A software information security analysis system and method using artificial intelligence

Abstract

This invention discloses a software information security analysis system and method using artificial intelligence, belonging to the field of software information security analysis technology. The invention includes: S10: analyzing the dependency relationship between interactive data and external dependent data; S20: analyzing the real-time operational characteristics of the application software; S30: constructing a real-time security assessment model for application software information; S40: performing security governance on the application software information at the predicted security governance time. This invention normalizes the operational characteristics generated when the application software calls different external dependent modules by quantifying weights, and based on the distance deviation value between the operational characteristics of the application software at adjacent response times, it facilitates a clearer analysis of the real-time risk growth of application software information, thereby improving the system's real-time monitoring effect on application software information security.

Description

Technical Field

[0001] This invention relates to the field of software information security analysis technology, specifically a software information security analysis system and method that applies artificial intelligence. Background Technology

[0002] Software information security refers to a series of measures and methods to protect software and its related information resources from illegal and malicious intrusion, theft, tampering, damage, and misuse. Therefore, the continuous enhancement of software information security helps protect users' privacy rights and improves the stability and reliability of software.

[0003] Currently, security analysis of software information is achieved by analyzing the network traffic consumed by application software during runtime. However, minor abnormal network traffic is often difficult to detect, and even if it is detected, its various causes must be eliminated one by one, which reduces the effectiveness of real-time monitoring of application software information. Furthermore, existing technologies require the application software to run for a period of time before scanning results can be obtained, which poses certain security risks. Summary of the Invention

[0004] The purpose of this invention is to provide a software information security analysis system and method that applies artificial intelligence to solve the problems raised in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a software information security analysis method applying artificial intelligence, the method comprising:

[0006] S10: When the application software is running, track the application software's interaction data and external dependency data in real time, and analyze the dependency relationship between the interaction data and external dependency data;

[0007] S20: Analyze the real-time operating characteristics of the application software based on the dependency relationship between interactive data and external dependent data;

[0008] S30: Based on the quantification weight of the application software at each historical response moment, quantify the historical operating characteristics of the retrieved application software, and construct a real-time security assessment model for application software information based on the processing results.

[0009] S40: Perform security governance on application software information during the predicted security governance time.

[0010] Furthermore, S10 includes:

[0011] S101: External dependency data includes third-party libraries and components that the application software depends on, and interaction data includes user operation data and application software response data;

[0012] S102: Based on the input time t of the user operation data and the generation time w of the application software response data generated by the application software based on the user's input operation data at time t, the running time period of the application software [t, t+w] is obtained;

[0013] Within the runtime period [t, t+w], the similarity S between the theoretical response data of the application software generated from the tracked user operation data and the tracked application software response data is calculated. t→t+w Perform the calculation, if S t→t+w =1, then the traced external dependency data will be stored as a set of data in set M. If S t→t+w If the value is not 1, the interaction data and external dependency data obtained from the tracking will be stored as a set of data in set N.

[0014] S103: Based on the storage location of external dependency data, predict the dependency index between the interaction data and external dependency data tracked within the same running time period.

[0015] Predicting the dependencies between interactive data and external dependent data in application software can quickly analyze whether the third-party libraries and components called by the application software are the root cause of the leakage of application software information.

[0016] Furthermore, the specific method for predicting the dependency index between the interaction data and external dependency data tracked within the same running time period in S103 is as follows:

[0017] If the external dependency data tracked within the runtime period [t, t+w] is stored in set M, then the dependency index Y between the interaction data tracked within the runtime period [t, t+w] and the external dependency data tracked within the runtime period [t, t+w] is... t→t+w =1-f / w, where f represents the generation time of application response data generated by the application software based on user operation data, without affecting the performance of the application software, when the third-party libraries and components on which the application software depends are used.

[0018] If the external dependency data tracked within the runtime period [t, t+w] is stored in set N, then the dependency index Y between the interaction data tracked within the runtime period [t, t+w] and the external dependency data tracked within the runtime period [t, t+w] is... t→t+w =(1-f / w)×(1-S t→w ).

[0019] Furthermore, S20 includes:

[0020] S201: When Y t→t+wWhen =1-f / w, the third-party library in the external dependency data tracked within the runtime period [t,t+w] is denoted as library A and the component as component B;

[0021] The number of vulnerabilities U in library A / component B at time t At / U Bt When library A / component B is invoked and executed at time t, the number of permissions Q required by the application software to display the functions based on user operation data exceeds the limit. At / Q Bt And the maintenance status value W of library A / component B at time t. At / W Bt To retrieve data, when library A / component B is maintained within the time period [td,t], W... At =0 / W Bt =0, when library A / component B is not maintained during the time period [td,t], W At =1 / W Bt =1;

[0022] According to R (t+w)A =a1×U At +a2×Q At +a3×W At Calculate the characteristic value of the risk impact of library A on the application software at time t+w;

[0023] According to R (t+w)B =a4×U Bt +a5×Q Bt +a6×W Bt The risk impact characteristic value of component B on the application software at time t+w is calculated, where a1, a2, a3, a4, a5, and a6 all represent proportionality coefficients and a1+a2+a3=1 and a4+a5+a6=1;

[0024] 1-f / w is used as the characteristic value of the performance impact of library A and component B on the application software at time t+w;

[0025] The operational characteristics of the application software at time t+w are [R (t+w)A ,R (t+w)B ,1-f / w];

[0026] S202: When Y t→t+w =(1-f / w)×(1-S t→t+w When the third-party library in the external dependency data tracked within the runtime period [t, t+w] is denoted as library A' and the component as component B', it is recorded as library A' and component B' respectively.

[0027] According to R (t+w)A´ =[a1×U A´t +a2×Q A´t+a3×W A´t ]×(2-S t→w )Calculate the risk impact characteristic value of library A' on the application software at time t+w;

[0028] According to R (t+w)B´ =[a4×U B´t +a5×Q B´t +a6×W B´t ]×(2-S t→w ) Calculate the characteristic value of the risk impact of component B' on the application software at time t+w;

[0029] (1-f / w)×(1-S) t→t+w ) serves as the characteristic value of the performance impact of library A' and component B' on the application software at time t+w;

[0030] The operational characteristics of the application software at time t+w are [R] (t+w)A´ ,R (t+w)B´ ,(1-f / w)×(1-S t→t+w )).

[0031] By analyzing the state of third-party libraries / components when they are invoked, the risk and performance impact characteristics of these libraries / components on the application software are calculated. This generates real-time operational characteristics of the application software, and the real-time risk growth of application software information is analyzed based on these characteristics. This enables real-time security analysis of application software information. Compared to methods such as analyzing abnormal network traffic, this process effectively reduces the risk of application software information leakage and allows for timely governance decisions before information is leaked.

[0032] Furthermore, S30 includes:

[0033] S301: Based on the combination of third-party libraries and components during application software runtime, several groups of external dependency modules are obtained. Each group of external dependency modules is numbered, and the numbering result is: j=1,2,…,n; n represents the total number of external dependency modules.

[0034] The application software's response times are numbered sequentially, with the result being: i = 1, 2, ..., m; where m represents the total number of application software responses.

[0035] At time i, the application calls external dependency module j. When external dependency module j is called and executed at time i, the number of standard permission items Q required by the application to display the functionality based on user operation data exceeds the limit. ij The information is acquired, and based on this information, the quantization weight H of the application software at time i is determined. iCalculations are performed; by quantifying weights, the runtime characteristics generated when the application software calls different external dependent modules are normalized, which helps to more clearly analyze the real-time risk growth of the application software information.

[0036] S302: Quantize the operating characteristics of the application software according to the quantization weight, and calculate the distance deviation between the operating characteristics at adjacent response times using the Euclidean distance formula;

[0037] S303: According to K i+1 =(-1) z ×[1-exp(-X i→i+1 The risk growth coefficient of application software information at time i+1 is predicted, where exp() represents an exponential function with base e and e=2.73, z=1 or z=2, when [R iA_j ×(1+H i )+R iB_j ×(1+H i )+Y i-1→i ]-[R (i+1)A_j ×(1+H i+1 )+R (i+1)B_j ×(1+H i+1 )+Y i→i+1 When [R] > 0, z = 1; when [R] > 0, z = 1. iA_j ×(1+H i )+R iB_j ×(1+H i )+Y i-1→i ]-[R (i+1)A_j ×(1+H i+1 )+R (i+1)B_j ×(1+H i+1 )+Y i→i+1 When z ≤ 0, z = 2;

[0038] ;

[0039] From i=1 to i=m for all K i+1 Perform summation to obtain V i+1 Construct a real-time security assessment model G for application software information. i+1 G i+1 =1-V i+1 .

[0040] Furthermore, S301 assigns a quantization weight H to the application software at time i. i The specific method for performing the calculation is as follows:

[0041] Let the third-party library in the external dependency module j be library A_j, and the component be component B_j;

[0042] According to formula H i =1-1 / [(Q A_ji +Q B_ji )-Q ij The quantization weight of the application software at time i is calculated;

[0043] Among them, Q A_ji Q B_ji These represent the number of permissions required by the application software to display the functions based on user operation data when library A_j and component B_j are invoked and executed at time i.

[0044] Furthermore, the quantization result in S302 is: [R iA_j ×(1+H i ),R iB_j ×(1+H i ),Y i-1→i ].

[0045] Furthermore, the specific method for calculating the distance deviation between the operational characteristics at adjacent response times using the Euclidean distance formula in step S302 is as follows:

[0046] Run characteristics [R] iA_j ×(1+H i ),R iB_j ×(1+H i ),Y i-1→i ], Operational characteristics [R (i+1)A_j ×(1+H i+1 ),R (i+1)B_j ×(1+H i+1 ),Y i→i+1 The values ​​are converted into three-dimensional coordinate points τ and δ respectively. The risk impact characteristic value of the third-party library on the application software is used as the abscissa value of the three-dimensional coordinate point, and the risk impact characteristic value of the component on the application software is used as the ordinate value of the three-dimensional coordinate point. The performance impact characteristic value of the third-party library and component on the application software is used as the ordinate value of the three-dimensional coordinate point.

[0047] The distance deviation X between three-dimensional coordinate points τ and δ is calculated using the Euclidean distance formula. i→i+1 Perform calculations;

[0048] Among them, R iA_j R (i+1)A_j R represents the risk impact characteristic values ​​of library A_j on the application software at times i and i+1, respectively. iB_j R (i+1)B_j These represent the risk impact characteristic values ​​of component B_j on the application software at times i and i+1, respectively.

[0049] Furthermore, S40 includes:

[0050] When G q >R and G q+1 When R ≤ R, the time value T corresponding to the application software at time q+1. q+1 Mark it and put T q+1 +b represents the security governance time for application software;

[0051] Where b represents the user's delayed processing time for the application software, R represents a constant and R=0.8, q=1,2,…,m;

[0052] During security governance time T q+1 +b, disconnects the application from the network.

[0053] A software information security analysis system applying artificial intelligence, the system comprising a dependency index analysis module, an operational feature analysis module, a security assessment module, and a security governance module;

[0054] The dependency index analysis module is used to track the interaction data and external dependency data of the application software in real time during the application software runtime, and analyze the dependency index between the interaction data and external dependency data tracked within the same running time period based on the storage location of the external dependency data.

[0055] The runtime characteristic analysis module is used to analyze the real-time runtime characteristics of the application software;

[0056] The security assessment module is used to quantify the historical operating characteristics of the application software based on the quantified weights of the application software at each historical response time, and to construct a real-time security assessment model for the application software information based on the processing results.

[0057] The security governance module is used to perform security governance on application software information during the predicted security governance time.

[0058] Compared with the prior art, the beneficial effects of the present invention are:

[0059] 1. This invention analyzes the security and performance impacts of external dependent modules on application software by examining the dependencies between external dependent data and interactive data, as well as the state of external dependent modules when they are invoked. This yields the real-time operational characteristics of the application software. Compared to methods that analyze network traffic anomalies, this invention eliminates the need to consider the impact of minor network traffic anomalies on the application software. Furthermore, the operational characteristics provide a more intuitive view of the application software's real-time security status, further improving the system's efficiency in analyzing application software information for security.

[0060] 2. This invention normalizes the operational characteristics generated when application software calls different external dependent modules by quantifying weights, and, based on the distance deviation between the operational characteristics of the application software at adjacent response times, it is beneficial to more clearly analyze the real-time risk growth of application software information, thereby improving the system's real-time monitoring effect on application software information security.

[0061] 3. Based on the historical operation of the application software, this invention constructs a security assessment model for application software information. This model can directly analyze the security status of the application software information at the next response moment based on the status information of the external dependent modules collected before the application software starts calling the external dependent modules. It can perform security governance on the application software information before the application software starts calling the external dependent modules with risk vulnerabilities, and there are no security risks. This further improves the security analysis effect of the system on application software information. Attached Figure Description

[0062] Figure 1 This is a schematic diagram illustrating the workflow of a software information security analysis method using artificial intelligence according to the present invention. Detailed Implementation

[0063] Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0064] like Figure 1 As shown, this invention provides a software information security analysis system and method using artificial intelligence, and a software information security analysis method using artificial intelligence, the method comprising:

[0065] S10: When the application software is running, track the application software's interaction data and external dependency data in real time, and analyze the dependency relationship between the interaction data and external dependency data. The application software shall call at least one of the third-party libraries or components during runtime.

[0066] S10 includes:

[0067] S101: External dependency data includes third-party libraries and components that the application software depends on, and interaction data includes user operation data and application software response data;

[0068] S102: Based on the input time t of the user operation data and the generation time w of the application software response data generated by the application software based on the user's input of the application software operation data at time t, the generation time represents the time length value corresponding to the time period of the application software processing the user operation data and generating the response data, the running time period of the application software [t, t+w] is obtained.

[0069] Within the runtime period [t, t+w], the similarity S between the theoretical response data of the application software generated from the tracked user operation data and the tracked application software response data is calculated. t→t+w The calculation method for data similarity is existing technology. If S t→t+w =1, then the traced external dependency data will be stored as a set of data in set M. If S t→t+w If ≠1, the tracked interaction data and external dependency data will be stored as a set of data in set N. Theoretical response data refers to the processing result of user operation data by the application software without interference from external factors. External factors include illegal, malicious intrusion, theft, tampering, destruction and other attack methods.

[0070] S103: If the external dependency data tracked within the runtime period [t, t+w] is stored in set M, then the dependency index Y between the interaction data tracked within the runtime period [t, t+w] and the external dependency data tracked within the runtime period [t, t+w] is... t→t+w =1-f / w, where f represents the generation time of application response data generated by the application software based on user operation data, without affecting the performance of the application software, when the third-party libraries and components on which the application software depends are used.

[0071] If the external dependency data tracked within the runtime period [t, t+w] is stored in set N, then the dependency index Y between the interaction data tracked within the runtime period [t, t+w] and the external dependency data tracked within the runtime period [t, t+w] is... t→t+w =(1-f / w)×(1-S t→t+w );

[0072] S20: Analyze the real-time operating characteristics of the application software based on the dependency relationship between interactive data and external dependent data;

[0073] S20 includes:

[0074] S201: When Y t→t+w When =1-f / w, the third-party library in the external dependency data tracked within the runtime period [t,t+w] is denoted as library A and the component as component B;

[0075] The number of vulnerabilities U in library A / component B at time t At / U Bt When library A / component B is invoked and executed at time t, the number of permissions Q required by the application software to display the functions based on user operation data exceeds the limit. At / Q Bt And the maintenance status value W of library A / component B at time t. At / WBt To retrieve data, when library A / component B is maintained within the time period [td,t], W... At =0 / W Bt =0, when library A / component B is not maintained during the time period [td,t], W At =1 / W Bt =1, where d represents the interval time value;

[0076] According to R (t+w)A =a1×U At +a2×Q At +a3×W At The risk impact characteristic value of library A on the application software at time t+w is calculated, R. wA This represents the characteristic value of the risk impact of library A on the application software at time t+w;

[0077] According to R (t+w)B =a4×U Bt +a5×Q Bt +a6×W Bt The risk impact characteristic value of component B on the application software at time t+w is calculated, where a1, a2, a3, a4, a5, and a6 all represent proportionality coefficients, and a1+a2+a3=1, a4+a5+a6=1, R wB This represents the characteristic value of the risk impact of component B on the application software at time t+w;

[0078] 1-f / w is used as the characteristic value of the performance impact of library A and component B on the application software at time t+w;

[0079] The operational characteristics of the application software at time t+w are [R (t+w)A ,R (t+w)B ,1-f / w];

[0080] S202: When Y t→t+w =(1-f / w)×(1-S t→t+w When the third-party library in the external dependency data tracked within the runtime period [t, t+w] is denoted as library A' and the component as component B', it is recorded as library A' and component B' respectively.

[0081] The number of vulnerabilities U of library A' / component B' at time t A´t / U B´t If library A' / component B' is invoked and executed at time t, the number of permissions Q required by the application software to display the functions based on user operation data will exceed the limit. A´t / Q B´t And the maintenance state value W of library A' / component B' at time t. A´t / W B´tTo retrieve data, when library A' / component B' is maintained within the time period [td,t], W... A´t =0 / W B´t =0, when library A' / component B' is not maintained during the time period [td,t], W A´t =1 / W B´t =1;

[0082] According to R (t+w)A´ =[a1×U A´t +a2×Q A´t +a3×W A´t ]×(2-S t→w ) Calculate the risk impact characteristic value of library A' on the application software at time w;

[0083] According to R (t+w)B´ =[a4×U B´t +a5×Q B´t +a6×W B´t ]×(2-S t→w ) Calculate the risk impact characteristic value of component B' on the application software at time w;

[0084] [1-f / w]×(1-S) t→t+w ) serves as the characteristic value of the performance impact of library A' and component B' on the application software at time t+w;

[0085] The operational characteristics of the application software at time t+w are [R] (t+w)A´ ,R (t+w)B´ ,[1-f / w]×(1-S t→t+w )];

[0086] S30: Based on the quantification weight of the application software at each historical response moment, quantify the historical operating characteristics of the retrieved application software, and construct a real-time security assessment model for application software information based on the processing results.

[0087] S30 includes:

[0088] S301: Based on the combination of third-party libraries and components during application software runtime, several groups of external dependency modules are obtained. Each group of external dependency modules can be represented as a third-party library, a third-party library and a component, or a component. The external dependency modules in each group are numbered, and the numbering result is: j=1,2,…,n; n represents the total number of external dependency modules.

[0089] The application software's response times are numbered sequentially, with the result being: i=1,2,…,m; m represents the total number of responses from the application software, and the response time refers to the moment when the application software generates the response data.

[0090] At time i, the application calls external dependency module j. When external dependency module j is called and executed at time i, the number of standard permission items Q required by the application to display the functionality based on user operation data exceeds the limit. ij The standard number of permissions refers to the sum of the number of permissions required by the application software to display functions based on user operation data when the external dependent module is called and executed, assuming that the application software is not affected by external interference factors.

[0091] H i =1-1 / [(Q A_ji +Q B_ji )-Q ij As the quantization weight of the application software at time i, let the third-party library in the external dependency module j be library A_j and the component be component B_j, where Q A_ji Q B_ji These represent the number of permissions required by the application software to display the functions based on user operation data when library A_j and component B_j are invoked and executed at time i.

[0092] S302: The operational characteristics of the application software are quantized according to the quantization weights. The quantization result is: [R] iA_j ×(1+H i ),R iB_j ×(1+H i ),Y i-1→i ];

[0093] The distance deviation between the operational characteristics of adjacent response times is calculated using the Euclidean distance formula. The specific method is as follows:

[0094] Run characteristics [R] iA_j ×(1+H i ),R iB_j ×(1+H i ),Y i-1→i ], Operational characteristics [R (i+1)A_j ×(1+H i+1 ),R (i+1)B_j ×(1+H i+1 ),Y i→i+1 The values ​​are converted into three-dimensional coordinate points τ and δ respectively. The risk impact characteristic value of the third-party library on the application software is used as the abscissa value of the three-dimensional coordinate point, and the risk impact characteristic value of the component on the application software is used as the ordinate value of the three-dimensional coordinate point. The performance impact characteristic value of the third-party library and component on the application software is used as the ordinate value of the three-dimensional coordinate point.

[0095] When i=1, Y i-1→i =Y 0→1This represents the performance impact characteristic value of the third-party libraries and components called by the application software during its first response, at time number 1.

[0096] The distance deviation X between three-dimensional coordinate points τ and δ is calculated using the Euclidean distance formula. i→i+1 Perform calculations;

[0097] Among them, R iA_j R (i+1)A_j R represents the risk impact characteristic values ​​of library A_j on the application software at times i and i+1, respectively. iB_j R (i+1)B_j These represent the risk impact characteristic values ​​of component B_j on the application software at times i and i+1, respectively.

[0098] S303: According to K i+1 =(-1) z ×[1-exp(-X i→i+1 The risk growth coefficient of the application software information at time i+1 is predicted, where exp() represents an exponential function with base e and e=2.73;

[0099] z=1 or z=2, when [R] iA_j ×(1+H i )+R iB_j ×(1+H i )+Y i-1→i ]-[R (i+1)A_j ×(1+H i+1 )+R (i+1)B_j ×(1+H i+1 )+Y i→i+1 When [R] > 0, z = 1; when [R] > 0, z = 1. iA_j ×(1+H i )+R iB_j ×(1+H i )+Y i-1→i ]-[R (i+1)A_j ×(1+H i+1 )+R (i+1)B_j ×(1+H i+1 )+Y i→i+1 When z ≤ 0, z = 2;

[0100] ;

[0101] From i=1 to i=m for all K i+1 Perform summation to obtain V i+1 Construct a real-time security assessment model G for application software information. i+1 G i+1 =1-V i+1 ;

[0102] S40: Perform security governance on application software information during the predicted security governance time;

[0103] S40 includes:

[0104] When G q >R and G q+1 When R ≤ R, the time value T corresponding to the application software at time q+1. q+1 Mark it and put T q+1 +b represents the security governance time for application software;

[0105] Where b represents the user's delayed processing time for the application software, R represents a constant and R=0.8, q=1,2,…,m;

[0106] During security governance time T q+1 +b, disconnects the application from the network.

[0107] A software information security analysis system that applies artificial intelligence, the system includes a dependency index analysis module, an operational feature analysis module, a security assessment module, and a security governance module;

[0108] The dependency index analysis module is used to track the application software's interaction data and external dependency data in real time during application software runtime, and analyze the dependency index between the interaction data and external dependency data tracked within the same running time period based on the storage location of the external dependency data.

[0109] The runtime characteristic analysis module is used to analyze the real-time runtime characteristics of application software;

[0110] The security assessment module is used to quantify the historical operating characteristics of the application software based on the quantified weights of the application software at each historical response time, and to build a real-time security assessment model of the application software information based on the processing results.

[0111] The security governance module is used to perform security governance on application software information at the predicted security governance time.

[0112] Example 1: When Y t→t+w When =1-f / w, let U be the number of vulnerabilities in library A / component B at time t. At =5 / U Bt =6. When library A / component B is invoked and executed at time t, the number of permission items Q required by the application software to display the functions based on user operation data exceeds the limit. At =1 / Q Bt =2, and the maintenance status value W of library A / component B at time t. At =1 / W Bt=0, a1=a4=0.3, a2=a5=0.4, a3=a6=0.3, then:

[0113] The characteristic value of the risk impact of library A on the application software at time t+w is:

[0114] R (t+w)A =a1×U At +a2×Q At +a3×W At =0.3×5+0.4×1+0.3×1=2.2;

[0115] The characteristic value of the risk impact of component B on the application software at time t+w is:

[0116] R (t+w)B =a4×U Bt +a5×Q Bt +a6×W Bt =0.3×6+0.4×2+0.3×0=2.2;

[0117] Let f = 10 minutes and w = 15 minutes, then the characteristic value of the performance impact of library A and component B on the application software at time t+w is 1 - 10 / 15 = 0.33;

[0118] Therefore, the operating characteristics of the application software at time t+w are [2.2, 2.2, 0.33].

[0119] Example 2: Suppose that when the external dependent module j is invoked and executed at time i, it exceeds the standard number of permission items Q required by the application software to display the functions based on user operation data. ij =8, when library A_j and component B_j are invoked and executed at time i, the number of permission items Q required by the application software to display the functions based on user operation data exceeds the limit. A_ji =6, Q B_ji =6, then the quantization weight of the application software at time i is:

[0120] H i =1-1 / [(Q A_ji +Q B_ji )-Q ij ] = 1 - 1 / [(6+6) - 8] = 0.75;

[0121] The quantization weight of the application software at time i is 0.75.

[0122] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A software information security analysis method applying artificial intelligence, characterized in that: The method includes: S10: When the application software is running, track the application software's interaction data and external dependency data in real time, and analyze the dependency relationship between the interaction data and external dependency data; S20: Analyze the real-time operating characteristics of the application software based on the dependency relationship between interactive data and external dependent data; S20 includes: S201: When Y t→t+w When Y = 1 - f / w, let the third-party library be library A and the component be component B in the external dependency data tracked within the runtime period [t, t+w]. Here, t represents the input time of the user's operation data, w represents the generation time of the application software's response data based on the user's input at time t, and Y... t→t+w represents the dependency index between the interaction data tracked within the runtime period [t, t+w] and the external dependency data tracked within the runtime period [t, t+w]. f represents the generation time of the application software response data generated by the application software based on the user operation data, without affecting the performance of the application software, when the third-party libraries and components on which the application software depends do not affect the performance of the application software. The number of vulnerabilities U in library A / component B at time t At / U Bt When library A / component B is invoked and executed at time t, the number of permissions Q required by the application software to display the functions based on user operation data exceeds the limit. At / Q Bt And the maintenance status value W of library A / component B at time t. At / W Bt To retrieve data, when library A / component B is maintained within the time period [td,t], W... At =0 / W Bt =0, when library A / component B is not maintained during the time period [td,t], W At =1 / W Bt =1; According to R (t+w)A =a1×U At +a2×Q At +a3×W At Calculate the characteristic value of the risk impact of library A on the application software at time t+w; According to R (t+w)B =a4×U Bt +a5×Q Bt +a6×W Bt The risk impact characteristic value of component B on the application software at time t+w is calculated, where a1, a2, a3, a4, a5, and a6 all represent proportionality coefficients and a1+a2+a3=1 and a4+a5+a6=1; 1-f / w is used as the characteristic value of the performance impact of library A and component B on the application software at time t+w; The operational characteristics of the application software at time t+w are [R] (t+w)A ,R (t+w)B ,1-f / w]; S202: When Y t→t+w =(1-f / w)×(1-S t→t+w When the external dependency data is tracked within the runtime period [t, t+w], the third-party library is denoted as library A' and the component as component B'. According to R (t+w)A´ =[a1×U A´t +a2×Q A´t +a3×W A´t ]×(2-S t→w )Calculate the risk impact characteristic value of library A' on the application software at time t+w; According to R (t+w)B´ =[a4×U B´t +a5×Q B´t +a6×W B´t ]×(2-S t→w ) Calculate the characteristic value of the risk impact of component B' on the application software at time t+w; (1-f / w)×(1-S) t→t+w ) serves as the characteristic value of the performance impact of library A' and component B' on the application software at time t+w; The operational characteristics of the application software at time t+w are [R (t+w)A´ ,R (t+w)B´ ,(1-f / w)×(1-S t→t+w )]; S30: Based on the quantification weight of the application software at each historical response time, the historical operating characteristics of the retrieved application software are quantified. Based on the processing results, a real-time security assessment model for the application software information is constructed. The response time refers to the time when the application software generates response data. S40: Perform security governance on application software information during the predicted security governance time.

2. The software information security analysis method using artificial intelligence according to claim 1, characterized in that: S10 includes: S101: External dependency data includes third-party libraries and components that the application software depends on, and interaction data includes user operation data and application software response data; S102: Based on the input time t of the user operation data and the generation time w of the application software response data generated by the application software based on the user's input operation data at time t, the running time period of the application software [t, t+w] is obtained; Within the runtime period [t, t+w], the similarity S between the theoretical response data of the application software generated from the tracked user operation data and the tracked application software response data is calculated. t→t+w Perform the calculation, if S t→t+w =1, then the traced external dependency data will be stored as a set of data in set M. If S t→t+w If the value is not 1, the interaction data and external dependency data obtained from the tracking will be stored as a set of data in set N. S103: Based on the storage location of external dependency data, predict the dependency index between the interaction data and external dependency data tracked within the same running time period.

3. The software information security analysis method using artificial intelligence according to claim 2, characterized in that: The specific method for predicting the dependency index between the interaction data and external dependency data tracked within the same running time period in step S103 is as follows: If the external dependency data tracked within the runtime period [t, t+w] is stored in set M, then the dependency index Y between the interaction data tracked within the runtime period [t, t+w] and the external dependency data tracked within the runtime period [t, t+w] is... t→t+w =1-f / w; If the external dependency data tracked within the runtime period [t, t+w] is stored in set N, then the dependency index Y between the interaction data tracked within the runtime period [t, t+w] and the external dependency data tracked within the runtime period [t, t+w] is... t→t+w =(1-f / w)×(1-S t→w ).

4. The software information security analysis method using artificial intelligence according to claim 3, characterized in that: S30 includes: S301: Based on the combination of third-party libraries and components during application software runtime, several groups of external dependency modules are obtained. Each group of external dependency modules is numbered, and the numbering result is: j=1,2,…,n; n represents the total number of external dependency modules. The application software's response times are numbered sequentially, with the result being: i = 1, 2, ..., m; where m represents the total number of application software responses. At time i, the application calls external dependency module j. When external dependency module j is called and executed at time i, the number of standard permission items Q required by the application to display the functionality based on user operation data exceeds the limit. ij The information is acquired, and based on this information, the quantization weight H of the application software at time i is determined. i Perform calculations; S302: Quantize the operating characteristics of the application software according to the quantization weight, and calculate the distance deviation between the operating characteristics at adjacent response times using the Euclidean distance formula; S303: According to K i+1 =(-1) z ×[1-exp(-X i→i+1 The risk growth coefficient of application software information at time i+1 is predicted, where exp() represents an exponential function with base e and e=2.73, z=1 or z=2, when [R iA_j ×(1+H i )+R iB_j ×(1+H i )+Y i-1→i ]-[R (i+1)A_j ×(1+H i+1 )+R (i+1)B_j ×(1+H i+1 )+Y i→i+1 When [R] > 0, z = 1; when [R] > 0, z = 1. iA_j ×(1+H i )+R iB_j ×(1+H i )+Y i-1→i ]-[R (i+1)A_j ×(1+H i+1 )+R (i+1)B_j ×(1+H i+1 )+Y i→i+1 When ]≤0, z=2, X i→i+1 R represents the distance deviation between three-dimensional coordinate points τ and δ. iA_j R represents the characteristic value of the risk impact of library A_j on the application software at time i. iB_j H represents the characteristic value of the risk impact of component B_j on the application software at time i. i This represents the quantization weight of the application software at time i. ； From i=1 to i=m for all K i+1 Perform summation to obtain V i+1 Construct a real-time security assessment model G for application software information. i+1 , G i+1 =1-V i+1 .

5. The software information security analysis method using artificial intelligence according to claim 4, characterized in that: S301 assigns the quantization weight H to the application software at time i. i The specific method for performing the calculation is as follows: Let the third-party library in the external dependency module j be library A_j, and the component be component B_j; According to formula H i =1-1 / [(Q A_ji +Q B_ji )-Q ij The quantization weight of the application software at time i is calculated; Among them, Q A_ji Q B_ji These represent the number of permissions required by the application software to display the functions based on user operation data when library A_j and component B_j are invoked and executed at time i.

6. The software information security analysis method using artificial intelligence according to claim 5, characterized in that: The quantization result in S302 is: [R] iA_j ×(1+H i ),R iB_j ×(1+H i ),Y i-1→i ].

7. The software information security analysis method using artificial intelligence according to claim 6, characterized in that: The specific method for calculating the distance deviation between the operational characteristics at adjacent response times using the Euclidean distance formula in S302 is as follows: Run characteristics [R] iA_j ×(1+H i ),R iB_j ×(1+H i ),Y i-1→i ], Operational characteristics [R (i+1)A_j ×(1+H i+1 ),R (i+1)B_j ×(1+H i+1 ),Y i→i+1 The values ​​are converted into three-dimensional coordinate points τ and δ respectively. The risk impact characteristic value of the third-party library on the application software is used as the abscissa value of the three-dimensional coordinate point, and the risk impact characteristic value of the component on the application software is used as the ordinate value of the three-dimensional coordinate point. The performance impact characteristic value of the third-party library and component on the application software is used as the ordinate value of the three-dimensional coordinate point. The distance deviation X between three-dimensional coordinate points τ and δ is calculated using the Euclidean distance formula. i→i+1 Perform calculations; Among them, R (i+1)A_j R represents the characteristic value of the risk impact of library A_j on the application software at time i+1. (i+1)B_j This represents the characteristic value of the risk impact of component B_j on the application software at time i.

8. The software information security analysis method using artificial intelligence according to claim 7, characterized in that: S40 includes: When G q >R and G q+1 When R ≤ R, the time value T corresponding to the application software at time q+1. q+1 Mark it and put T q+1 +b represents the security governance time for application software; Where b represents the user's delayed processing time for the application software, R represents a constant and R=0.8, q=1,2,…,m; During security governance time T q+1 +b, disconnects the application from the network.

9. A software information security analysis system applying artificial intelligence using the software information security analysis method according to any one of claims 1-8, characterized in that: The system includes a dependency index analysis module, a runtime characteristic analysis module, a security assessment module, and a security governance module; The dependency index analysis module is used to track the interaction data and external dependency data of the application software in real time during the application software runtime, and analyze the dependency index between the interaction data and external dependency data tracked within the same running time period based on the storage location of the external dependency data. The runtime characteristic analysis module is used to analyze the real-time runtime characteristics of the application software; The security assessment module is used to quantify the historical operating characteristics of the application software based on the quantified weights of the application software at each historical response time, and to construct a real-time security assessment model for the application software information based on the processing results. The security governance module is used to perform security governance on application software information during the predicted security governance time.

Images