System online and offline authorization scheme design and implementation method

Abstract

The invention provides a system online and offline authorization scheme design and implementation method, which relates to the field of computer security, and comprises the following steps: acquiring terminal state information, acquiring resource data, calculating a security score and generating an encryption strategy matrix; analyzing a calling relation and generating an authorization key through an online monitoring module and an offline analysis module which are used for constructing an application program calling chain; according to the invention, seamless authorization switching between an online state and an offline state is realized, the security and reliability of system authorization are improved, the authorization risk is reduced, and identity authentication requirements in various network environments are met.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer security, and in particular to a system online and offline authorization scheme design and implementation method. BACKGROUND

[0002] With the rapid development of information technology, the authorization management of software system has become an important link to ensure the safe use of software and protect intellectual property. Traditional software authorization usually adopts serial number activation, hardware binding or network verification and other ways to achieve. In the field of enterprise-level application and professional software, the authorization management needs to meet the use requirements in online and offline environments at the same time, in order to cope with different network conditions and application scenarios.

[0003] The current software authorization technology mainly includes online authorization based on network, offline authorization based on local and hybrid authorization mode. Online authorization usually requires the user terminal to maintain network connection with the authorization server, and verifies the authorization state in real time to ensure the legality of software use; offline authorization makes the software run normally in the network environment through the pre-downloaded authorization file or hardware encryption lock and other ways; the hybrid authorization mode combines the advantages of the two ways, and switches the authorization verification mode under different network states.

[0004] However, the existing system online and offline authorization scheme still has the following shortcomings: the existing authorization scheme has limited perception ability of the terminal security state, most systems only use static authorization verification mechanism, which cannot dynamically adjust the authorization strategy according to the real-time resource state and security risk of the terminal, resulting in reduced authorization security in complex or poor environment; the selection of authorization encryption algorithm is usually preset fixed, lacking adaptive adjustment ability based on terminal performance and network state, so that the authorization performance and security on different terminal devices exist obvious difference, it is difficult to meet the authorization needs of high-performance terminal and low-configuration terminal at the same time; the existing authorization scheme generally lacks deep analysis ability of software runtime behavior, which cannot effectively identify abnormal application call chain and potential authorization bypass behavior, resulting in that the authorization system is vulnerable to attacks by simulation environment, code injection and other technical means, reducing the effectiveness of authorization protection. SUMMARY

[0005] The embodiment of the present application provides a system online and offline authorization scheme design and implementation method, which can solve the problems in the prior art.

[0006] In a first aspect, the embodiment of the present application provides a system online and offline authorization scheme design and implementation method, comprising:

[0007] Obtaining the state information of the user terminal, collecting real-time resource data when detecting that it is in online state, and reading the resource data at the last online time from the local cache when detecting that it is in offline state;

[0008] draw a load curve using the resource data, calculate a curve inflection point and a fluctuation period, extract a feature value in the fluctuation period, calculate a terminal security score in combination with the state information, establish a mapping relationship between the terminal security score and a preset encryption algorithm library, generate an encryption strategy matrix, select an optimal encryption algorithm based on the encryption strategy matrix, generate a security encryption code, and establish an encrypted communication channel;

[0009] When the authorization pass information returned by the server is received, an online monitoring module and an offline analysis module of an application program call chain are constructed; the online monitoring module collects the call timing and the call relationship between the application programs in real time, generates a continuous data stream, constructs an adjacency matrix based on the continuous data stream, and finally generates a dynamic call graph; the offline analysis module periodically performs clustering analysis on historical call data, generates a call link topology graph, identifies a call mode in combination with a dynamic kernel function; the online and offline analysis results are fused to determine a key program node, extract a running feature of the key program node, calculate a risk coefficient, and generate an authorization key based on the key program node and the risk coefficient;

[0010] The authorization key is sent to a user terminal, a monitor verifier state is monitored, and an authorization strategy is dynamically adjusted according to the terminal online and offline state.

[0011] Draw a load curve using the resource data, calculate a curve inflection point and a fluctuation period, extract a feature value in the fluctuation period, calculate a terminal security score in combination with the state information, including:

[0012] The resource data is divided into adjacent time intervals based on a preset time axis, and a load curve is generated using a polynomial segmentation mapping that satisfies a second-order smoothness constraint;

[0013] Curvature analysis is performed based on the load curve to obtain a curvature distribution feature of the load curve, a dynamic curvature threshold is generated according to the curvature distribution feature, and time points in the load curve whose curvature values exceed the dynamic curvature threshold are marked as an inflection point sequence;

[0014] Adjacent inflection points in the inflection point sequence are paired, the time interval between the paired inflection points is calculated to obtain a fluctuation duration, and the amplitude change of the curve between the paired inflection points is extracted to obtain a fluctuation intensity;

[0015] The fluctuation duration and the fluctuation intensity of each pair of paired inflection points are organized into a feature matrix in chronological order, the information entropy distribution of each feature dimension in the feature matrix is calculated to obtain a corresponding feature weight, and a terminal security score is generated in combination with the fluctuation features in the feature matrix.

[0016] Map the terminal security score to a preset encryption algorithm library to generate an encryption strategy matrix, select an optimal encryption algorithm based on the encryption strategy matrix, including:

[0017] Extract the key length and computational complexity of each encryption algorithm in the preset encryption algorithm library to generate an encryption algorithm feature set; divide the numerical interval of the terminal security score, set a mapping reference point in the numerical interval, establish a corresponding relationship between the mapping reference point and the encryption algorithm feature set, and extend the corresponding relationship to the entire numerical interval to form a complete mapping relationship;

[0018] Set a segmented nonlinear activation function, perform segmented activation in each numerical interval of the mapping relationship, apply a smoothing constraint at the junction of the numerical intervals, calculate the deviation of the terminal security score in the numerical interval, input the deviation into an exponential decay rule to determine a feature coefficient, calibrate the numerical upper and lower limits of the feature coefficient, construct a mapping matrix based on the feature coefficient and the segmented nonlinear activation function, and output an encryption strategy matrix by applying the mapping matrix to the encryption algorithm feature set;

[0019] Extract the security policy vector and execution time of each encryption algorithm in the encryption strategy matrix, calculate the Euclidean distance between each security policy vector and a target vector, construct a target function value based on the Euclidean distance and the normalized execution time, and iteratively update the encryption algorithm parameters using the target function value until convergence is achieved, and select the encryption algorithm with the smallest target function value as the optimal encryption algorithm.

[0020] The online monitoring module collects the calling timing and calling relationship between application programs in real time to generate a continuous data stream, and constructs an adjacency matrix based on the continuous data stream to finally generate a dynamic call graph, including:

[0021] Construct a time window queue based on the calling timing, input the calling data and the calling relationship into the time window queue to generate a continuous data stream;

[0022] Assign a globally unique identifier as a node to each application program in the continuous data stream, record the processing capacity and calling state of the node, construct directed edges between nodes in combination with the calling relationship, map the processing capacity and calling state to a two-dimensional plane using a space filling method based on a two-dimensional Z-order curve, obtain the similarity of the node by calculating the spatial position of the node on the Z-order curve, and group nodes with similar processing capacity and calling state using local sensitive hashing; construct an affinity matrix according to the similarity of the nodes in each group, splice each affinity matrix according to the access order of the Z-order curve to generate an adjacency matrix;

[0023] Continuously receiving the calling data in the continuous data stream, adding the corresponding node and directed edge in the adjacency matrix when a new calling relationship is found; recalculating the spatial position of the node on the Z-order curve and the similarity according to the latest processing capacity and calling state, dynamically adjusting the node grouping; deleting the edges that have not occurred for a preset time and the isolated nodes generated therefrom, and finally generating a dynamic calling graph.

[0024] The offline analysis module periodically performs clustering analysis on historical calling data to generate a calling link topology graph, identifies calling patterns in combination with a dynamic kernel function, including:

[0025] Extracting the calling initiator service and the calling target service recorded in the historical calling data, concatenating them in timestamp order to form a calling link, and integrating all the calling links to generate a calling link topology graph;

[0026] Counting the degrees of all nodes in the calling link topology graph to obtain a node degree distribution, selecting any two nodes from the calling link topology graph, counting the minimum number of nodes passed between the two nodes as a calling path length, and constructing a path feature vector based on the node degree distribution and the calling path length;

[0027] Inputting the path feature vector into a radial basis function and an inner product polynomial function respectively, linearly superimposing the output results to obtain a dynamic kernel function value; calculating the distance between the historical calling data using the dynamic kernel function value, counting the number of nodes with a distance less than a preset cutoff distance to obtain a density value, and selecting the minimum distance value from the nodes with a density value greater than the density value;

[0028] Determining a clustering center point according to the density value and the minimum distance value, dividing the historical calling data into a class in which the clustering center point is located, and obtaining a calling pattern.

[0029] Fusing the online and offline analysis results, determining a key program node, extracting the running features of the key program node, and calculating a risk coefficient, including:

[0030] Extracting a calling path from the dynamic calling graph, calculating a path importance based on the edge weight of the calling path and the density value in the calling pattern;

[0031] Recursively decomposing the calling path according to the path importance to generate a key path set; in the key path set, extracting the occurrence frequency and position information of the node in the key path to generate a node key degree, and determining the node with the maximum node key degree as the key program node;

[0032] For the key program node, the calling timing mode and response time sequence in the running process are collected, the calling timing mode distribution characteristics are extracted to generate timing entropy, and the response time sequence is extracted to generate timing stability characteristics;

[0033] The timing entropy is taken as a state node, the timing stability characteristics are taken as a transition boundary, a state space graph is generated, a state transition matrix is generated based on the transition direction between adjacent timing entropies, feature value sequences are extracted from the state transition matrix to generate state persistence, a maximum connected subgraph in the state space graph is identified to generate state convergence, and a risk coefficient is calculated based on the state persistence and the state convergence.

[0034] In a second aspect of the embodiment of the application, a system online and offline authorization scheme design and implementation system is provided, comprising:

[0035] A first unit is configured to acquire state information of a user terminal, collect real-time resource data when detecting that the user terminal is in an online state, and read resource data at the last online time from a local cache when detecting that the user terminal is in an offline state;

[0036] A second unit is configured to draw a load curve using the resource data, calculate a curve inflection point and a fluctuation period, extract feature values in the fluctuation period, calculate a terminal security score in combination with the state information, establish a mapping relationship between the terminal security score and a preset encryption algorithm library to generate an encryption strategy matrix, select an optimal encryption algorithm based on the encryption strategy matrix to generate a security encryption code, and establish an encrypted communication channel.

[0037] A third unit is configured to, when receiving authorization pass information returned by a server, construct an online monitoring module and an offline analysis module of an application program calling chain, collect calling timing and calling relationship among application programs in real time to generate a continuous data stream, construct an adjacency matrix based on the continuous data stream, and finally generate a dynamic calling graph, periodically perform clustering analysis on historical calling data to generate a calling link topology graph, identify a calling mode in combination with a dynamic kernel function, fuse online and offline analysis results to determine a key program node, extract running characteristics of the key program node, calculate a risk coefficient, and generate an authorization key based on the key program node and the risk coefficient.

[0038] A fourth unit is configured to send the authorization key to a user terminal, monitor a verifier state, and dynamically adjust an authorization strategy according to an online or offline state of the user terminal.

[0039] In a third aspect of the embodiment of the application,

[0040] An electronic device is provided, comprising:

[0041] A processor;

[0042] a memory for storing processor-executable instructions;

[0043] The processor is configured to invoke the instructions stored in the memory to perform the method described above.

[0044] A fourth aspect of the embodiments of the present application,

[0045] A computer-readable storage medium is provided, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the method described above.

[0046] The beneficial effects of the present application are as follows:

[0047] By dynamically monitoring the terminal state and calculating the security score based on resource data, intelligent selection of encryption strategies is realized, ensuring the security of data transmission during the authorization process, effectively resisting network attacks and data theft risks.

[0048] Combining online monitoring and offline analysis dual mechanisms, a complete application program call chain analysis system is constructed, which can accurately identify key program nodes and call patterns, improving the identification ability of the authorization system to abnormal behavior and enhancing the system security.

[0049] According to the terminal online and offline state, the authorization strategy is dynamically adjusted, so that the system can maintain stable operation under various network environments, improve user experience, and at the same time ensure the continuity and reliability of the authorization mechanism, adapt to the needs of various complex application scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 The flowchart of the design and implementation method of the online and offline authorization scheme of the system of the embodiments of the present application;

[0051] Figure 2 The system architecture diagram of the adaptive encryption algorithm selection based on the terminal security score. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme of the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0053] The technical scheme of the present application will be described in detail in specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in some embodiments.

[0054] Figure 1 A flowchart of a method for designing and implementing an online and offline authorization scheme for an embodiment system of the present application is shown in FIG. 1, which comprises the following steps: Figure 1

[0055] Obtaining state information of a user terminal, collecting real-time resource data when detecting an online state, and reading resource data at the last online time from a local cache when detecting an offline state;

[0056] Drawing a load curve using the resource data, calculating a curve inflection point and a fluctuation period, extracting feature values in the fluctuation period, calculating a terminal security score in combination with the state information, establishing a mapping relationship between the terminal security score and a preset encryption algorithm library, generating an encryption strategy matrix, selecting an optimal encryption algorithm based on the encryption strategy matrix, generating a security encryption code, and establishing an encrypted communication channel;

[0057] When receiving authorization pass information returned by a server, constructing an online monitoring module and an offline analysis module of an application program call chain, the online monitoring module collecting call timing and call relationships between application programs in real time, generating a continuous data stream, constructing an adjacency matrix based on the continuous data stream, and finally generating a dynamic call graph, the offline analysis module periodically performing clustering analysis on historical call data, generating a call link topology graph, identifying a call mode in combination with a dynamic kernel function, fusing online and offline analysis results, determining a key program node, extracting running features of the key program node, calculating a risk coefficient, and generating an authorization key based on the key program node and the risk coefficient;

[0058] Sending the authorization key to a user terminal, monitoring a verifier state, and dynamically adjusting an authorization strategy according to a terminal online or offline state.

[0059] In an optional embodiment, drawing a load curve using the resource data, calculating a curve inflection point and a fluctuation period, extracting feature values in the fluctuation period, and calculating a terminal security score in combination with the state information, comprise:

[0060] Dividing the resource data into adjacent time intervals based on a preset time axis, and generating a load curve using a polynomial piecewise mapping satisfying a second-order smoothness constraint;

[0061] Performing curvature analysis based on the load curve, obtaining curvature distribution characteristics of the load curve, generating a dynamic curvature threshold value according to the curvature distribution characteristics, and marking time points in the load curve with a curvature value exceeding the dynamic curvature threshold value as an inflection point sequence;

[0062] ​pairing adjacent inflection points in the inflection point sequence, calculating the time interval between the paired inflection points to obtain the fluctuation duration, and extracting the amplitude change of the curve between the paired inflection points to obtain the fluctuation intensity;

[0063] The fluctuation duration and the fluctuation intensity of each pair of paired inflection points are organized in time sequence into a feature matrix, the corresponding feature weight is calculated based on the information entropy distribution of each feature dimension in the feature matrix, and the terminal security score is generated in combination with the fluctuation features in the feature matrix.

[0064] The collected resource data is divided into a plurality of adjacent time intervals according to a preset time axis, for example, the time intervals can be divided every 5 minutes, every 10 minutes or every hour. For the resource data points in each time interval, a polynomial piecewise mapping method is applied to generate a smooth load curve. When generating the curve, a second-order smoothness constraint needs to be met, that is, not only the curve value is continuous at the piecewise point, but also the first and second derivatives are continuous, to ensure smooth transition of the curve. For example, for CPU usage data, a cubic spline interpolation method can be used to fit the corresponding CPU usage values [v1, v2,..., v n] ] to generate a smooth CPU load curve. n

[0065] Curvature analysis is performed on the generated load curve, and the curvature values of each point on the curve are calculated. By analyzing the curvature distribution characteristics of the entire curve, such as the mean, variance, maximum value, etc. of the curvature, a dynamic curvature threshold is generated. This threshold is not a fixed value, but is dynamically adjusted according to the characteristics of the current load curve. For example, the mean curvature plus twice the standard deviation of the curvature can be used as the dynamic threshold. If the mean curvature of the CPU usage curve in a certain time period is 0.05 and the standard deviation is 0.03, the dynamic curvature threshold can be set to 0.11. The points in the load curve whose curvature values exceed the dynamic threshold are marked as inflection points, forming an inflection point sequence [p1, p2,..., p m ].

[0066] The adjacent inflection points in the inflection point sequence are paired, such as (p1, p2) and (p3, p4). For each pair of inflection points, the time interval between them is calculated as the fluctuation duration, such as the time difference between inflection points p1 and p2 being 30 seconds, indicating that this fluctuation lasted for 30 seconds. At the same time, the amplitude change of the curve between the paired inflection points is extracted as the fluctuation intensity, such as the CPU usage at p1 being 20% and at p2 being 80%, so the fluctuation intensity is 60%.

[0067] ​The fluctuation duration and fluctuation intensity of each pair of paired inflection points are organized in chronological order into a feature matrix. For example, if there are n pairs of inflection points, an n x 2 matrix can be constructed, where each row contains the fluctuation duration and fluctuation intensity of a pair of inflection points. The information entropy of each feature dimension in the feature matrix is calculated to evaluate the uncertainty and information amount of each feature. Based on the information entropy distribution, the corresponding feature weight is calculated, and the higher the information entropy, the greater the feature weight. For example, if the information entropy of the fluctuation duration is 0.8 and the information entropy of the fluctuation intensity is 0.5, the weight of the fluctuation duration can be set to 0.615 and the weight of the fluctuation intensity to 0.385.

[0068] Based on the fluctuation features in the feature matrix and the corresponding weights, as well as the state information of the terminal, a terminal security score is generated, and the calculation process can include multiplying the fluctuation features by the corresponding weights to obtain weighted scores, and then adjusting them in combination with the state information. For example, if the terminal has an abnormal process running or a suspicious application installed, the security score will be reduced; on the contrary, if it is running stably and the resource usage is regular, the security score will be increased. The final security score can be a value between 0 and 100, and the higher the score, the better the terminal security state.

[0069] A specific example: the CPU usage data of a terminal within an hour is collected and divided into 60 data points at 1-minute intervals. After applying cubic spline interpolation, a smooth CPU load curve is generated. The curvature analysis shows that the mean curvature of the curve is 0.04 and the standard deviation is 0.025, and the dynamic curvature threshold is set to 0.09. Six inflection points with curvature exceeding the threshold are identified, located at time points [5 minutes, 12 minutes, 27 minutes, 35 minutes, 48 minutes, 56 minutes]. These inflection points are paired into three groups: (5 minutes, 12 minutes), (27 minutes, 35 minutes), and (48 minutes, 56 minutes). The fluctuation duration of the first group of inflection points is 7 minutes and the fluctuation intensity is 45%; the second group is 8 minutes and 35%; and the third group is 8 minutes and 30%. The feature matrix is constructed as [[7, 45], [8, 35], [8, 30]]. After calculating the information entropy, the weight of the fluctuation duration is 0.4 and the weight of the fluctuation intensity is 0.6. The terminal state information shows that there is an unusual system process occupying a high resource. The final terminal security score calculated is 78, indicating that the terminal security state is good but there is a slight abnormality that needs attention.

[0070] Figure 2 The architecture diagram for the adaptive encryption algorithm based on the terminal security score is shown in Figure 1. In an optional implementation, a mapping relationship between the terminal security score and a preset encryption algorithm library is established to generate an encryption strategy matrix, and the optimal encryption algorithm is selected based on the encryption strategy matrix, including:

[0071] extract the key length and computational complexity of each encryption algorithm in the preset encryption algorithm library to generate an encryption algorithm feature set; divide the numerical interval of the terminal security score, set mapping reference points within the numerical interval, establish a correspondence between the mapping reference points and the encryption algorithm feature set, and extend the correspondence to the entire numerical interval to form a complete mapping relationship;

[0072] A segmented nonlinear activation function is set, a segmented activation is performed within each numerical interval of the mapping relationship, a smooth constraint is applied at the junction of the numerical intervals, the degree of deviation of the terminal security score within the numerical interval is calculated, the degree of deviation is input into an exponential decay rule to determine a feature coefficient, the numerical upper and lower limits of the feature coefficient are calibrated, a mapping matrix is constructed based on the feature coefficient and the segmented nonlinear activation function, and the mapping matrix is applied to the encryption algorithm feature set to output an encryption strategy matrix;

[0073] The security policy vector and execution time of each encryption algorithm in the encryption strategy matrix are extracted, the Euclidean distance between each security policy vector and a target vector is calculated, a target function value is constructed based on the Euclidean distance and the normalized execution time, the encryption algorithm parameters are iteratively updated using the target function value until convergence, and the encryption algorithm with the smallest target function value is selected as the optimal encryption algorithm.

[0074] First, a preset encryption algorithm library is established, containing multiple encryption algorithms such as AES, RSA, SM4, etc. By extracting the key length and computational complexity characteristics of each encryption algorithm, an encryption algorithm feature set is generated. For example, an algorithm library contains AES-128, AES-256, RSA-2048 algorithms, with key lengths of 128 bits, 256 bits, and 2048 bits, and computational complexities of 25, 40, and 80 (in standardized units). These characteristic values are stored as a two-dimensional array as the basis data for subsequent mapping.

[0075] The terminal security score is usually a value between 0 and 100, which is divided into five intervals: [0, 20), [20, 40), [40, 60), [60, 80), and [80, 100]. Mapping reference points are set at the center points 10, 30, 50, 70, and 90 of each interval. For the correspondence between the reference points and the encryption algorithm features, when the security score is 10, it corresponds to a lightweight algorithm with a key length of 128 bits, when the score is 50, it corresponds to a medium-strength algorithm, and when the score is 90, it corresponds to a high-strength key algorithm. The correspondence is extended to the entire numerical interval by interpolation to form a complete mapping relationship table.

[0076] To achieve smooth transition of the mapping relationship, a segmented nonlinear activation function is set to process the security score. In actual implementation, an improved sigmoid function is used as the activation function, a relatively gentle curve is used when the security score is in the interval [40, 60), and a relatively steep curve is used in the interval [0, 20) and [80, 100] to reflect that the encryption policy change should be more sensitive when the security risk is extremely low or extremely high. At the numerical points such as 20, 40, 60, and 80 on the interval boundary, a smooth constraint is applied to ensure the continuity of the function and avoid policy mutation.

[0077] The deviation degree of the terminal security score in the interval is calculated to measure the distance from the center of the interval, for example, when the security score is 35, the center of the interval [20, 40) in which it is located is 30, and the deviation degree is (35-30) / 10=0.5. The deviation degree is input into the exponential decay rule to determine the characteristic coefficient. When the deviation degree is 0.5, the characteristic coefficient is obtained by calculating e (-0.5×0.5) ≈0.78. The characteristic coefficient is limited in the range of [0.1, 1.0] to prevent excessive adjustment in extreme cases.

[0078] Based on the characteristic coefficient and the segmented nonlinear activation function, a mapping matrix is constructed. The specific method is to multiply the output value of the activation function by the characteristic coefficient to form an adjustment factor matrix, and each element in the matrix represents the weight adjustment value of the corresponding feature. When the terminal security score is 35, the corresponding mapping matrix may be a 2x2 matrix, and the elements of the matrix correspond to the weight adjustment factors of the key length and the calculation complexity, respectively. The mapping matrix is applied to the encryption algorithm feature set, and the encryption strategy matrix is output by matrix multiplication operation.

[0079] In the optimal encryption algorithm selection stage, the security policy vector and the execution time of each encryption algorithm in the encryption strategy matrix are extracted, the security policy vector includes the adjusted key length and calculation complexity value, and the target vector is predefined to represent the ideal security parameter combination under the current security score. The Euclidean distance between each security policy vector and the target vector is calculated, for example, the target vector corresponding to the security score 35 is [160, 35], the security policy vector of algorithm A is [192, 45], and the Euclidean distance is 38.6.

[0080] Meanwhile, the execution time of the encryption algorithm is considered, and the original execution time is normalized by maximum-minimum value to obtain a normalized time value between 0 and 1. For example, if the execution time range in the algorithm library is 10 ms to 100 ms, the normalized value of the algorithm with an execution time of 40 ms is (40-10) / (100-10)=0.33. Based on the Euclidean distance and the normalized execution time, a target function value is constructed: F=w1 x Euclidean distance+w2 x normalized execution time, wherein w1 and w2 are weight coefficients, and are set according to security requirements and performance requirements. Usually, w1+w2=1.

[0081] The encryption algorithm parameters are iteratively optimized by adjustment until the target function value converges or the maximum iteration number is reached. Finally, the encryption algorithm with the minimum target function value is selected as the optimal encryption algorithm. For example, in a certain optimization, the target function value of algorithm A is 0.48, that of algorithm B is 0.52, and that of algorithm C is 0.41. Therefore, algorithm C is selected as the optimal encryption algorithm under the current terminal security score.

[0082] In an optional embodiment, the online monitoring module collects the calling timing and calling relationship between the application programs in real time to generate a continuous data stream, and constructs an adjacency matrix based on the continuous data stream to finally generate a dynamic calling graph, including:

[0083] A time window queue is constructed based on the calling timing, and the calling data and the calling relationship are input into the time window queue to generate a continuous data stream;

[0084] A globally unique identifier is allocated to each application program in the continuous data stream as a node, the processing capacity and calling state of the node are recorded, and a directed edge between the nodes is constructed in combination with the calling relationship. The processing capacity and calling state are mapped to a two-dimensional plane by using a space filling method based on a two-dimensional Z-order curve, the similarity of the node is obtained by calculating the spatial position of the node on the Z-order curve, and the nodes with similar processing capacity and calling state are grouped by using local sensitive hashing. An affinity matrix is constructed according to the similarity of the nodes in each group, the affinity matrices are spliced according to the access order of the Z-order curve to generate an adjacency matrix;

[0085] The calling data in the continuous data stream is continuously received, and when a new calling relationship is found, the corresponding node and directed edge are added in the adjacency matrix. The spatial position of the node on the Z-order curve and the similarity of the node are recalculated according to the latest processing capacity and calling state, and the node grouping is dynamically adjusted. Meanwhile, the edges that have not been called for a preset time length and the isolated nodes generated therefrom are deleted, and finally a dynamic calling graph is generated.

[0086] The online monitoring module collects the calling information between application programs in the distributed system through the way of burying points or agents, including the calling initiator identification, the called party identification, the calling time stamp and the related performance indicators. Taking the micro-service architecture as an example, when service A calls service B, (A, B, 1623142536000, 200ms) is recorded, indicating that A calls B at the time stamp 1623142536000, and the time consumption is 200ms.

[0087] When the time window queue is constructed based on the calling time sequence, the sliding window mechanism is adopted, the window size is set to 10 seconds, the sliding step is 2 seconds, a queue structure is maintained, and each window contains all the calling data in the time period. For example, the first window contains the calling data with the time stamp 1623142530000 to 1623142540000, and the second window contains the data with the time stamp 1623142532000 to 1623142542000. The window queue length is set to 30, that is, the calling information in the last 60 seconds is retained. With the arrival of new data, the head window of the queue is automatically popped out when it exceeds the retention range, so that the latest calling information is always contained in the queue, thereby forming a continuous data stream.

[0088] When each application program in the continuous data stream is allocated a globally unique identification as a node, the UUID generation mechanism is used to ensure the uniqueness of the identification in the entire distributed system. For each node, the processing capacity and the calling state are recorded. The processing capacity indicators include CPU usage, memory occupation, response time, etc.; the calling state indicators include calling frequency, success rate, error rate, etc. For example, the attributes of service A can be represented as: {processing capacity: [CPU: 30%, memory: 500MB, response time: 150ms], calling state: [calling frequency: 100 times / minute, success rate: 98%, error rate: 2%]}. Based on the calling relationship, the directed edges between nodes are constructed, and the weight of the edge represents the calling frequency or importance.

[0089] When mapping the processing capacity and the calling state to a two-dimensional plane by using a space-filling method based on a two-dimensional Z-order curve, first, normalize each index to make the value range uniform in the interval [0, 1], and select the response time in the processing capacity and the success rate in the calling state as the two coordinate axes of the two-dimensional space. For example, the normalized response time of service A is 0.3, and the success rate is 0.98, so the coordinates of service A in the two-dimensional plane are (0.3, 0.98). The Z-order curve is a space-filling curve that can map multidimensional data to one-dimensional space while maintaining the locality of the data. The two-dimensional coordinates are converted to the position on the Z-order curve, and the specific implementation is to interleave the binary representations of the two coordinates. For example, the binary representations of (0.3, 0.98) are 0.010011... and 0.111110..., respectively. After interleaving, 01.101101... is obtained, which is the spatial position of the node on the Z-order curve.

[0090] The similarity of the nodes is obtained by calculating the spatial position of the nodes on the Z-order curve. The Manhattan distance is used for similarity calculation. For example, if the position values of node A and node B on the Z-order curve are 0.42 and 0.45, respectively, their similarity is 1-|0.42-0.45|=0.97, indicating that the processing capacity and the calling state of the two nodes are very close.

[0091] The nodes with similar processing capacity and calling state are grouped by using local sensitive hashing (LSH). Multiple hash functions are used to hash the Z-order curve position values. Nodes with close positions are likely to be hashed into the same bucket. In actual implementation, 10 hash functions can be created to divide the space into 20 buckets. For example, when there are 100 nodes, 5-8 different groups can be formed, each containing 10-30 similar nodes.

[0092] An affinity matrix is constructed according to the similarity of the nodes in each group. For each group, an n x n matrix is created, where n is the number of nodes in the group, and the element a[i][j] in the matrix represents the affinity between node i and node j. For example, in group 1, nodes A, B, and C have affinities of a[A][B]=0.97, a[A][C]=0.85, and a[B][C]=0.88, respectively.

[0093] The affinity matrices are spliced according to the access order of the Z-order curve to generate a complete adjacency matrix. The access order of the Z-order curve ensures that similar nodes are adjacent in the adjacency matrix, which is beneficial for subsequent processing. The dimension of the complete adjacency matrix is N x N, where N is the number of all nodes.

[0094] Continuously receiving the invocation data in the continuous data stream, dynamically updating the adjacency matrix and the invocation graph, when discovering that service D first invokes service E, adding the corresponding directed edge in the adjacency matrix, and setting the value of the adjacency matrix element a[D][E] as the initial invocation frequency. Meanwhile, according to the processing capacity and the invocation state of the two nodes, the positions of the nodes on the Z-order curve and the similarity are calculated.

[0095] According to the latest processing capacity and invocation state, the spatial positions of the nodes on the Z-order curve and the similarity are recalculated, and the global recalculation is performed every 5 seconds. If the key indicators of a node change significantly, such as the response time increasing from 150 ms to 450 ms, an instant recalculation will be triggered to dynamically adjust the node grouping. For example, node A originally belonging to group 1 may be reallocated to group 3 due to performance degradation.

[0096] The expiration time of the edge is set to 300 seconds, and when it is detected that a certain edge has not occurred in the past 300 seconds, it is deleted from the adjacency matrix. If the deletion of the edge results in a node having no incoming edge and outgoing edge, the node becomes an isolated node and is also removed from the graph. For example, if service F has not been invoked by any service in the past 5 minutes, and has not invoked any service, all edges related to F are deleted, and F is removed from the invocation graph.

[0097] Through the above dynamic maintenance mechanism, the changes in the invocation relationship between application programs can be reflected in real time, and an accurate dynamic invocation graph can be generated to provide a basis for distributed system monitoring and anomaly detection.

[0098] In an optional implementation, an offline analysis module periodically performs clustering analysis on historical invocation data to generate an invocation link topology graph, and identifies invocation patterns in combination with a dynamic kernel function, including:

[0099] Extracting the invocation initiating service and the invocation target service recorded in the historical invocation data, concatenating them in timestamp order to form an invocation link, and integrating all the invocation links to generate an invocation link topology graph;

[0100] Counting the degrees of all nodes in the invocation link topology graph to obtain a node degree distribution, selecting any two nodes from the invocation link topology graph, counting the minimum number of nodes passed between the two nodes as an invocation path length, and constructing a path feature vector based on the node degree distribution and the invocation path length;

[0101] Inputting the path feature vector into a radial basis function and an inner product polynomial function respectively, linearly superimposing the output results to obtain a dynamic kernel function value, calculating the distance between the historical invocation data using the dynamic kernel function value, counting the number of nodes with a distance less than a preset cutoff distance to obtain a density value, and selecting a minimum distance value from the nodes with a distance greater than the density value from the current node;

[0102] determining a cluster center point according to the density value and the minimum distance value, dividing the historical invocation data to a category where the nearest cluster center point is located, and obtaining an invocation pattern.

[0103] In practical applications, a large amount of service invocation data is collected, which contains invocation initiation service identifier, invocation target service identifier, invocation timestamp, invocation parameter and other information. The offline analysis module extracts historical invocation data from the data storage system, such as obtaining all service invocation records in the past week from the database. For example, a obtained invocation record is: service A invokes service B at 2023-01-01 08:00:15, and the parameter is {user_id: 12345}.

[0104] The offline analysis module constructs an invocation link topology graph according to these invocation data. The specific implementation is to first extract the initiation service and target service identifiers in each record, and connect them in chronological order. For example, if service A invokes service B, and then service B invokes service C, a invocation link A→B→C is formed. The offline analysis module integrates all such links together to form a complete invocation link topology graph. In practical scenarios, a topology graph containing hundreds of service nodes and thousands of invocation relationships can be obtained.

[0105] After constructing the invocation link topology graph, the offline analysis module analyzes the node characteristics in the graph. For each node in the graph, the in-degree and out-degree are counted, and the node degree distribution is generated. For example, in a system containing 100 service nodes, 60% of the nodes may have a degree between 1-3, 30% of the nodes may have a degree between 4-8, and 10% of the nodes may have a degree greater than 8. The offline analysis module will use this distribution characteristic as the basis for subsequent analysis.

[0106] The offline analysis module also analyzes the invocation path length. For any two nodes in the topology graph, the minimum number of nodes passed between them is calculated as the path length. For example, if service A needs to pass through B, C, and D to reach service E, the path length is 3. By analyzing the path length between a large number of node pairs, the typical invocation depth distribution in the system can be obtained, such as 80% of the invocation path length is less than 4, 15% of the invocation path length is between 5-7, and 5% of the invocation path length is greater than 7.

[0107] Based on the node degree distribution and the calling path length, the offline analysis module constructs a path feature vector. For each calling link, the degree of each node in the link and the length of the whole link are extracted to form a feature vector. For example, for a calling link A→B→C→D, if the degree of A is 3, the degree of B is 5, the degree of C is 2, and the degree of D is 1, and the path length is 3, a feature vector [3, 5, 2, 1, 3] can be constructed.

[0108] The offline analysis module uses a dynamic kernel function to calculate the similarity between different calling paths. The dynamic kernel function is composed of a radial basis function and an inner product polynomial function. The radial basis function captures the Euclidean distance information between feature vectors, giving a higher similarity value to feature vectors that are closer to each other. The inner product polynomial function captures the similarity of the direction of the vectors by calculating the inner product of the feature vectors and performing a polynomial transformation. The outputs of the two functions are linearly superimposed to obtain the final value of the dynamic kernel function.

[0109] In a specific implementation, for two path feature vectors, a similarity value is first calculated by the radial basis function, and another similarity value is then calculated by the inner product polynomial function. Then, the two values are weighted and summed according to a preset weight to obtain the final value of the dynamic kernel function. For example, for the feature vectors [3, 5, 2, 1, 3] and [4, 6, 2, 2, 3], the radial basis function value obtained may be 0.85, and the inner product polynomial function value obtained may be 0.92. If the weights of the two are the same, the dynamic kernel function value is 0.885.

[0110] Using the dynamic kernel function value, the offline analysis module calculates the distance between the historical calling data. The distance is defined as 1 minus the dynamic kernel function value, so the greater the kernel function value, the smaller the distance. For example, if the dynamic kernel function value is 0.885, the distance is 0.115.

[0111] The offline analysis module sets a cutoff distance threshold, such as 0.2, and counts the number of other data points with a distance less than the threshold from each data point. This number is defined as the density value of the point. For example, if the distance of a calling path from other 50 paths is less than 0.2, the density value of the path is 50.

[0112] After calculating the density values of all data points, the offline analysis module finds the smallest distance from each data point to all data points with a density value greater than that of the data point. For example, for a data point A with a density value of 50, if the distance to data point B is the smallest among all data points with a density value greater than 50, and the distance is 0.15, then the minimum distance of A is recorded as 0.15.

[0113] According to the density value and the minimum distance, the offline analysis module identifies the cluster center point. Specifically, a point with a higher density value and a larger minimum distance is selected as the cluster center. For example, a density threshold is set as the average density value in the system, and a distance threshold is set as the average minimum distance in the system. A point that simultaneously satisfies the density value being greater than the density threshold and the minimum distance being greater than the distance threshold is determined as the cluster center point.

[0114] After determining the cluster center point, the offline analysis module assigns each data point to the category in which the nearest cluster center is located. For example, if the distance between data point A and cluster center C1 is 0.1, the distance between data point A and cluster center C2 is 0.3, and the distance between data point A and cluster center C3 is 0.2, then A is divided into the category in which C1 is located.

[0115] Through the above clustering process, the offline analysis module divides the historical call data into different categories, and each category represents a call mode. For example, different call modes such as "read-write separation type", "cache access type", and "compute-intensive type" can be identified. These call mode information will be used for subsequent anomaly detection and system optimization.

[0116] In an optional implementation, the online and offline analysis results are fused to determine a key program node, extract a running feature of the key program node, and calculate a risk coefficient, including:

[0117] extracting a call path from the dynamic call graph and calculating a path importance based on an edge weight of the call path and a density value in the call mode;

[0118] recursively decomposing the call path according to the path importance to generate a key path set, extracting a frequency and position information of a node in the key path in the key path set to generate a node key degree, and determining a node with a maximum node key degree as a key program node;

[0119] for the key program node, collecting a call timing mode and a response time sequence in a running process, extracting a distribution feature of the call timing mode to generate a timing entropy, and extracting the response time sequence to generate a timing stability feature;

[0120] generating a state space graph by taking the timing entropy as a state node and the timing stability feature as a transition boundary, generating a state transition matrix based on a transition direction between adjacent timing entropies, extracting a feature value sequence from the state transition matrix to generate a state persistence, identifying a maximum connected subgraph in the state space graph to generate a state convergence degree, and calculating a risk coefficient based on the state persistence and the state convergence degree.

[0121] The method first extracts the call path from the dynamic call graph, which is a directed graph composed of method call relationships during program execution, where nodes represent methods and edges represent call relationships. The edge weight reflects the call frequency and importance. For example, in an e-commerce system, the call edge weight of the core transaction service is 0.85 on the call path from user login to order payment, while the call edge weight of non-critical functions such as log recording is 0.23. At the same time, the density value in the call pattern is analyzed, which represents the connection tightness between nodes in the call path. For the above e-commerce scenario, the density value of the transaction core process is 0.92, indicating a high degree of coupling between components. Based on the edge weight and density value, the path importance is calculated, for example, the importance of the core payment path is 0.89, while the importance of the user browsing path is 0.45.

[0122] The call path is recursively decomposed according to the path importance to generate a set of critical paths, and the recursive decomposition process starts from the highest importance path and gradually includes the next highest importance path until all important paths are covered. In the e-commerce system example, a set of 5 critical paths including "user verification - product selection - inventory confirmation - payment processing - order creation" is generated. In these critical paths, the frequency and position information of the node in the critical path are extracted. For example, the payment processing node appears 4 times in the 5 critical paths and appears multiple times in the critical position of the path, so its node criticality is 0.78; while the log recording node has a high frequency but the position is not important, the node criticality is only 0.23. The payment processing node with the maximum node criticality is determined as the critical program node.

[0123] For the determined critical program node, the call timing pattern and response time sequence during its running process are collected, the call timing pattern records the time sequence characteristics of the node being called, for example, the payment processing node is called 20-25 times per minute in normal state, the peak period reaches 40-45 times, and presents regular fluctuations. The response time sequence records the time required for the node to respond to the request, and the response time of the payment processing node is 15-40 milliseconds under normal circumstances, with stable fluctuation range.

[0124] The distribution characteristics are extracted from the call timing pattern to generate the timing entropy, which reflects the uncertainty and complexity of the call pattern. Under normal circumstances, the timing entropy value of the payment processing node is 2.34, indicating that its call pattern is relatively stable and predictable; when attacked, the timing entropy value rises to 4.56, indicating that the call pattern becomes irregular and chaotic. At the same time, the timing stability features are extracted from the response time sequence, including the fluctuation range, change rate, etc. of the response time. Under normal circumstances, the timing stability feature value of the payment processing node is 0.15, indicating that the response time fluctuation is small; under abnormal circumstances, the value rises to 0.67, indicating that the response time fluctuation increases significantly.

[0125] The time series entropy is taken as a state node, and the time series stability feature is taken as a transition boundary to generate a state space graph, for example, when the time series entropy is in the interval of 2.0-2.5 and the time series stability feature is in the interval of 0.1-0.2, it is in a "stable state"; when the time series entropy is in the interval of 3.5-4.5 and the time series stability feature is in the interval of 0.5-0.7, it is in a "high-risk state". Based on the transition direction between adjacent time series entropies in the state space graph, a state transition matrix is generated to record the probability of transition from one state to another. For example, the probability of transition from the "stable state" to the "slight fluctuation state" is 0.23, and the probability of transition to the "high-risk state" is only 0.03.

[0126] From the state transition matrix, a feature value sequence is extracted to generate a state persistence, which represents the length of time that a state is maintained, for example, the persistence of the "stable state" is 0.85, indicating that it can be maintained stably for a long time; and the persistence of the "high-risk state" is 0.32, indicating that it will not be in a high-risk state for a long time. The maximum connected subgraph in the state space graph is identified to generate a state convergence degree. The state convergence degree represents the ability to recover from an arbitrary state to a stable state, for example, the state convergence degree of a normal system is 0.79, indicating that it has strong self-recovery ability.

[0127] Finally, based on the state persistence and the state convergence degree, a risk coefficient is calculated, which comprehensively considers the stability and recovery ability of the system state, and is a comprehensive index for measuring the safety risk of the system. For example, when the state persistence is 0.85 and the state convergence degree is 0.79, the calculated risk coefficient is 0.18, indicating that the system risk is low; when the state persistence decreases to 0.32 and the state convergence degree decreases to 0.25, the risk coefficient increases to 0.76, indicating that there is a serious safety risk.

[0128] Through the above process, the method can effectively identify the key nodes in the program, monitor the running features, and timely discover potential safety risks, thereby providing strong protection for system safety.

[0129] The second aspect of the embodiment of the application provides a system online and offline authorization scheme design and implementation system, which comprises:

[0130] A first unit is configured to acquire state information of a user terminal, collect real-time resource data when it is detected that the user terminal is in an online state, and read resource data at the last online time from a local cache when it is detected that the user terminal is in an offline state.

[0131] The second unit is configured to draw a load curve by using the resource data, calculate a curve inflection point and a fluctuation period, extract a characteristic value in the fluctuation period, and calculate a terminal security score in combination with the state information; map the terminal security score with a preset encryption algorithm library to generate an encryption strategy matrix, select an optimal encryption algorithm based on the encryption strategy matrix, generate a security encryption code, and establish an encrypted communication channel.

[0132] The third unit is configured to construct an online monitoring module and an offline analysis module of an application program call chain when receiving authorization pass information returned by the server; the online monitoring module collects a call timing and a call relationship between the application programs in real time to generate a continuous data stream, constructs an adjacency matrix based on the continuous data stream, and finally generates a dynamic call graph; the offline analysis module periodically performs clustering analysis on historical call data to generate a call link topology graph, identifies a call mode in combination with a dynamic kernel function; and fuses online and offline analysis results to determine a key program node, extract a running feature of the key program node, calculate a risk coefficient, and generate an authorization key based on the key program node and the risk coefficient.

[0133] The fourth unit is configured to send the authorization key to a user terminal, monitor a verifier state, and dynamically adjust an authorization strategy according to a terminal online and offline state.

[0134] The third aspect of the embodiment of the present application provides an electronic device, comprising:

[0135] a processor;

[0136] a memory for storing processor-executable instructions;

[0137] The processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0138] The fourth aspect of the embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon, and the computer program instructions are executed by a processor to implement the method described above.

[0139] The present application can be a method, device, system and / or computer program product. The computer program product can include a computer readable storage medium having computer readable program instructions loaded thereon for executing various aspects of the present application.

[0140] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and are not intended to limit the present application; although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions recorded in the above embodiments can be modified, or some or all of the technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A system online and offline authorization scheme design and implementation method, characterized in that, The method comprises the following steps: acquiring state information of a user terminal, collecting real-time resource data when detecting that the user terminal is in an online state; reading resource data at the last online time from a local cache when detecting that the user terminal is in an offline state; drawing a load curve using the resource data, calculating a curve inflection point and a fluctuation period, extracting a feature value in the fluctuation period, and calculating a terminal security score in combination with the state information; establishing a mapping relationship between the terminal security score and a preset encryption algorithm library, generating an encryption strategy matrix, selecting an optimal encryption algorithm based on the encryption strategy matrix, generating a security encryption password, and establishing an encrypted communication channel; when receiving authorization pass information returned by a server, constructing an online monitoring module and an offline analysis module of an application program call chain; the online monitoring module collects call timing and call relationship among application programs in real time, generates a continuous data stream, constructs an adjacency matrix based on the continuous data stream, and finally generates a dynamic call graph; the offline analysis module periodically performs clustering analysis on historical call data, generates a call link topology graph, identifies a call mode in combination with a dynamic kernel function, determines a key program node, extracts a running feature of the key program node, calculates a risk coefficient, and generates an authorization key based on the key program node and the risk coefficient; sending the authorization key to the user terminal, monitoring a checker state, and dynamically adjusting an authorization strategy according to an online / offline state of the user terminal.

2. The method of claim 1, wherein, The method for calculating a terminal security score using resource data to draw a load curve, calculating a curve inflection point and a fluctuation period, and extracting a feature value in the fluctuation period comprises the following steps: dividing the resource data into adjacent time intervals based on a preset time axis, and generating a load curve by using a polynomial segmentation mapping that meets a second-order smoothness constraint; performing curvature analysis based on the load curve to obtain curvature distribution characteristics of the load curve, generating a dynamic curvature threshold value according to the curvature distribution characteristics, and marking time points in the load curve at which the curvature value exceeds the dynamic curvature threshold value as an inflection point sequence; pairing adjacent inflection points in the inflection point sequence, calculating a time interval between the paired inflection points to obtain a fluctuation duration, and extracting an amplitude change of the curve between the paired inflection points to obtain a fluctuation intensity; organizing the fluctuation duration and the fluctuation intensity of each pair of paired inflection points into a feature matrix in chronological order, calculating a corresponding feature weight based on the information entropy distribution of each feature dimension in the feature matrix, and generating a terminal security score in combination with the fluctuation features in the feature matrix.

3. The method of claim 1, wherein, The method for establishing a mapping relationship between the terminal security score and a preset encryption algorithm library, generating an encryption strategy matrix, and selecting an optimal encryption algorithm based on the encryption strategy matrix comprises the following steps: extracting a key length and a calculation complexity of each encryption algorithm in the preset encryption algorithm library to generate an encryption algorithm feature set; dividing a numerical interval of the terminal security score, setting a mapping reference point in the numerical interval, establishing a corresponding relationship between the mapping reference point and the encryption algorithm feature set, and extending the corresponding relationship to the entire numerical interval to form a complete mapping relationship; A segmented nonlinear activation function is set, segmented activation is performed in each numerical interval of the mapping relationship, a smooth constraint is applied at the junction of the numerical intervals, a deviation degree of the terminal security score in the numerical interval is calculated, the deviation degree is input into an exponential decay rule to determine a characteristic coefficient, numerical upper and lower limits of the characteristic coefficient are calibrated, a mapping matrix is constructed based on the characteristic coefficient and the segmented nonlinear activation function, and the mapping matrix is applied to the encryption algorithm feature set to output an encryption strategy matrix; A security policy vector and an execution time of each encryption algorithm in the encryption strategy matrix are extracted, an Euclidean distance between each security policy vector and a target vector is calculated, a target function value is constructed based on the Euclidean distance and the execution time after normalization processing, encryption algorithm parameters are iteratively updated until convergence by using the target function value, and an encryption algorithm with the minimum target function value is selected as an optimal encryption algorithm.

4. The method of claim 1, wherein, An online monitoring module collects calling timing and calling relationship between application programs in real time, generates a continuous data stream, constructs an adjacency matrix based on the continuous data stream, and finally generates a dynamic calling graph, including: A time window queue is constructed based on the calling timing, calling data and the calling relationship are input into the time window queue, and a continuous data stream is generated; A globally unique identifier is allocated to each application program in the continuous data stream as a node, the processing capacity and calling state of the node are recorded, a directed edge between nodes is constructed in combination with the calling relationship, the processing capacity and calling state are mapped to a two-dimensional plane by using a space filling method based on a two-dimensional Z-order curve, the similarity of the node is obtained by calculating the spatial position of the node on the Z-order curve, and nodes with similar processing capacity and calling state are grouped by using local sensitive hashing; an affinity matrix is constructed according to the similarity of the nodes in each group, the affinity matrices are spliced according to the access order of the Z-order curve, and an adjacency matrix is generated; Calling data in the continuous data stream is continuously received, and when a new calling relationship is found, corresponding nodes and directed edges are added in the adjacency matrix; the spatial position of the node on the Z-order curve and the similarity of the node are recalculated according to the latest processing capacity and calling state, and the node grouping is dynamically adjusted; meanwhile, edges that have not been called for a preset time length and isolated nodes generated therefrom are deleted, and finally a dynamic calling graph is generated.

5. The method of claim 1, wherein, An offline analysis module periodically performs cluster analysis on historical calling data, generates a calling link topology graph, and identifies a calling mode in combination with a dynamic kernel function, including: A calling initiator service and a calling target service recorded in the historical calling data are extracted, are concatenated in a timestamp order to form a calling link, and all calling links are integrated to generate a calling link topology graph; The degree distribution of all nodes in the calling link topology graph is obtained by counting the degrees of all nodes in the calling link topology graph, any two nodes are selected from the calling link topology graph, the minimum number of nodes passed between the two nodes is counted and is recorded as a calling path length, and a path feature vector is constructed based on the node degree distribution and the calling path length; The path feature vectors are respectively input into a radial basis function and an inner product polynomial function, and a dynamic kernel function value is obtained by linear superposition of output results; distances between the historical calling data are calculated using the dynamic kernel function value, and a density value is obtained by counting the number of nodes with distances less than a preset cut-off distance; and a minimum distance value is selected from nodes with a density value greater than the density value; A cluster center point is determined according to the density value and the minimum distance value, and the historical calling data are divided into a category of the nearest cluster center point to obtain a calling mode.

6. The method of claim 1, wherein, The online and offline analysis results are fused to determine a key program node, and running features of the key program node are extracted to calculate a risk coefficient, including: A calling path is extracted from the dynamic calling graph, and a path importance is calculated based on an edge weight of the calling path and a density value in the calling mode; The calling path is recursively decomposed according to the path importance to generate a key path set; a node key degree is generated by extracting a frequency and position information of a node in a key path in the key path set; and a node with a maximum node key degree is determined as a key program node; For the key program node, a calling timing mode and a response time sequence in a running process are collected, a timing entropy is generated by extracting a calling timing mode distribution feature, and a timing stability feature is generated by extracting a response time sequence; The timing entropy is taken as a state node, and the timing stability feature is taken as a transition boundary to generate a state space graph; a state transition matrix is generated based on a transition direction between adjacent timing entropies; a feature value sequence is extracted from the state transition matrix to generate a state persistence degree; a maximum connected subgraph in the state space graph is identified to generate a state convergence degree; and a risk coefficient is calculated based on the state persistence degree and the state convergence degree.

7. A system for online and offline authorization scheme design and implementation system for implementing the method according to any one of claims 1-6, characterized in that, Including: A first unit is configured to acquire state information of a user terminal, collect real-time resource data when it is detected that the user terminal is in an online state, and read resource data at the last online time from a local cache when it is detected that the user terminal is in an offline state; A second unit is configured to draw a load curve using the resource data, calculate a curve inflection point and a fluctuation period, extract a feature value in the fluctuation period, and calculate a terminal security score in combination with the state information; A mapping relationship between the terminal security score and a preset encryption algorithm library is established to generate an encryption strategy matrix, an optimal encryption algorithm is selected based on the encryption strategy matrix, a security encryption code is generated, and an encrypted communication channel is established; A third unit is configured to construct an online monitoring module and an offline analysis module of an application program calling chain when authorization pass information returned by a server is received. ​ The online monitoring module collects the calling timing and calling relationship among the application programs in real time, generates a continuous data stream, constructs an adjacency matrix based on the continuous data stream, and finally generates a dynamic calling graph; the offline analysis module periodically performs clustering analysis on historical calling data, generates a calling link topology graph, identifies a calling mode in combination with a dynamic kernel function; the online and offline analysis results are fused to determine a key program node, extract a running feature of the key program node, calculate a risk coefficient, and generate an authorization key based on the key program node and the risk coefficient; The fourth unit is configured to send the authorization key to a user terminal, monitor a checker state, and dynamically adjust an authorization strategy according to an online or offline state of the terminal.

8. An electronic device, comprising: The computer program instructions are executed by the processor to implement the method in any one of claims 1 to 6. The computer program instructions are executed by the processor to implement the method in any one of claims 1 to 6. ​ ​ 9. A computer-readable storage medium having stored thereon computer program instructions, wherein, ​

Images