Process control method, device and system based on big data in trusted environment

Abstract

The invention discloses a process control method, device and system based on big data in a trusted environment. The method comprises the following steps: calling a trusted agent on a computing component of a target terminal to detect a to-be-controlled first process in the computing component; a first control strategy of a first process is generated by utilizing a strategy prediction model deployed in a protection component, so that credible security protection is performed on process operation in a calculation component, and the strategy prediction model is obtained by utilizing collected multi-dimensional data training of processes of a credible terminal in a credible security environment. The multi-dimensional data comprises a static feature, a dynamic feature, a context feature and a sensitive behavior feature, the strategy prediction model carries reference information of a white list of the trusted process, the target terminal and the trusted terminal both adopt a dual-system architecture based on a protection component and a calculation component, and the protection component and the calculation component are isolated through an isolation mechanism. The technical problem that process running safety protection cannot be quickly responded in the related technology is solved.

Description

Technical Field

[0001] This application relates to the field of computer security, and more specifically, to a process control method, apparatus, and system based on big data in a trusted environment. Background Technology

[0002] This section is intended to provide background or context for the content set forth in the claims or specification, and the content described herein is not acknowledged as prior art simply because it is included in this section.

[0003] With the rapid development of computer systems, various process requirements are emerging one after another, and process security issues are becoming increasingly prominent. Traditional runtime control technologies cannot accurately control process access to resources. Using SELINUX or the existing APPARMOR for access control requires a certain amount of time to collect program behavior, analyze and generate access control policy files, and then use manually generated policies for runtime control, which cannot quickly respond to runtime security protection needs.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] This application provides a process control method, apparatus, and system based on big data in a trusted environment, so as to at least solve the technical problem in the related art of being unable to quickly respond to process operation security protection.

[0006] According to one aspect of the embodiments of this application, a process control system based on big data in a trusted environment is provided, comprising: a trusted management center, used to train a policy prediction model using multidimensional data of processes collected in a trusted security environment, wherein the multidimensional data includes static features, dynamic features, context features, and sensitive behavior features, and the policy prediction model is used to generate control policies for processes, the policy prediction model carrying baseline information of a whitelist of trusted processes; and a terminal set, wherein the terminals in the terminal set adopt a dual-system architecture based on a protection component and a computing component, the protection component and the computing component are isolated by an isolation mechanism, the terminal set includes trusted terminals and target terminals, the trusted terminals are used to report multidimensional data of processes to the trusted management center, and the target terminals deploy the policy prediction model in the protection component, used to call a trusted agent on the computing component to detect a first process to be controlled in the computing component, and use the policy prediction model to generate a first control policy for the first process, thereby providing trusted security protection for the process operation in the computing component.

[0007] Optionally, the trusted management center is further configured to: after obtaining the initial whitelist, continuously collect multi-dimensional data of trusted terminal processes in the trusted security environment; update the trusted processes in the whitelist or the baseline information of trusted processes according to the changes in the multi-dimensional data of the same process, until the obtained whitelist no longer changes; and use the whitelist to train the policy prediction model.

[0008] Optionally, the trusted management center is further configured to: after sending the policy prediction model to the target terminal, obtain audit information reported by the target terminal, wherein the audit information is used to indicate a second process determined by the policy prediction model that does not match the baseline information of trusted processes in the whitelist; perform a security assessment on the second process indicated by the audit information using a large model and a vulnerability database; generate a second control policy for the second process based on the security assessment results; and update the policy prediction model using the second control policy of the second process.

[0009] Optionally, the trusted management center is further configured to: after updating the policy prediction model using the second control strategy of the second process, record the version of the policy prediction model and allow updating or rolling back the version of the policy prediction model.

[0010] Optionally, the trusted terminal is further configured to invoke a trusted agent to detect multi-dimensional data of processes in the computing component within a trusted security environment in the following manner: Invoking the trusted agent to obtain the following static characteristics from the executable file pointed to by the trusted process: execution type, file hash, file signature, file permissions, dependency library information, compilation time, compiler version, file digital certificate information, file modification time, and access permission change history; Invoking the trusted agent to obtain the following dynamic characteristics of the process during runtime: memory usage, CPU utilization, opened files, network access connections, system call sequence, memory request permissions, interaction behavior with other processes, resource consumption trends, abnormal exits, and crash information; Invoking the trusted agent to obtain the following contextual characteristics of the process runtime: parent process, user, group, startup parameters, runtime environment variables, working directory, and file system mount point; Invoking the trusted agent to obtain the following sensitive behavioral characteristics of the process runtime: accessed sensitive files, queried specific network ports, accessed critical system resources, and monitoring records of processes with special markers.

[0011] According to another aspect of the embodiments of this application, a process control method based on big data in a trusted environment is also provided, including: calling a trusted agent on the computing component of a target terminal to detect a first process to be controlled in the computing component; generating a first control policy for the first process using a policy prediction model deployed in a protection component, thereby providing trusted security protection for the process running in the computing component, wherein the policy prediction model is trained using multidimensional data of processes of trusted terminals collected in a trusted security environment, the multidimensional data including static features, dynamic features, context features and sensitive behavior features, the policy prediction model carries baseline information of a whitelist of trusted processes, and both the target terminal and the trusted terminal adopt a dual-system architecture based on a protection component and a computing component, the protection component and the computing component being isolated through an isolation mechanism.

[0012] Optionally, after deploying the policy prediction model in the protection component of the target terminal, the method further includes: reporting audit information to a trusted management center so that the trusted management center can use the audit information to update the policy prediction model, wherein the audit information is used to indicate a second process on the target terminal that does not match the baseline information of trusted processes in the whitelist; and updating the policy prediction model deployed on the protection component according to the instructions of the trusted management center.

[0013] According to another aspect of the embodiments of this application, a process control device based on big data in a trusted environment is also provided, comprising: a detection unit, used to call a trusted proxy on the computing component of a target terminal to detect a first process to be controlled in the computing component; and a control unit, used to generate a first control policy for the first process using a policy prediction model deployed in a protection component, thereby providing trusted security protection for the process running in the computing component. The policy prediction model is trained using multidimensional data of processes of trusted terminals collected in a trusted security environment. The multidimensional data includes static features, dynamic features, contextual features, and sensitive behavior features. The policy prediction model carries baseline information of a whitelist of trusted processes. Both the target terminal and the trusted terminal adopt a dual-system architecture based on a protection component and a computing component, and the protection component and the computing component are isolated through an isolation mechanism.

[0014] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, the storage medium including a stored program that executes the above-described method when the program is run.

[0015] According to another aspect of the embodiments of this application, an electronic device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor performs the above-described method through the computer program.

[0016] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of any of the embodiments of the methods described above.

[0017] In this embodiment, a trusted proxy on the computing component of the target terminal is invoked to detect the first process to be controlled in the computing component; a first control policy for the first process is generated using a policy prediction model deployed in the protection component, thereby providing trusted security protection for the process running in the computing component. The policy prediction model is trained using multi-dimensional data of processes of trusted terminals in a trusted security environment. The multi-dimensional data includes static features, dynamic features, context features, and sensitive behavior features. The policy prediction model carries baseline information of a whitelist of trusted processes. Both the target terminal and the trusted terminal adopt a dual-system architecture based on the protection component and the computing component. The protection component and the computing component are isolated through an isolation mechanism, thereby solving the technical problem of being unable to quickly respond to process running security protection in related technologies. Attached Figure Description

[0018] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0019] Figure 1 This is a schematic diagram of a process control system based on big data in a trusted environment according to an embodiment of this application;

[0020] Figure 2 This is a flowchart of an optional process control method based on big data in a trusted environment according to an embodiment of this application;

[0021] Figure 3 This is a schematic diagram of an optional prediction strategy module according to an embodiment of this application;

[0022] Figure 4 This is a schematic diagram of an optional data structure according to an embodiment of this application;

[0023] Figure 5 This is a schematic diagram illustrating an optional whitelist update according to an embodiment of this application;

[0024] Figure 6 This is a schematic diagram of the output of an optional prediction strategy model according to an embodiment of this application;

[0025] Figure 7 This is a schematic diagram of an optional trusted control strategy according to an embodiment of this application;

[0026] Figure 8 This is a schematic diagram of a process control scheme based on big data in a trusted environment according to an embodiment of this application;

[0027] Figure 9 This is a schematic diagram of an optional process control device based on big data in a trusted environment according to an embodiment of this application;

[0028] Figure 10 This is a structural block diagram of a terminal according to an embodiment of this application. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] According to one aspect of the embodiments of this application, a method embodiment of a process control method based on big data in a trusted environment is provided, which can quickly generate a trusted process operation control policy. This is an operation control mechanism based on big data in a trusted environment, which can achieve precise control in dimensions such as network ports, file access, and memory usage. When the program scans the whitelist, the trusted access control policy can be quickly generated through a built-in module (i.e., a policy prediction model), thereby achieving efficient protection.

[0032] Optionally, in this embodiment, the above-described process control method based on big data in a trusted environment can be applied to, for example... Figure 1The process control system based on big data in a trusted environment shown can solve the technical problem of the inability to quickly respond to process execution security protection in related technologies, including:

[0033] The Trusted Management Center is used to train a policy prediction model using multidimensional data of processes collected in a trusted security environment. The multidimensional data includes static features, dynamic features, contextual features, and sensitive behavior features. The policy prediction model is used to generate control policies for processes and carries baseline information of a whitelist of trusted processes.

[0034] After obtaining the initial whitelist, the Trusted Management Center continuously collects multi-dimensional data on the processes of trusted terminals in the trusted security environment; based on the changes in the multi-dimensional data of the same process, it updates the trusted processes in the whitelist or the baseline information of trusted processes until the obtained whitelist no longer changes; the whitelist is used to train the policy prediction model, which is then sent to the target terminal (i.e., the terminal that may have certain security risks).

[0035] After the policy prediction model is sent to the target terminal, the audit information reported by the target terminal is obtained. The audit information is used to indicate a second process determined by the policy prediction model that does not match the baseline information of trusted processes in the whitelist. A security assessment is performed on the second process indicated by the audit information using a large model and a vulnerability database. A second control policy for the second process is generated based on the security assessment results. The policy prediction model is updated using the second control policy of the second process. The version of the policy prediction model is recorded, and the trusted management center and / or the target terminal are allowed to update or roll back the version of the policy prediction model.

[0036] The terminal set comprises a dual-system architecture based on a protection component and a computing component. The protection component and the computing component are isolated by an isolation mechanism. The terminal set includes trusted terminals and target terminals. The trusted terminals are used to report multi-dimensional data of processes to the trusted management center. The target terminals have the policy prediction model deployed in the protection component. The target terminals are used to call the trusted agent on the computing component to detect the first process to be controlled in the computing component, and use the policy prediction model to generate a first control policy for the first process, thereby providing trusted security protection for the process execution in the computing component.

[0037] Optionally, the trusted terminal invokes the trusted agent to detect the multi-dimensional data of the process in the computing component within the trusted security environment in the following manner: The trusted agent is invoked to obtain the following static characteristics from the executable file pointed to by the trusted process: execution type, file hash, file signature, file permissions, dependency library information, compilation time, compiler version, file digital certificate information, file modification time, and access permission change history; The trusted agent is invoked to obtain the following dynamic characteristics of the process during runtime: memory usage, CPU utilization, open files, network access connections, system call sequence, memory allocation permissions, interaction behavior with other processes, resource consumption trends, abnormal exits, and crash information; The trusted agent is invoked to obtain the following contextual characteristics of the process during runtime: parent process, user, group, startup parameters, runtime environment variables, working directory, and file system mount point;

[0038] The trusted proxy is invoked to obtain the following sensitive behavioral characteristics of the process: the sensitive files accessed, the specific network ports queried, the critical system resources accessed, and the monitoring records of processes with special markers.

[0039] The process control method based on big data in a trusted environment according to the embodiments of this application can be executed by the target terminal, or it can be executed collaboratively by the target terminal and the trusted management center. Specifically, the execution of the process control method based on big data in a trusted environment by the target terminal can also be performed by its protective components.

[0040] Figure 2 This is a flowchart of an optional process control method based on big data in a trusted environment according to an embodiment of this application, such as... Figure 2 As shown, the method may include the following steps:

[0041] Step S202: Call the trusted proxy on the computing component of the target terminal to detect the first process to be controlled in the computing component.

[0042] Step S204: The first control policy of the first process is generated using the policy prediction model deployed in the protection component, thereby providing trusted security protection for the process running in the computing component. The policy prediction model is trained using multi-dimensional data of processes of trusted terminals in the trusted security environment. The multi-dimensional data includes static features, dynamic features, context features and sensitive behavior features. The policy prediction model carries the baseline information of the whitelist of trusted processes. Both the target terminal and the trusted terminal adopt a dual architecture based on the protection component and the computing component. The protection component and the computing component are isolated through an isolation mechanism.

[0043] After deploying a policy prediction model in the protection component of the target terminal, the target terminal can report audit information to the Trusted Management Center, so that the Trusted Management Center can use the audit information to update the policy prediction model. The audit information is used to indicate a second process on the target terminal that does not match the baseline information of trusted processes in the whitelist, as determined by the policy prediction model. The policy prediction model deployed on the protection component is updated according to the instructions of the Trusted Management Center, thereby realizing real-time policy updates and enhancing the protection effect.

[0044] The main purpose of rapidly generating trusted process operation control strategies is to predict and analyze the scope of process influence by using a built-in prediction strategy module, thereby providing trusted security protection for process operation. The prediction strategy module is a mechanism for rapidly generating process operation control strategies based on big data in a trusted environment. It can perform multi-dimensional detection on processes, covering the actions of the detected process on other files, directories, ports, memory usage, etc. in a trusted environment. After the detection is completed, the corresponding trusted operation control strategy is issued in real time, which can control process operation with high precision and limit the active range of processes to a minimum with high timeliness, thereby completing process operation control.

[0045] The technical solution of this invention is: a method for rapidly generating trusted operation control strategies based on big data in a trusted environment. Rapidly generating trusted operation control strategies involves multiple steps. As an optional embodiment, the following key aspects are described in detail:

[0046] S1. Build a large database using a trusted and secure environment, and train the prediction strategy module (i.e., the policy prediction model, whose functionality is mainly implemented by the prediction unit), such as... Figure 3 As shown.

[0047] 1) Monitoring Unit Description: In a trusted and secure environment system, global monitoring mode is enabled. In this mode, trusted products report event data for all monitored processes within the system, using processes as the monitoring entity. Data is collected from multiple dimensions based on event type: static characteristics, dynamic characteristics, contextual characteristics, and sensitive behavior analysis. The collection of data from these four dimensions constitutes process integrity. Specific data descriptions for feature collection are as follows:

[0048] Static characteristics: From the executable file pointed to by the process, not only are file hashes, file signatures, file permissions, and dependent library information extracted based on the specific execution type (e.g., ELF, SH), but the file's compilation time, compiler version, and digital certificate information are also further analyzed. This information helps verify the file's integrity and source reliability, ensuring that only certified executable files can run on the system. In addition, the file's modification time and access permission change history are recorded for traceability analysis in the event of a security incident.

[0049] Dynamic characteristics: Monitoring the runtime behavior of processes is a key focus. In addition to basic information such as memory usage, CPU utilization, open files, network connections, system call sequences, and memory allocation permissions (read, write, execute), the monitoring also tracks interactions between processes, such as signal sending and receiving, pipe communication, and shared memory access. Furthermore, it records resource consumption trends, such as increases in memory and CPU utilization, as well as abnormal exits and crashes during process execution. This information helps identify potential malicious behavior and resource abuse.

[0050] Contextual characteristics: The execution context of a process is crucial for understanding its behavior. In addition to basic information such as parent process, user, group, and startup parameters (command line), the system also records the process's runtime environment variables, such as PATH and LD_LIBRARY_PATH, which can affect process behavior. Furthermore, the system monitors the process's working directory and file system mount points to quickly locate relevant files when file access events occur. This information helps build a complete contextual view of the process, enabling more accurate analysis of its behavior.

[0051] Sensitive Behavioral Characteristics: The system focuses on monitoring process access to sensitive files and specific network ports. In addition to monitoring access to sensitive files such as / etc / passwd and specific network ports like DNS lookup ports, it also monitors process access to critical system resources, such as memory device files like / dev / mem and / dev / kmem. Furthermore, processes with special markings, such as those with SUID or SGID privileges, are additionally monitored. These processes often run as other users and pose potential security risks. By logging these sensitive behavioral characteristics, potential security threats can be detected and responded to promptly.

[0052] 2) Prediction Unit Description: Based on the audit data collected from the four dimensions mentioned above, the extracted process features and audit information are cleaned, standardized, and normalized to facilitate model training. This step generates a main process structure containing four child nodes, as shown below. Figure 4 As shown.

[0053] The above multidimensional data is converted into the following format:

[0054]

[0055]

[0056] This data collection includes all static fingerprint information of the process (such as file hash, signature, permissions, etc.) and dynamic action access range values ​​(such as memory usage range, memory allocation attributes, etc.), forming a comprehensive and detailed process behavior profile.

[0057] In a trusted and secure environment, distributing this data as the benchmark for updating the whitelist is not a one-step process, but requires repeated data collection and updates to ensure the accuracy and reliability of the whitelist. Specifically, a preliminary whitelist is constructed based on the collected data and applied to the system for real-time monitoring. Within a specified threshold time, the system continuously collects and compares process behavior data, observing for data fluctuations exceeding three differences. If the data fluctuation is within an acceptable range, the process's behavior is considered highly consistent with the whitelist benchmark, and it can be stored as a composite whitelist benchmark, completing the data collection process. However, if the data fluctuation exceeds the threshold, it indicates that the process's behavior may have changed abnormally. In this case, the whitelist benchmark data needs to be updated again and re-distributed to the system for training. This process is repeated until a stable and accurate process whitelist is obtained, providing strong protection for the secure operation of the system. Through such continuous iteration and optimization, the system's security performance can be continuously improved, ensuring the security and integrity of data. The specific process is as follows: Figure 5 As shown.

[0058] S2. Construct an initial composite trusted whitelist baseline based on process integrity, and feed the trusted whitelist composite baseline into the prediction strategy model to predict the creation and distribution of operation control strategies.

[0059] Constructing an initial composite trusted whitelist baseline based on process integrity is an important step aimed at enhancing system security. This process first involves a comprehensive analysis and evaluation of all processes in the system to determine which processes are trusted, and then constructing a whitelist baseline based on these trusted processes.

[0060] When building a whitelist, special attention needs to be paid to the integrity of processes. Integrity means that the process has not been tampered with or corrupted, and its behavior is as expected. To ensure this, various techniques and methods, such as hash verification and digital signatures, can be used to verify the process's code and data.

[0061] Once a trusted whitelist baseline is established, it needs to be fed into the predictive strategy model. This model will use the information in the whitelist to predict which processes are safe and which may be potential threats. Through iterative methods, the model can analyze data such as process behavior characteristics and resource usage, and compare them with trusted processes in the whitelist to make predictions.

[0062] like Figure 6As shown, based on the output of the predictive strategy model, runtime control policies can be created and deployed. These policies will guide how the system responds to different processes. For example, for processes predicted as trustworthy, the system can grant normal running permissions and resource allocation; while for processes predicted as potential threats, the system can take measures such as restricting their operation, isolating and observing them, or terminating them.

[0063] In a trusted security system, the generated composite whitelist benchmark data is not only the core of the security policy but also a crucial foundation for the target machine's operational control policy. This carefully selected and verified data is imported into the target machine as a benchmark source for subsequent policy learning and iterative updates. Upon receiving this benchmark data, the target machine immediately applies it to actual operation, directly allowing all data within the dynamic benchmark values ​​to pass, ensuring smooth operation of normal business. However, for data not explicitly listed in the policy, the target machine adopts a more cautious approach. This data is sent to the auditing system for reporting, forming a new data source for subsequent policy optimization and updates. This process not only helps discover potential security threats but also continuously improves and optimizes the system's security policy. It is worth noting that the prediction unit on the target machine plays a key role in policy execution. To address new behaviors that may arise from higher-version software, the prediction unit incorporates a human intervention dimension. This means that when the system encounters behaviors that cannot be accurately identified, it promptly notifies security experts for manual analysis and judgment. This human-machine collaboration significantly improves the system's accuracy in identifying new behaviors, ensuring the timeliness and effectiveness of the security policy. This mechanism allows for continuous adaptation to software version updates and changes, providing a strong guarantee for the secure operation of the system.

[0064] S3. Start the operation control service. The operation control module controls the operation of each process according to the issued trusted operation control policy. Processes that meet the control requirements are allowed to proceed, while those that violate the trusted policy are intercepted and audit information is recorded. Figure 7 As shown.

[0065] S4. Periodically return the operational audit information to the prediction strategy module to update and generate trusted operational control policies. Administrators can choose whether to update specific policies, thereby improving the accuracy of prediction and protection.

[0066] The system can be configured to periodically revert audit information back to the prediction strategy module for strategy rollback, supporting multiple time intervals such as hours, days, and weeks. The prediction module reads information such as the subject, object, and operation from the audit information and uses this as a basis to create a strategy-specific token, with the following format:

[0067]

[0068]

[0069] The token is input into the proprietary large model, which analyzes and provides a preliminary legality judgment and prediction. The prediction module is integrated with the open-source vulnerability database and the large model library. The large model synchronously generates corresponding tokens for processes according to their hash values. By connecting to the open-source vulnerability resource database and the large model based on the object relationship table, and establishing relationships with open-source objects based on open-source and proprietary support, the module comprehensively judges whether the security is guaranteed, and provides corresponding analysis results and final policy predictions. At the same time, it provides users with analysis explanations, policy reasons, and other explanations. The updated trusted operation control policy is then synchronized to the trusted management center. Administrators can choose whether to update specific policies based on the comprehensive explanations, thereby improving the accuracy of prediction and protection.

[0070] The specific process for this application is as follows: Figure 8 As shown, the method for rapid generation and operation control of big data in a trusted environment includes the following steps:

[0071] S1. Build trusted and secure environments for various business types, and monitor and audit the characteristics of all processes, file access actions, port access, and memory usage in each trusted environment;

[0072] S2. Extract process features and process execution audit information, build a prediction model, and train and validate the prediction strategy module;

[0073] S3. Initialize and build a trusted whitelist baseline, feed all entries in the whitelist into the prediction strategy module in sequence, and use the prediction template to predict the trusted operation control strategy for each entry.

[0074] S4. Issue trusted whitelist benchmarks and trusted process execution control policies, and start the execution control service;

[0075] S5. During product operation, processes that conform to policy requirements are allowed to proceed, while actions that violate the configured policies are protected, intercepted, and audit information is recorded.

[0076] S6. The prediction strategy module periodically reverts the operational audit information to the prediction model to improve the accuracy of the prediction strategy.

[0077] S7. The administrator, through the intelligent security policy, provides corresponding analysis results and policy predictions, as well as explanations of the reasons for the analysis policy, to confirm whether to update the issued trusted operation control policy and to more accurately control process behavior.

[0078] The innovations of the strategy and method for rapid generation and operation control of big data in a trusted environment are mainly reflected in the following aspects:

[0079] 1) Pre-created trusted operation control policies: Based on the prediction model trained on big data in a trusted environment, the trusted operation control policies can be predicted, generated and distributed in real time for newly added whitelist benchmark entries, ensuring that the entry has the corresponding operation control policy when it is added to the whitelist.

[0080] 2) The predictive model is constantly updated. After the product is deployed, it not only controls the process operation, but also has the function of updating the predictive model. Administrators can use the model update function to revert the audit information after the product deployment into the predictive model, thereby obtaining and issuing more accurate and reliable operation control strategies.

[0081] 3) Refined whitelist operation control: The trusted whitelist of processes works in conjunction with trusted operation control strategies to avoid whitelisting processes as a whole, providing multi-dimensional and precise operation control protection;

[0082] 4) Based on the intelligent security policy generation scheme of the Trusted Management Center, the Trusted Management Center synchronously and manually configures the benchmark library and policies, establishes tokens for corresponding subjects, objects, and operations, inputs them into its own large model, and the large model synchronously generates tokens according to hash values, provides legality judgment and prediction, and can access the open source vulnerability resource library and large model library based on the object relationship table (its own subjects and objects correspond to the open source large model or the subjects and objects corresponding to the vulnerability library and the relationship graph). Based on open source and proprietary support, it establishes relationships with open source objects, judges whether they are secure, provides corresponding analysis results and policy predictions, and provides users with analysis explanations, policy reasons and other explanations.

[0083] Compared with existing technologies, the technical advantages of the rapid generation and operation control strategy for big data in a trusted environment are mainly reflected in the following aspects:

[0084] 1) Optimized execution control policy generation timeliness: Execution control policies can be predicted and issued when a process is added to the trusted whitelist benchmark, eliminating the monitoring stage of traditional SELinux and AppArmor execution control policies; 2) Improved execution control precision enhances system security: Avoiding the "one-size-fits-all" approach of traditional whitelists, execution control is more granular, and execution control policies are issued synchronously when the whitelist benchmark is configured, effectively improving system security; 3) More precise trusted execution control: After the initial prediction policy is issued, the process is still monitored, and regular analysis and regression auditing are performed to continuously improve the accuracy of the prediction policy; 4) Intelligent security policies based on the trusted management center: The trusted management center synchronously and manually configures the benchmark library and policies, establishes tokens for corresponding subjects, objects, and operations, and generates tokens synchronously in the large model. Based on the object relationship table, it connects to the open-source vulnerability resource library and the large model library, establishes relationships with open-source objects based on open-source and proprietary support, comprehensively judges whether it is secure, provides corresponding analysis results and policy predictions, and provides users with analysis explanations and policy reasons.

[0085] In summary, the technical effects of implementing a trusted control strategy for the rapid generation and operation of big data in a trusted environment are mainly reflected in optimizing the timeliness of operational control strategy generation, enhancing system security, providing precise operational control, and implementing intelligent security strategies. These combined effects effectively prevent attacks on the terminal system during process execution, providing a more secure and trusted operating environment for the terminal system.

[0086] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0087] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0088] According to another aspect of the embodiments of this application, a process control device based on big data in a trusted environment is also provided for implementing the above-described process control method based on big data in a trusted environment. Figure 9 This is a schematic diagram of an optional process control device based on big data in a trusted environment according to an embodiment of this application, such as... Figure 9 As shown, the device may include:

[0089] The detection unit 901 is used to call the trusted proxy on the computing component of the target terminal to detect the first process to be controlled in the computing component;

[0090] The control unit 903 is used to generate a first control policy for the first process using a policy prediction model deployed in the protection component, thereby providing trusted security protection for the process execution in the computing component. The policy prediction model is trained using multi-dimensional data of processes of trusted terminals in a trusted security environment. The multi-dimensional data includes static features, dynamic features, context features, and sensitive behavior features. The policy prediction model carries baseline information of a whitelist of trusted processes. Both the target terminal and the trusted terminal adopt a dual-system architecture based on the protection component and the computing component. The protection component and the computing component are isolated through an isolation mechanism.

[0091] Through the aforementioned modules, a trusted proxy on the computing component of the target terminal is invoked to detect the first process to be controlled within the computing component. A first control policy for the first process is generated using a policy prediction model deployed in the protection component, thereby providing trusted security protection for the process execution within the computing component. The policy prediction model is trained using multi-dimensional data of processes from trusted terminals in a trusted security environment. This multi-dimensional data includes static features, dynamic features, contextual features, and sensitive behavioral features. The policy prediction model carries baseline information for a whitelist of trusted processes. Both the target terminal and the trusted terminal adopt a dual-system architecture based on the protection component and the computing component. The protection component and the computing component are isolated through an isolation mechanism, which can solve the technical problem of being unable to quickly respond to process execution security protection in related technologies.

[0092] Optionally, the control unit is further configured to, after deploying the policy prediction model in the protection component of the target terminal, report audit information to the Trusted Management Center so that the Trusted Management Center can use the audit information to update the policy prediction model, wherein the audit information is used to indicate a second process on the target terminal that does not match the baseline information of trusted processes in the whitelist; and update the policy prediction model deployed on the protection component according to the instructions of the Trusted Management Center.

[0093] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of a device, can operate in environments such as... Figure 1 The hardware environment shown can be implemented through software or hardware, and the hardware environment includes the network environment.

[0094] According to another aspect of the embodiments of this application, a server or trusted terminal is also provided for implementing the above-described process control method based on big data in a trusted environment.

[0095] This solution is applicable to a dual-architecture system (i.e., a computing subsystem and a security subsystem) that operates in parallel with security measures. The computing and security subsystems are securely isolated from each other and can interact through a dedicated access channel. The security subsystem has higher control privileges than the computing subsystem. It can access the computing subsystem's memory and I / O peripherals without restriction, and it can also control the computing subsystem. However, the computing subsystem cannot access the security subsystem's memory or I / O peripherals, nor can it control the security subsystem. The computing and security subsystems have their own independent hardware resources to support computing and security tasks, including CPU, memory, and storage.

[0096] To facilitate the modification of existing computer motherboards (i.e., computing subsystems), the protection subsystem of this application, a novel external board type, can be adopted. This board integrates core components such as TPCM, TCM, BIOS chip (including BIOS1, BIOS2, and BIOS3), timing control circuit CPLD (denoted as CPLD2, while the CPLD on the computer motherboard is denoted as CPLD1), and standard interfaces into the board. The card slots, motherboard, circuits, and other hardware on the computer motherboard do not need to be customized. The original BIOS chip position on the motherboard can be left unused by installing a socket. Then, the signal lines originally connected to the BIOS chip can be guided to the external board through methods such as flying wires (i.e., directly soldering thin wires) or pins.

[0097] When the motherboard powers on and loads the BIOS, CPLD2, under its control, receives a reset signal from BIOS1 (the signal sending module) and continuously sends a reset signal to the CPU, preventing the CPU from entering execution mode. Simultaneously, CPLD2 wakes up the TPCM (causing it to boot before the CPU). The TPCM performs a self-test and then verifies the integrity of CPLD2 and the BIOS (BIOS2 and BIOS3). If the verification fails, the motherboard does not boot. If the verification succeeds, the TPCM interacts with CPLD2 to release the reset signal control, triggering the CPU to boot, and then continues the other boot processes, establishing a trust chain. This method ensures the security and integrity of the system boot process. The TPCM connects to the motherboard via an interface for data transmission and command interaction. It can directly access the motherboard's memory to read and measure memory data and control processes within it. Through its proactive measurement mechanism, the TPCM can proactively initiate real-time measurements of the system and application running status during system operation, ensuring that critical information is not illegally altered and guaranteeing the safe and stable operation of the system and applications.

[0098] BIOS1 is a signal transmission module. It begins sending reset signals upon power-up and before TPCM verification. Its code contains reset signal transmission logic. Physical protection ensures attackers cannot modify the initial control logic. Physical write protection combined with digital signature verification meets the basic requirements of trusted computing. BIOS2 is a read-only area used to store unmodifiable code. Through board locking, unmodifiable code (such as initialization code and trusted measurement logic) is permanently stored in the read-only area. Static logic is also stored there. Hardware locks (such as fuses and write-protection pins) prevent accidental modification or tampering. The read-only code undergoes signature verification, and TPCM verifies its integrity during initialization. This dual-layered physical and logical defense design enhances the BIOS's trustworthiness and security. BIOS3 is a read-write-configurable area. Its configuration items mainly involve hardware parameters. The physical storage blocks of the configuration item area only allow write operations authorized by TPCM. The SPI interface for the configuration item area... The Flash chip select signal is controlled by CPLD2. By default, the motherboard's access to the configuration item area is disconnected. Only after authorization by TPCM will CPLD2 switch control of the SPI bus to the motherboard, allowing temporary access. The process is as follows: the motherboard sends a configuration item read / write request to TPCM and provides a short-term access token issued by TPCM. TPCM generates a one-time session key. After completing authentication and permission checks, TPCM sends an authorization command to CPLD2, dynamically enabling hardware permissions. At the same time, write operations are encrypted and protected for integrity when writing configuration items. All configuration item modification records are signed by TPCM and written to the secure storage area to prevent log tampering.The read / write area stores the parts that need to be dynamically updated and modified by authorized entities. Access control for this part is handled by the TPCM. This may include frequently written content such as user settings, log data, runtime data, temporary data, and firmware update cache. The TPCM strictly restricts access permissions through access control policies. For example, the write process is as follows: the motherboard sends a write request to the TPCM, including the target address, plaintext data, and operation certificate. The TPCM verifies the motherboard's identity, checks operation permissions, generates a unique root key for the device, and derives a session key (such as an SM4 key) based on the request context. Plaintext data is then encrypted using the session key. For integrity protection, the TPCM writes ciphertext to the read / write area via a hardware isolation bus (such as a private SPI channel). Simultaneously, operation details (operator, time, target address hash) are signed by the TPCM and written to the security log area. The read process is as follows: the motherboard sends a read request to the TPCM, the TPCM verifies authorization and generates a temporary decryption token, the TPCM reads the ciphertext data from the read / write area, decrypts the data using the session key, and the plaintext is only cached in the TPCM's internal secure memory. The plaintext is returned to the motherboard via an encrypted channel, and the cache is immediately cleared upon completion. Simultaneously, operation details are signed by the TPCM and written to the security log area to prevent log tampering.

[0099] Static measurement is performed using a dual-architecture system with the aforementioned external boards: 1) A benchmark library file is established. During system initialization, all executable files in the system are scanned, including critical files during startup and executable files during system operation. The size and hash value of each file are calculated, and the file size, hash value, and full file path information are saved to the benchmark library file. Instructions are sent to the TPCM via shared memory communication. The TPCM calculates the digest value of the benchmark library file and saves it in the TPCM's digest value storage area. After receiving the successful digest value saving message, the benchmark library management module encrypts and saves the benchmark library file. 2) The benchmark library file data is loaded into memory. The memory data is divided into a first-level cache and a second-level cache. The first-level cache uses a fragmented Bloom filter to store file attribute information. A multidimensional file attribute fragmented Bloom filter (MFABF) is used to store valid files. The compression feature of file attributes introduces multiple attribute data such as file path information, file hash value, and file size. The multidimensional attribute data of the file is combined with a hash function to generate a unique key value, and a sharded Bloom filter is constructed. Its memory data area serves as the first-level cache area, and the second-level cache uses a sharded hash table to store file attribute information. The sharded hash table only stores the hash value and file path information of the file for data comparison. The file size information is not stored in the hash table to avoid consuming too much memory resources; 3) Static measurement file matching: When an executable file attempts to execute, the static measurement function is triggered. First, the sharded Bloom filter of the first-level cache is queried (which can be a multi-threaded parallel query) to obtain the size, hash value, and full path information of the executable file to be tested. The hash value is calculated and combined into a string of multidimensional attribute information of the file for querying. Then, the sharded hash table of the second-level cache is queried.

[0100] For trusted terminals with a dual architecture using the above external boards, if the Linux kernel of the trusted terminal has the CONFIG_JUMP_LABLE compilation option enabled, then the server acting as the trusted management center can generate and send verification content to the trusted terminal based on the characteristics that the Jump Label will not change after loading, the instructions of the static code marked by the Jump Label are the same after each compilation, and the instructions of the dynamic code marked by the Jump Label may change after each compilation. This allows for the measurement of the Linux system running on the computing component of the trusted terminal. If the measurement passes, it indicates that the Linux system is trustworthy; otherwise, its operation is restricted according to the corresponding control policy. Specifically, the following steps are taken: 1) The baseline value can be generated directly on the trusted terminal. When the Linux kernel code of the trusted terminal runs for the first time, the hash value of the Jump Label table is calculated to obtain the baseline value of the Jump Label table, which is then stored in the baseline value library. The hash value of the static code marked in the Jump Label table is calculated to obtain the baseline value of the static code, which is also stored in the baseline value library. The Jump Label table is measured, and after the measurement passes, key verification information is extracted from the Jump Label table and stored in the baseline value library. Alternatively, the baseline value library can be generated using verification content issued by the Trusted Management Center. The baseline value of the static code in the issued verification content is directly stored in the baseline value library. The address of the Jump Label table in the issued verification content is converted, and then the hash value of the Jump Label table is calculated using TPCM to obtain the baseline value of the Jump Label table, which is then stored in the baseline value library. After converting the address of the Jump Label table in the issued verification content, the baseline value of the static code is extracted from the Jump Label table and stored in the baseline value library. 1) Extract key verification information from the Label table and store it in the benchmark value library; 2) Verify the benchmark value: The trusted terminal calculates the hash value of the local Jump Label table and compares it with the benchmark value of the Jump Label table in the benchmark value library to measure the Jump Label table. It also calculates the hash value of the static code marked in the local Jump Label table and compares it with the benchmark value of the static code marked in the Jump Label table in the benchmark value library to measure the static code marked in the Jump Label table. Finally, it compares the key information in the dynamic code marked in the local Jump Label table with the key verification information of the Jump Label table in the benchmark value library to measure the dynamic code marked in the Jump Label table.

[0101] Figure 10 This is a structural block diagram of a terminal according to an embodiment of this application, such as... Figure 10 As shown, the terminal may include: one or more (only one is shown in the figure) processors 1001, memory 1003, and transmission devices 1005, such as... Figure 10 As shown, the terminal may also include input / output devices 1007.

[0102] The memory 1003 can be used to store software programs and modules, such as the program instructions / modules corresponding to the process control method and apparatus based on big data in a trusted environment in this embodiment of the application. The processor 1001 executes various functional applications and data processing by running the software programs and modules stored in the memory 1003, thereby realizing the aforementioned process control method based on big data in a trusted environment. The memory 1003 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1003 may further include memory remotely located relative to the processor 1001, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0103] The aforementioned transmission device 1005 is used to receive or send data via a network, and can also be used for data transfer between a processor and memory. Specific examples of the network described above may include wired networks and wireless networks. In one example, the transmission device 1005 includes a Network Interface Controller (NIC), which can be connected to other network devices and a router via a network cable to communicate with the Internet or a local area network. In another example, the transmission device 1005 is a radio frequency (RF) module used for wireless communication with the Internet.

[0104] Specifically, memory 1003 is used to store application programs.

[0105] The processor 1001 can invoke the application program stored in the memory 1003 via the transmission device 1005 to perform the following steps:

[0106] The system invokes a trusted proxy on the computing component of the target terminal to detect the first process to be controlled in the computing component; it then uses a policy prediction model deployed in the protection component to generate a first control policy for the first process, thereby providing trusted security protection for the process running in the computing component. The policy prediction model is trained using multi-dimensional data of processes of trusted terminals collected in a trusted security environment. The multi-dimensional data includes static features, dynamic features, context features, and sensitive behavior features. The policy prediction model carries baseline information of a whitelist of trusted processes. Both the target terminal and the trusted terminal adopt a dual-system architecture based on the protection component and the computing component, which are isolated from each other through an isolation mechanism.

[0107] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated here.

[0108] Those skilled in the art will understand that Figure 10 The structure shown is for illustrative purposes only. The terminal can be a smartphone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile internet device (MID), a PAD, or other terminal devices. Figure 10 This does not limit the structure of the aforementioned electronic device. For example, the terminal may also include components that are more... Figure 10 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 10 The different configurations shown.

[0109] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0110] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to execute program code for a process control method based on big data in a trusted environment.

[0111] Optionally, in this embodiment, the storage medium may be located on at least one of the network devices in the network shown in the above embodiment.

[0112] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps:

[0113] The system invokes a trusted proxy on the computing component of the target terminal to detect the first process to be controlled in the computing component; it then uses a policy prediction model deployed in the protection component to generate a first control policy for the first process, thereby providing trusted security protection for the process running in the computing component. The policy prediction model is trained using multi-dimensional data of processes of trusted terminals collected in a trusted security environment. The multi-dimensional data includes static features, dynamic features, context features, and sensitive behavior features. The policy prediction model carries baseline information of a whitelist of trusted processes. Both the target terminal and the trusted terminal adopt a dual-system architecture based on the protection component and the computing component, which are isolated from each other through an isolation mechanism.

[0114] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated here.

[0115] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0116] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0117] If the integrated units in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0118] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0119] In the several embodiments provided in this application, it should be understood that the disclosed client can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between units or modules, and may be electrical or other forms.

[0120] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0121] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0122] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A process control system based on big data in a trusted environment, characterized in that, include: The Trusted Management Center is used to train a policy prediction model using multi-dimensional data of processes collected in a trusted security environment. The multi-dimensional data includes static features, dynamic features, contextual features, and sensitive behavior features. The policy prediction model is used to generate control policies for processes and carries baseline information of a whitelist of trusted processes. The terminal set comprises a dual-system architecture based on a protection component and a computing component. The protection component and the computing component are isolated by an isolation mechanism. The terminal set includes trusted terminals and target terminals. The trusted terminals are used to report multi-dimensional data of processes to the trusted management center. The target terminals have the policy prediction model deployed in the protection component. The target terminals are used to call the trusted agent on the computing component to detect the first process to be controlled in the computing component, and use the policy prediction model to generate a first control policy for the first process, thereby providing trusted security protection for the process execution in the computing component.

2. The system according to claim 1, characterized in that, The trusted management center is also used for: After obtaining the initial whitelist, we continuously collect multi-dimensional data on the processes of trusted terminals in a trusted security environment; Based on the changes in multidimensional data of the same process, update the trusted processes in the whitelist or the baseline information of trusted processes until the whitelist no longer changes. The policy prediction model is obtained by training using the whitelist.

3. The system according to claim 1, characterized in that, The trusted management center is also used for: After the strategy prediction model is sent to the target terminal, the audit information reported by the target terminal is obtained, wherein the audit information is used to indicate the second process determined by the strategy prediction model that does not match the baseline information of the trusted processes in the whitelist; A security assessment of the second process indicated by the audit information is performed using a large model and vulnerability database. A second control strategy for the second process is generated based on the security assessment results; The policy prediction model is updated using the second control strategy of the second process.

4. The system according to claim 3, characterized in that, The trusted management center is also used for: After updating the policy prediction model using the second control strategy of the second process, the version of the policy prediction model is recorded and updating or reverting the version of the policy prediction model is allowed.

5. The system according to any one of claims 1 to 4, characterized in that, The trusted terminal is also used to invoke multidimensional data of processes in the trusted proxy detection computing component within a trusted security environment in the following manner: The trusted agent is invoked to obtain the following static characteristics from the executable file pointed to by the trusted process: execution type, file hash, file signature, file permissions, dependency library information, compilation time, compiler version, file digital certificate information, file modification time, and access permission change history. The trusted agent is invoked to obtain the following dynamic characteristics of the process during runtime: memory usage, CPU utilization, open files, network access connections, system call sequence, memory request permissions, interaction behavior with other processes, resource consumption trends, abnormal exits, and crash information; The trusted agent is invoked to obtain the following contextual characteristics of the process running: parent process, user, group, startup parameters, runtime environment variables, working directory, and file system mount point; The trusted proxy is invoked to obtain the following sensitive behavioral characteristics of the process: the sensitive files accessed, the specific network ports queried, the critical system resources accessed, and the monitoring records of processes with special markers.

6. A process control method based on big data in a trusted environment, characterized in that, Applied to target terminals, including: The trusted proxy on the computing component of the target terminal is invoked to detect the first process to be controlled in the computing component; A first control policy for the first process is generated using a policy prediction model deployed in the protection component, thereby providing trusted security protection for the process execution in the computing component. The policy prediction model is trained using multi-dimensional data of processes of trusted terminals in a trusted security environment. The multi-dimensional data includes static features, dynamic features, context features, and sensitive behavior features. The policy prediction model carries baseline information of a whitelist of trusted processes. Both the target terminal and the trusted terminal adopt a dual-system architecture based on the protection component and the computing component, which are isolated from each other through an isolation mechanism.

7. The method according to claim 6, characterized in that, After deploying a policy prediction model in the protection components of the target terminal, the method further includes: The audit information is reported to the Trusted Management Center so that the Trusted Management Center can use the audit information to update the policy prediction model. The audit information is used to indicate the second process determined by the policy prediction model on the target terminal that does not match the baseline information of the trusted processes in the whitelist. Update the policy prediction model deployed on the protection component according to the instructions of the Trusted Management Center.

8. A process control device based on big data in a trusted environment, characterized in that, Applied to target terminals, including: The detection unit is used to call the trusted proxy on the computing component of the target terminal to detect the first process to be controlled in the computing component; The control unit is used to generate a first control policy for the first process using a policy prediction model deployed in the protection component, thereby providing trusted security protection for the process execution in the computing component. The policy prediction model is trained using multi-dimensional data of processes of trusted terminals in a trusted security environment. The multi-dimensional data includes static features, dynamic features, context features, and sensitive behavior features. The policy prediction model carries baseline information of a whitelist of trusted processes. Both the target terminal and the trusted terminal adopt a dual-system architecture based on the protection component and the computing component. The protection component and the computing component are isolated through an isolation mechanism.

9. A computer-readable storage medium, characterized in that, The storage medium includes a stored program, wherein the program executes the method described in any one of claims 6 to 7 when it is run.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the method described in any one of claims 6 to 7 through the computer program.

Images