal and the external network, while recording the disconnection time, the current network connection status, and the affected network service information, to prevent the attacker from further stealing data or expanding the attack scope;

[0063] (b) Closing suspicious applications, including: identifying malicious processes and abnormally running application programs, forcibly terminating their operations, and detailedly recording the application name, process ID, closing time, and application behavior log information to prevent malicious code from continuing to execute;

[0064] (c) Restricting preset permissions, including: for sensitive permissions such as cameras, microphones, address books, and file access, dynamically adjusting the permission allocation strategy according to the attack type and risk assessment results, while recording the time, object, and permission status before and after the permission adjustment to reduce the risk of the attacker using permission vulnerabilities to carry out attacks.

[0065] In this embodiment, the involved passive defense module specifically includes a vulnerability repair unit, a system strengthening unit, a data backup and recovery unit, and a user notification unit, where:

[0066] Vulnerability Repair Unit: When the system detects vulnerabilities in an application or system component, it is responsible for assessing the severity of the vulnerabilities, determining the repair priority by combining the exploitation difficulty and the scope of impact of the vulnerabilities; for publicly known vulnerabilities, the Vulnerability Repair Unit automatically downloads the corresponding patch package from the official channel and installs it silently during the idle period of the device, while backing up the critical system files to avoid system failures caused by patch installation; for zero-day vulnerabilities for which no solution has been publicly released, the Vulnerability Repair Unit will temporarily take avoidance measures until the official repair solution is released.

[0067] System Hardening Unit: Responsible for enhancing the system security of the Android terminal by setting up security access control and strengthening the encryption mechanism.

[0068] Data Backup and Recovery Unit: Responsible for regularly performing full or incremental backups of the user's important data, and storing the backup data in a local secure storage device or encrypted cloud storage space; when the terminal is attacked and data is lost or damaged, the user can quickly restore the corresponding version of the data through the Data Backup and Recovery Unit according to the backup timestamp, thus reducing business interruptions and losses caused by data loss.

[0069] User Notification Unit: Responsible for establishing effective communication with the user, and pushing a detailed attack report to the user at the first time of an attack event, including information such as the attack type, the time of attack occurrence, the affected system components or applications, and the possible impacts; at the same time, it is responsible for providing clear operation guidelines to guide the user to participate in the security protection process and improve the overall defense effect.

[0070] In this embodiment, the involved Feedback and Optimization Module specifically includes a Recording and Analysis Unit and an Optimization and Defense Unit, where:

[0071] Recording and Analysis Unit: Responsible for comprehensively collecting the network disconnection information, application shutdown records, and permission restriction logs of the Active Defense Module, the vulnerability repair records, system hardening configuration changes, and data backup and recovery details of the Passive Defense Module, as well as the attack report pushed to the user at the first time of an attack event, and using big data analysis and visualization techniques to deeply mine the collected data, and quantitatively evaluating from multiple dimensions such as the effectiveness of defense measures, response timeliness, and resource occupancy, to identify the weak links in the defense system.

[0072] Optimization and Defense Unit: Responsible for optimizing and adjusting the Active Defense Module and the Passive Defense Module according to the analysis and evaluation results of the Recording and Analysis Unit, further improving the passive defense and active defense measures, and enhancing the security protection ability of the Android terminal.

[0073] Embodiment 2:

[0074] Reference appendix Figure 1 , this embodiment proposes a multi-level collaborative network security defense method for Android terminals, which includes the following steps:

[0075] S1. Through pre-emptive threat intelligence collection, behavior monitoring and anomaly detection, actively identify potential attacks and take blocking measures in a timely manner.

[0076] The involved step S1 specifically includes operations at three levels: threat intelligence collection and analysis, behavior monitoring and anomaly detection, and active blocking and counterattack. Among them:

[0077] At the level of threat intelligence collection and analysis, by docking with multi-channel data sources, continuously obtain the latest attack means, malware samples and vulnerability intelligence, and use natural language processing and data mining technologies to clean, classify and correlate analyze the collected intelligence, and accurately extract three key information: attack characteristics, attack source distribution and attack trend prediction, providing data support for the formulation of active defense strategies;

[0078] At the level of behavior monitoring and anomaly detection, real-time monitor the running behavior, network traffic behavior and user operation behavior of applications on the Android terminal, and build a normal behavior baseline based on historical behavior data with the help of machine learning algorithms. Once the monitored behavior deviates from the baseline, immediately trigger an alarm to identify potential attack signs;

[0079] When an attack behavior is detected, the active blocking and counterattack level is quickly activated, and at least one of the operations of disconnecting the network, closing the suspicious application and restricting the preset permissions is executed, and the corresponding information is recorded; during this process:

[0080] (a) Execute the network disconnection operation, including: immediately cut off the connection between the threatened terminal and the external network, and at the same time record the disconnection time, the current network connection status, and the affected network service information to prevent the attacker from further stealing data or expanding the attack scope;

[0081] (b) Close the suspicious application, including: identify malicious processes and abnormally running application programs, forcefully terminate their running, and record in detail the application name, process ID, closing time, and application behavior log information to prevent malicious code from continuing to execute;

[0082] (c) Restrict the preset permissions, including: for sensitive permissions such as cameras, microphones, address books, and file access, dynamically adjust the permission allocation strategy according to the attack type and risk assessment results, and record the time, object, and permission status before and after the permission adjustment at the same time, reducing the risk of attackers using permission vulnerabilities to carry out attacks.

[0083] S2. When the active defense in step S1 fails to fully resist the attack, immediately initiate passive defense. Reduce the harm of the attack by means of vulnerability repair, system strengthening, data backup and recovery, and notifying users, so as to ensure network security and data integrity. During this process:

[0084] When a vulnerability is detected in an application or system component, perform a vulnerability repair operation, evaluate the severity of the vulnerability, and determine the repair priority in combination with the exploitation difficulty and impact scope of the vulnerability; for publicly known vulnerabilities, automatically download the corresponding patch package from the official channel and perform a silent installation during the idle period of the device, and at the same time back up the key system files to avoid system failures caused by patch installation; for zero-day vulnerabilities for which no solution has been made public, temporarily take avoidance measures until the official release of the repair solution;

[0085] Perform system strengthening operations to enhance the system security of Android terminals by setting up security access controls and strengthening encryption mechanisms;

[0086] Perform data backup and recovery operations, regularly perform full or incremental backups of the user's important data, and store the backup data in a local secure storage device or an encrypted cloud storage space; when the terminal is attacked and data is lost or damaged, the user performs a data backup and recovery operation, and can quickly recover by selecting the corresponding version of the data according to the backup timestamp, so as to reduce business interruptions and losses caused by data loss;

[0087] Perform the operation of notifying users, establish effective communication with users, and be responsible for pushing a detailed attack report to users at the first time of an attack event, including information such as the attack type, attack occurrence time, affected system components or applications, and possible impacts; at the same time, be responsible for providing clear operation guidelines to guide users to participate in the security protection process and improve the overall defense effect.

[0088] S3. Deeply analyze various information and user feedback in the active defense and passive defense processes, provide a basis for optimizing the active defense and passive defense, and promote the continuous iteration and upgrade of defense measures, so as to more effectively respond to the ever-changing network security threats; this process specifically includes:

[0089] Comprehensively collect the network disconnection information, application shutdown records, and permission restriction logs in the active defense process, the vulnerability repair records, system strengthening configuration changes, and data backup and recovery details in the passive defense process, as well as the attack reports pushed to users at the first time of an attack event. Use big data analysis and visualization technologies to deeply mine the collected data, and quantitatively evaluate from multiple dimensions such as the effectiveness of defense measures, response timeliness, and resource occupancy to identify the weak links in the defense system;

[0090] According to the analysis and evaluation results, optimize and adjust the active defense process and passive defense process, further improve the passive defense and active defense measures, and enhance the security protection ability of Android terminals.

[0091] In summary, by adopting the multi-level collaborative network security defense system and method for Android terminals of the present invention, an all-round protection system from attack prevention to attack response is formed, which can effectively resist various network attacks and ensure the security of the Android terminal system and data integrity.

[0092] The above specific application examples have elaborated in detail the principle and implementation manner of the present invention. These examples are only used to help understand the core technical content of the present invention. Based on the above specific embodiments of the present invention, any improvements and modifications made by those skilled in the art of this technology field without departing from the principle of the present invention shall fall within the scope of the patent protection of the present invention.

Claims

1. An Android terminal multi-level collaborative network security defense system, characterized in that, It includes: An active defense module, which is responsible for actively identifying potential attacks through pre - emptive threat intelligence collection, behavior monitoring, and anomaly detection, and taking blocking measures in a timely manner; A passive defense module, which is immediately activated when the active defense module fails to fully resist attacks. It is responsible for reducing the harm of attacks through means such as vulnerability repair, system hardening, data backup and recovery, and notifying users, to ensure system security and data integrity; A feedback and optimization module, which runs through the whole process of active defense and passive defense. It is responsible for deeply analyzing various types of information and user feedback in the process of active defense and passive defense, providing a basis for optimizing the active defense module and the passive defense module, and promoting the continuous iteration and upgrade of the entire system, so as to more effectively respond to the constantly changing network security threats.

2. The Android terminal multi-level collaborative network security defense system according to claim 1, characterized in that The active defense module specifically includes a threat intelligence collection and analysis unit, a behavior monitoring and anomaly detection unit, and an active blocking and counter - attack unit, where: The threat intelligence collection and analysis unit continuously obtains the latest attack methods, malware samples, and vulnerability intelligence by connecting to multiple data sources. Using natural language processing and data mining technologies, it cleans, classifies, and correlates the collected intelligence, and accurately extracts three key pieces of information: attack characteristics, attack source distribution, and attack trend prediction, providing data support for the formulation of defense strategies; The behavior monitoring and anomaly detection unit real - time monitors the running behavior, network traffic behavior, and user operation behavior of applications on the Android terminal. With the help of machine learning algorithms, it constructs a normal behavior baseline based on historical behavior data. Once the monitored behavior deviates from the baseline, the system immediately triggers an alarm to identify potential attack signs; When an attack behavior is detected, the active blocking and counter - attack unit is quickly activated to perform at least one of the operations of disconnecting the network, closing suspicious applications, and restricting preset permissions, and record the corresponding information.

3. The Android terminal multi-level collaborative network security defense system according to claim 2, characterized in that, When an attack behavior is detected, the active blocking and counter - attack unit is quickly activated to perform a network disconnection operation, including: immediately cutting off the connection between the threatened terminal and the external network, and at the same time recording the network disconnection time, the current network connection status, and the affected network service information, to prevent the attacker from further stealing data or expanding the attack scope; When an attack behavior is detected, the active blocking and counter - attack unit is quickly activated to close suspicious applications, including: identifying malicious processes and abnormally running application programs, forcibly terminating their operations, and detailedly recording the application name, process ID, closing time, and application behavior log information, to prevent malicious code from continuing to execute; When an attack behavior is detected, the active blocking and counter - attack unit is quickly activated to restrict preset permissions, including: for sensitive permissions such as the camera, microphone, address book, and file access, dynamically adjusting the permission allocation strategy according to the attack type and risk assessment results, and at the same time recording the time, object, and permission status before and after the permission adjustment, to reduce the risk of the attacker using permission vulnerabilities to carry out attacks.

4. An Android terminal multi-level collaborative network security defense system according to claim 3, characterized in that, The passive defense module specifically includes a vulnerability repair unit, a system hardening unit, a data backup and recovery unit, and a user notification unit, where: Vulnerability Repair Unit: When the system detects vulnerabilities in application programs or system components, it is responsible for evaluating the severity of the vulnerabilities, determining the repair priority by combining the exploitation difficulty and impact scope of the vulnerabilities; for publicly known vulnerabilities, the Vulnerability Repair Unit automatically downloads the corresponding patch packages from official channels and installs them silently during the device idle period, while backing up the system critical files to avoid system failures caused by patch installation; for zero-day vulnerabilities without publicly available solutions, the Vulnerability Repair Unit will temporarily take avoidance measures until the official release of the repair solution. System Hardening Unit: Responsible for enhancing the system security of Android terminals by setting up security access controls and strengthening encryption mechanisms. Data Backup and Recovery Unit: Responsible for regularly performing full or incremental backups of users' important data, and storing the backup data in local secure storage devices or encrypted cloud storage spaces; when the terminal is attacked and data is lost or damaged, users can quickly recover the corresponding version of the data through the Data Backup and Recovery Unit according to the backup timestamp, thus reducing business interruptions and losses caused by data loss. User Notification Unit: Responsible for establishing effective communication with users, and pushing detailed attack reports to users at the first time of an attack event, including information such as attack type, attack occurrence time, affected system components or application programs, and possible impacts; at the same time, it is responsible for providing clear operation guidelines to guide users to participate in the security protection process and improve the overall defense effect.

5. An Android terminal multi-level collaborative network security defense system according to claim 4, characterized in that, The feedback and optimization module specifically includes a recording and analysis unit and an optimized defense unit, where: Recording and Analysis Unit: Responsible for comprehensively collecting the network disconnection information, application shutdown records, and permission restriction logs of the active defense module, the vulnerability repair records, system hardening configuration changes, and data backup and recovery details of the passive defense module, as well as the attack reports pushed to users at the first time of an attack event, and using big data analysis and visualization technologies to deeply mine the collected data, and quantitatively evaluating from multiple dimensions such as the effectiveness of defense measures, response timeliness, and resource occupancy to identify weak links in the defense system. Optimized Defense Unit: Responsible for optimizing and adjusting the active defense module and the passive defense module according to the analysis and evaluation results of the Recording and Analysis Unit, further improving the measures of passive defense and active defense, and enhancing the security protection ability of Android terminals.

6. An Android terminal multi-level collaborative network security defense method, characterized in that, Including the following steps: S1: Actively identify potential attacks through pre-emptive threat intelligence collection, behavior monitoring, and anomaly detection, and take blocking measures in a timely manner. S2: Immediately start passive defense when the active defense in step S1 fails to fully resist the attack, and reduce the attack harm through means such as vulnerability repair, system hardening, data backup and recovery, and user notification to ensure network security and data integrity. S3: Deeply analyze various types of information and user feedback in the process of active defense and passive defense, provide a basis for the optimization of active defense and passive defense, and promote the continuous iteration and upgrade of defense measures, so as to more effectively respond to the ever-changing network security threats.

7. A multi-level collaborative network security defense method for an Android terminal according to claim 6, characterized in that, The specific steps of step S1 include operations at three levels: threat intelligence collection and analysis, behavior monitoring and anomaly detection, and active blocking and counterattack. Among them: At the level of threat intelligence collection and analysis, by connecting to multiple data sources, continuously obtain the latest attack methods, malware samples, and vulnerability intelligence. Using natural language processing and data mining technologies, clean, classify, and perform correlation analysis on the collected intelligence, and accurately extract three key pieces of information: attack characteristics, attack source distribution, and attack trend prediction, providing data support for the formulation of active defense strategies; At the level of behavior monitoring and anomaly detection, real-time monitor the running behavior, network traffic behavior, and user operation behavior of applications on the Android terminal. With the help of machine learning algorithms, build a normal behavior baseline based on historical behavior data. Once the monitored behavior deviates from the baseline, immediately trigger an alarm to identify potential attack signs; When an attack behavior is detected, the active blocking and counterattack level is quickly activated, and at least one of the operations of disconnecting the network, closing suspicious applications, and restricting preset permissions is performed, and the corresponding information is recorded.

8. A multi-level collaborative network security defense method for an Android terminal according to claim 7, characterized in that When an attack behavior is detected, the active blocking and counterattack level is quickly activated to perform a network disconnection operation, including: immediately cutting off the connection between the threatened terminal and the external network, and at the same time recording the network disconnection time, the current network connection status, and the affected network service information to prevent the attacker from further stealing data or expanding the attack scope; When an attack behavior is detected, the active blocking and counterattack level is quickly activated to close suspicious applications, including: identifying malicious processes and abnormally running application programs, forcibly terminating their operations, and detailedly recording the application name, process ID, closing time, and application behavior log information to prevent malicious code from continuing to execute; When an attack behavior is detected, the active blocking and counterattack level is quickly activated to restrict preset permissions, including: for sensitive permissions such as cameras, microphones, address books, and file access, dynamically adjust the permission allocation strategy according to the attack type and risk assessment results, and at the same time record the time, object of permission adjustment, and the permission status before and after adjustment to reduce the risk of attackers using permission vulnerabilities to carry out attacks.

9. A method for multi-level collaborative network security defense of an Android terminal according to claim 8, characterized in that Execute step S2. When the active defense fails to fully resist the attack, immediately activate the passive defense, and reduce the attack harm through means such as vulnerability repair, system hardening, data backup and recovery, and notifying users to ensure network security and data integrity. Among them: When a vulnerability in an application program or system component is detected, perform a vulnerability repair operation, evaluate the severity of the vulnerability, and determine the repair priority in combination with the exploitation difficulty and impact scope of the vulnerability; for publicly known vulnerabilities, automatically download the corresponding patch package from the official channel and perform a silent installation during the device idle period, and at the same time back up the key system files to avoid system failures caused by patch installation; for zero-day vulnerabilities for which no solution has been publicly released, temporarily take avoidance measures until the official release of the repair plan; Execute the system hardening operation to improve the system security of the Android terminal by setting up security access control and strengthening the encryption mechanism; Perform data backup and recovery operations, regularly perform full or incremental backups of users' important data, and store the backup data in local secure storage devices or encrypted cloud storage spaces; when the terminal is attacked and data is lost or damaged, the user performs data backup and recovery operations, and can quickly recover by selecting the corresponding version of the data according to the backup timestamp, thereby reducing business interruptions and losses caused by data loss; Perform the operation of notifying the user, establish effective communication with the user, and be responsible for pushing a detailed attack report to the user at the first time of the attack event, including information such as the attack type, the time of the attack, the affected system components or applications, and the possible impacts; at the same time, be responsible for providing clear operation guidelines to guide the user to participate in the security protection process and improve the overall defense effect.

10. A multi-level collaborative network security defense method for an Android terminal according to claim 9, characterized in that, The specific steps of step S3 include: Comprehensively collect the network disconnection information, application shutdown records, and permission restriction logs in the active defense process, the vulnerability repair records, system hardening configuration changes, and data backup and recovery details in the passive defense process, as well as the attack report pushed to the user at the first time of the attack event. Use big data analysis and visualization technologies to deeply mine the collected data, and conduct quantitative evaluations from multiple dimensions such as the effectiveness of defense measures, response timeliness, and resource occupancy to identify weak links in the defense system; According to the analysis and evaluation results, optimize and adjust the active defense process and passive defense process, further improve the passive defense and active defense measures, and improve the security protection ability of Android terminals.

Images