A terminal security evaluation method, system, device and medium based on a nonlinear mapping technique

Abstract

The application discloses a terminal security evaluation method and system based on a nonlinear mapping technology, equipment and a medium, mainly relates to the technical field of terminal security evaluation, and is used to solve the problems that the existing scheme has single risk evaluation mode, is easy to cause secondary disclosure risk, and the risk response mechanism is lagging behind. Including: obtaining real-time data of terminal preset risk dimension, determining whether the real-time data meets the preset risk trigger condition; when the preset risk trigger condition is met, the risk scoring mode is entered: obtaining the nonlinear calculation formula corresponding to the specific preset risk trigger condition triggered, extracting the corresponding real-time data, and then obtaining the triggered risk score by using the nonlinear calculation formula; when the risk scoring mode is not entered, the comprehensive risk score is obtained by weighting according to the real-time data of the preset risk dimension; according to the falling interval of the triggered risk score or the comprehensive risk score, the security risk level of the current terminal is determined.

Description

Technical Field

[0001] This application relates to the field of terminal security assessment technology, and in particular to a terminal security assessment method, system, device and medium based on nonlinear mapping technology. Background Technology

[0002] The existing endpoint security assessment system mainly revolves around four core scenarios: confidential document governance, attack behavior defense, internet behavior control, and device usage compliance. It achieves risk monitoring through a collaborative model of local endpoint data collection and centralized analysis on a management platform.

[0003] Traditional endpoint security assessment methods reveal significant shortcomings in dynamic threat environments: Their risk assessment models are simplistic, relying solely on static rules or fixed thresholds, making them ill-suited to complex and ever-changing attack methods, resulting in high false negative rates. During sensitive information transmission, plaintext or weak encryption of data during the assessment phase can easily lead to secondary leaks, exacerbating security threats. Furthermore, risk response mechanisms are lagging, relying on periodic scanning or post-incident analysis, failing to capture sudden security threats in real time, such as zero-day attacks or advanced persistent threats, leading to reactive defense. Summary of the Invention

[0004] This application provides a terminal security assessment method, system, device, and medium based on nonlinear mapping technology to solve the problems of existing solutions having a single risk assessment mode, being prone to secondary leakage risks, and having a lagging risk response mechanism.

[0005] Firstly, this application provides a terminal security assessment method based on nonlinear mapping technology, the method comprising:

[0006] Acquire real-time data for the terminal's preset risk dimensions and determine whether the real-time data meets the preset risk trigger conditions; when the preset risk trigger conditions are met, enter the risk scoring mode:

[0007] Obtain the nonlinear calculation formula corresponding to the specific preset risk triggering conditions, extract the corresponding real-time data, and then use the nonlinear calculation formula to obtain the trigger risk score.

[0008] When the risk scoring mode is not activated, a comprehensive risk score is obtained by weighting real-time data based on preset risk dimensions.

[0009] The current security risk level of the terminal is determined based on the range in which the trigger risk score or the comprehensive risk score falls.

[0010] In one implementation of this application, the preset risk dimensions include at least: the number of medium-risk file suspicion alarms, alarm frequency, and probability of being remotely controlled within a preset window time period;

[0011] Acquire real-time data for preset risk dimensions on the terminal, and determine whether the real-time data meets the preset risk triggering conditions, specifically including:

[0012] The system obtains the number of alarms related to the suspected medium-risk files, the alarm frequency, and the probability of remote control of the terminal within a preset window time period.

[0013] If the number of medium-risk document suspicion alarms is less than the baseline threshold for the number of medium-risk documents, the alarm frequency is less than the baseline threshold for alarm frequency, and the probability of being remotely controlled is less than the baseline threshold for the probability of being controlled, then the preset risk triggering conditions are not met; otherwise, the preset risk triggering conditions are met.

[0014] In one implementation of this application, the nonlinear calculation formula corresponding to the specific preset risk triggering condition is obtained, the corresponding real-time data is extracted, and then the triggering risk score is obtained using the nonlinear calculation formula, specifically including:

[0015] When the specific preset risk trigger condition is that the number of suspected medium-risk file alerts within a preset window time period is greater than or equal to a preset benchmark threshold for the number of medium-risk files, the trigger condition is determined by the formula:

[0016] score_file = HIGH_RISK_START + min((fileCount - BASE_SUSPECTED_FILES) / step_file, MAX_SCORE - HIGH_RISK_START), calculates the first risk score score_file; where HIGH_RISK_START represents the starting value of the preset risk range, fileCount represents the number of medium-risk file suspicion alarms, BASE_SUSPECTED_FILES represents the preset baseline threshold for the number of medium-risk files, step_file represents the length of the first step, and step_file = (MAX_SCORE - HIGH_RISK_START) / (MAX_FILE_COUNT - BASE_SUSPECTED_FILES), MAX_SCORE represents the ending value of the preset risk range, and MAX_FILE_COUNT represents the preset high-risk upper limit for the number of medium-risk files;

[0017] When the specific preset risk trigger condition is that the alarm frequency within a preset window time period is greater than or equal to the alarm frequency baseline threshold, the following formula is used:

[0018] score_freq = HIGH_RISK_START + min((alertFreq - BASE_ALERT_FREQUENCY) / step_freq, MAX_SCORE - HIGH_RISK_START), calculates the second risk score score_freq; where alertFreq represents the alarm frequency, BASE_ALERT_FREQUENCY represents the baseline threshold for alarm frequency, step_freq represents the second step size, and step_freq = BASE_ALERT_FREQUENCY / (MAX_SCORE - HIGH_RISK_START);

[0019] When the specific preset risk trigger condition is that the probability of being remotely controlled is greater than or equal to the baseline threshold of the controlled probability within a preset window time period, the following formula is used:

[0020] score_prob = HIGH_RISK_START + min((ctrlProb - BASE_CTRL_PROBABILITY) / step_prob, MAX_SCORE - HIGH_RISK_START), calculates the third risk score score_prob; where ctrlProb represents the probability of being remotely controlled, BASE_CTRL_PROBABILITY represents the baseline threshold for the probability of being controlled, step_prob represents the third step size, and step_prob = (1.0 - BASE_CTRL_PROBABILITY) / (MAX_SCORE - HIGH_RISK_START);

[0021] When there is only one specific preset risk trigger condition, the calculated risk score is the trigger risk score; otherwise, the maximum value is taken as the trigger risk score.

[0022] When fileCount>0, alertFreq>0, ctrlProb>0, usageFreq>0, or disposalRate<1.0, and the trigger risk score is less than the preset minimum value, the trigger risk score is determined to be the preset minimum value; where usageFreq represents the terminal usage frequency threshold, and disposalRate represents the alarm handling rate.

[0023] When the trigger risk score is greater than the preset maximum value, the trigger risk score is determined to be the preset maximum value.

[0024] In one implementation of this application, when the risk scoring mode is not entered, a weighted comprehensive risk score is obtained based on real-time data from preset risk dimensions, specifically including:

[0025] Through the formula:

[0026] norm_file=min(fileCount / BASE_SUSPECTED_FILES,1.0)、

[0027] norm_freq=min(alertFreq / BASE_ALERT_FREQUENCY,1.0)、

[0028] norm_prob=min(max(ctrlProb,0.0),1.0)、

[0029] norm_usage=min(usageFreq / BASE_USAGE_FREQUENCY,1.0)、

[0030] norm_disposal=1.0-min(max(disposalRate,0.0),1.0);

[0031] The calculations include the normalized number of risk files (norm_file), the normalized alarm frequency (norm_freq), the normalized controlled probability (norm_prob), the normalized usage frequency (norm_usage), and the normalized alarm disposal rate (norm_disposal).

[0032] Among them, fileCount represents the number of alarms for medium-risk files, BASE_SUSPECTED_FILES represents the preset baseline threshold for the number of medium-risk files, alertFreq represents the alarm frequency, BASE_ALERT_FREQUENCY represents the baseline threshold for alarm frequency, ctrlProb represents the probability of being remotely controlled, usageFreq represents the terminal usage frequency, BASE_USAGE_FREQUENCY represents the terminal usage frequency threshold, and disposalRate represents the alarm handling rate.

[0033] Through the formula:

[0034] weighted_sum = norm_file × weight_file + norm_freq × weight_freq + norm_prob × weight_prob + norm_usage × weight_usage + norm_disposal × weight_disposal, and the initial comprehensive risk score weighted_sum is obtained by weighting.

[0035] Among them, weight_file, weight_freq, weight_prob, weight_usage, and weight_disposal represent the preset weights;

[0036] Through the formula:

[0037] score_regular = round( min( max( weighted_sum, 0.0 ), 1.0 ) × (HIGH_RISK_START-1) ), which maps the initial comprehensive risk score to the interval [0, HIGH_RISK_START-1] to obtain the comprehensive risk score;

[0038] When fileCount>0, alertFreq>0, ctrlProb>0, usageFreq>0, or disposalRate<1.0, and the overall risk score is less than the preset minimum value, the preset minimum value is determined to be the overall risk score.

[0039] When the overall risk score is greater than the preset maximum value, the overall risk score is determined to be the preset maximum value.

[0040] In one implementation of this application, the security risk level of the current terminal is determined based on the range in which the trigger risk score or the comprehensive risk score falls, specifically including:

[0041] When the trigger risk score or the comprehensive risk score falls within the range [0, A), the current terminal's security risk level is determined to be no risk.

[0042] When the trigger risk score or comprehensive risk score falls within the range [A, B), the current terminal's security risk level is determined to be low risk.

[0043] When the trigger risk score or comprehensive risk score falls within the range [B, C), the current terminal's security risk level is determined to be medium risk.

[0044] When the trigger risk score or comprehensive risk score falls within the range of [C,D], the current terminal's security risk level is determined to be high risk.

[0045] And A < B < C < D.

[0046] In one implementation of this application, before obtaining real-time data of a preset risk dimension from the terminal and determining whether the real-time data meets the preset risk triggering conditions, the method further includes:

[0047] Configure the preset risk trigger conditions, including the preset threshold for the number of medium-risk files, the starting value of the preset risk range, the ending value of the preset risk range, the preset high-risk upper limit for the number of medium-risk files, the alarm frequency benchmark threshold, the controlled probability benchmark threshold, the terminal usage frequency threshold, and the specific range values ​​of the ranges to be entered for each security risk level.

[0048] Secondly, this application provides a terminal security assessment system based on nonlinear mapping technology, the system comprising:

[0049] The determination module is used to acquire real-time data of preset risk dimensions from the terminal and determine whether the real-time data meets preset risk trigger conditions; when the preset risk trigger conditions are met, the risk scoring mode is entered.

[0050] The acquisition module is used to obtain the nonlinear calculation formula corresponding to the specific preset risk triggering conditions, extract the corresponding real-time data, and then use the nonlinear calculation formula to obtain the trigger risk score.

[0051] The weighting module is used to obtain a comprehensive risk score by weighting real-time data based on preset risk dimensions when the risk scoring mode is not entered.

[0052] The rating module is used to determine the current security risk level of the terminal based on the range in which the trigger risk score or the comprehensive risk score falls.

[0053] In one implementation of this application, the determining module includes a determining unit.

[0054] Used to obtain the number of alarms, alarm frequency, and probability of remote control of medium-risk files on the terminal within a preset window time period;

[0055] If the number of medium-risk document suspicion alarms is less than the baseline threshold for the number of medium-risk documents, the alarm frequency is less than the baseline threshold for alarm frequency, and the probability of being remotely controlled is less than the baseline threshold for the probability of being controlled, then the preset risk triggering conditions are not met; otherwise, the preset risk triggering conditions are met.

[0056] Thirdly, this application provides a terminal security assessment device based on nonlinear mapping technology, the device comprising:

[0057] processor;

[0058] And a memory that stores executable code, which, when executed, causes the processor to perform a terminal security assessment method based on nonlinear mapping technology, as described above.

[0059] Fourthly, this application provides a non-volatile computer storage medium storing computer instructions thereon, which, when executed, implement a terminal security assessment method based on nonlinear mapping technology as described above.

[0060] As can be seen from the above technical solutions, this application has the following advantages:

[0061] I. Diversified risk assessment models to improve assessment accuracy:

[0062] This invention diversifies risk assessment models by introducing nonlinear calculation formulas and a comprehensive risk scoring mechanism. The system can not only conduct specific assessments for particular risk triggering conditions, but also obtain a comprehensive risk score through weighted calculation, thus forming a multi-level, multi-dimensional risk assessment system. This diversified assessment model overcomes the problem of the single risk assessment model in traditional methods, and can more comprehensively reflect the security status of the terminal. Specifically, through real-time data monitoring of preset risk dimensions, combined with specific risk scoring and comprehensive risk assessment, the system can more accurately identify and assess various security threats faced by the terminal, providing a more reliable basis for security decision-making.

[0063] II. Avoid secondary leaks caused by the transmission of sensitive information:

[0064] Compared to existing technologies, there is no need to transmit file content (including file name, file summary, etc.). The risk of the terminal can be assessed simply by secondary analysis of the results of the terminal's file scan, combined with dimensions such as attack and internet behavior.

[0065] Third, achieve real-time risk response and eliminate response lag issues:

[0066] Through a real-time monitoring mechanism with preset risk trigger conditions, the system immediately activates risk scoring mode upon detecting any abnormal data, avoiding the time delays associated with traditional periodic scanning. This immediate response mechanism allows the system to intervene as soon as security threats emerge, effectively preventing the spread of security incidents. Specifically, when the system detects real-time data that meets preset risk trigger conditions, it immediately enters risk scoring mode, using a non-linear calculation formula to quickly calculate a risk score, thereby achieving real-time detection and handling of sudden security threats. This real-time capability enhances the overall security protection level of the terminal system. Attached Figure Description

[0067] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0068] Figure 1 This is a flowchart of a terminal security assessment method based on nonlinear mapping technology provided in an embodiment of this application.

[0069] Figure 2 This is a schematic diagram of the internal structure of a terminal security assessment system based on nonlinear mapping technology provided in an embodiment of this application.

[0070] Figure 3 This is a schematic diagram of the internal structure of a terminal security assessment device based on nonlinear mapping technology provided in an embodiment of this application. Detailed Implementation

[0071] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0072] Those skilled in the art should understand that the embodiments described below are merely preferred embodiments of this disclosure and do not imply that this disclosure can only be implemented through these preferred embodiments. These preferred embodiments are merely used to explain the technical principles of this disclosure and are not intended to limit the scope of protection of this disclosure. Based on the preferred embodiments provided by this disclosure, all other embodiments obtained by those skilled in the art without creative effort should still fall within the scope of protection of this disclosure.

[0073] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0074] The technical solutions proposed in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0075] The embodiment provides a terminal security assessment method based on nonlinear mapping technology, such as Figure 1 As shown in the embodiments of this application, the method mainly includes the following steps:

[0076] Step 110: Obtain real-time data of the terminal's preset risk dimensions and determine whether the real-time data meets the preset risk triggering conditions; when the preset risk triggering conditions are met, enter the risk scoring mode.

[0077] In some embodiments, the preset risk dimensions include at least: the number of medium-risk file suspicion alarms, alarm frequency, and probability of being remotely controlled within a preset window time period;

[0078] Acquire real-time data for preset risk dimensions on the terminal, and determine whether the real-time data meets the preset risk triggering conditions, specifically including:

[0079] The system obtains the number of alarms related to the suspected medium-risk files, the alarm frequency, and the probability of remote control of the terminal within a preset window time period.

[0080] If the number of medium-risk document suspicion alarms is less than the baseline threshold for medium-risk document count (e.g., 20), the alarm frequency is less than the baseline threshold for alarm frequency (e.g., 5.0 times / second), and the probability of being remotely controlled is less than the baseline threshold for controlled probability (e.g., 0.8), then the preset risk triggering conditions are not met; otherwise, the preset risk triggering conditions are met.

[0081] Before acquiring real-time data of the terminal's preset risk dimensions and determining whether the real-time data meets the preset risk triggering conditions, the method also includes:

[0082] Configure the preset risk trigger conditions, including the preset threshold for the number of medium-risk files, the starting value of the preset risk range, the ending value of the preset risk range, the preset high-risk upper limit for the number of medium-risk files, the alarm frequency benchmark threshold, the controlled probability benchmark threshold, the terminal usage frequency threshold, and the specific range values ​​of the ranges to be entered for each security risk level.

[0083] Step 120: Obtain the nonlinear calculation formula corresponding to the specific preset risk triggering conditions, extract the corresponding real-time data, and then use the nonlinear calculation formula to obtain the trigger risk score.

[0084] As an example, this step can be specifically described as follows:

[0085] When the specific preset risk trigger condition is that the number of suspected medium-risk file alerts within a preset window time period is greater than or equal to a preset benchmark threshold for the number of medium-risk files, the trigger condition is determined by the formula:

[0086] score_file = HIGH_RISK_START + min((fileCount - BASE_SUSPECTED_FILES) / step_file, MAX_SCORE - HIGH_RISK_START), calculates the first risk score score_file; where HIGH_RISK_START represents the starting value of the preset risk range (e.g., 90 points), fileCount represents the number of medium-risk file suspicion alarms, BASE_SUSPECTED_FILES represents the preset baseline threshold for the number of medium-risk files, step_file represents the length of the first step, and step_file = (MAX_SCORE - HIGH_RISK_START) / (MAX_FILE_COUNT - BASE_SUSPECTED_FILES), MAX_SCORE represents the ending value of the preset risk range (e.g., 96 points), MAX_FILE_COUNT represents the preset high-risk upper limit for the number of medium-risk files (e.g., 38), and step_file = 3;

[0087] Example: fileCount=20 (benchmark) → 90 points, fileCount=23 → 91 points, ..., fileCount=38 → 96 points.

[0088] When the specific preset risk trigger condition is that the alarm frequency within a preset window time period is greater than or equal to the alarm frequency baseline threshold, the following formula is used:

[0089] score_freq = HIGH_RISK_START + min((alertFreq - BASE_ALERT_FREQUENCY) / step_freq, MAX_SCORE - HIGH_RISK_START), calculates the second risk score score_freq; where alertFreq represents the alarm frequency, BASE_ALERT_FREQUENCY represents the baseline threshold for alarm frequency, step_freq represents the second step size, and step_freq = BASE_ALERT_FREQUENCY / (MAX_SCORE - HIGH_RISK_START);

[0090] Example: alertFreq=5.0 (benchmark) → 90 points, alertFreq=5.83 → 91 points, ..., alertFreq=10.0 → 96 points.

[0091] When the specific preset risk trigger condition is that the probability of being remotely controlled is greater than or equal to the baseline threshold of the controlled probability within a preset window time period, the following formula is used:

[0092] score_prob = HIGH_RISK_START + min((ctrlProb - BASE_CTRL_PROBABILITY) / step_prob, MAX_SCORE - HIGH_RISK_START), calculates the third risk score score_prob; where ctrlProb represents the probability of being remotely controlled, BASE_CTRL_PROBABILITY represents the baseline threshold for the probability of being controlled, step_prob represents the third step size, and step_prob = (1.0 - BASE_CTRL_PROBABILITY) / (MAX_SCORE - HIGH_RISK_START);

[0093] Example: ctrlProb=0.8 (benchmark) → 90 points, ctrlProb=0.833 → 91 points, ..., ctrlProb=1.0 → 96 points.

[0094] When there is only one specific preset risk triggering condition, the calculated risk score is the trigger risk score; otherwise, the maximum value is taken as the trigger risk score (the maximum value among score_file, score_freq, and score_prob is taken as the final score of the high-risk mode to ensure that the score is not lowered by other dimensions when the core risk dimension meets the standard).

[0095] When fileCount>0, alertFreq>0, ctrlProb>0, usageFreq>0, or disposalRate<1.0, and the trigger risk score is less than the preset minimum value, the trigger risk score is determined to be the preset minimum value; where usageFreq represents the terminal usage frequency threshold, and disposalRate represents the alarm handling rate.

[0096] When the trigger risk score is greater than the preset maximum value, the trigger risk score is determined to be the preset maximum value.

[0097] Step 130: When the risk scoring mode is not entered, a weighted comprehensive risk score is obtained based on real-time data of preset risk dimensions.

[0098] When the risk scoring mode is not activated, a weighted comprehensive risk score is obtained based on real-time data from preset risk dimensions, specifically including:

[0099] Through the formula:

[0100] norm_file=min(fileCount / BASE_SUSPECTED_FILES,1.0)、

[0101] norm_freq=min(alertFreq / BASE_ALERT_FREQUENCY,1.0)、

[0102] norm_prob=min(max(ctrlProb,0.0),1.0)、

[0103] norm_usage=min(usageFreq / BASE_USAGE_FREQUENCY,1.0)、

[0104] norm_disposal=1.0-min(max(disposalRate,0.0),1.0);

[0105] The calculations include the normalized number of risk files (norm_file), normalized alarm frequency (norm_freq), normalized controlled probability (norm_prob), normalized usage frequency (norm_usage), and normalized alarm disposal rate (norm_disposal) (here, the original values ​​of each dimension are mapped to the [0,1] interval to eliminate the difference in units).

[0106] Among them, fileCount represents the number of alarms for medium-risk files, BASE_SUSPECTED_FILES represents the preset baseline threshold for the number of medium-risk files, alertFreq represents the alarm frequency, BASE_ALERT_FREQUENCY represents the baseline threshold for alarm frequency, ctrlProb represents the probability of being remotely controlled, usageFreq represents the terminal usage frequency, BASE_USAGE_FREQUENCY represents the terminal usage frequency threshold, and disposalRate represents the alarm handling rate.

[0107] Through the formula:

[0108] weighted_sum = norm_file × weight_file + norm_freq × weight_freq + norm_prob × weight_prob + norm_usage × weight_usage + norm_disposal × weight_disposal, and the initial comprehensive risk score weighted_sum is obtained by weighting.

[0109] Among them, weight_file, weight_freq, weight_prob, weight_usage, and weight_disposal represent the preset weights;

[0110] Through the formula:

[0111] score_regular = round( min( max( weighted_sum, 0.0 ), 1.0 ) × (HIGH_RISK_START-1) ), which maps the initial comprehensive risk score to the interval [0, HIGH_RISK_START-1] to obtain the comprehensive risk score;

[0112] When fileCount>0, alertFreq>0, ctrlProb>0, usageFreq>0, or disposalRate<1.0, and the overall risk score is less than the preset minimum value (e.g., 1 point), the preset minimum value is determined to be the overall risk score.

[0113] When the overall risk score is greater than the preset maximum value (e.g., 96 points), the overall risk score is determined to be the preset maximum value.

[0114] Step 140: Determine the current terminal's security risk level based on the range in which the trigger risk score or comprehensive risk score falls.

[0115] In some embodiments, the security risk level of the current terminal is determined based on the range in which the trigger risk score or the comprehensive risk score falls, specifically including:

[0116] When the trigger risk score or the comprehensive risk score falls within the range [0, A), the current terminal's security risk level is determined to be no risk.

[0117] When the trigger risk score or comprehensive risk score falls within the range [A, B), the current terminal's security risk level is determined to be low risk.

[0118] When the trigger risk score or comprehensive risk score falls within the range [B, C), the current terminal's security risk level is determined to be medium risk.

[0119] When the trigger risk score or comprehensive risk score falls within the range of [C,D], the current terminal's security risk level is determined to be high risk.

[0120] And A < B < C < D.

[0121] As an example, no risk: score < 50 points;

[0122] Low risk: 50 points ≤ score < 70 points;

[0123] Medium risk: 70 points ≤ score < 90 points;

[0124] High risk: 90 points ≤ score ≤ 96 points.

[0125] Based on the foregoing description, this embodiment has the following beneficial effects:

[0126] More comprehensive risk assessment: By integrating multiple dimensions such as the number of alarms, the probability of being compromised by an attack, and the frequency of alarms, a comprehensive assessment of terminal risks is achieved. Compared to the "chimney"-style monitoring of existing technologies, this invention breaks down these silos, achieving linkage and integration between multiple dimensions to comprehensively assess the terminal risk situation. The comprehensive risk assessment results are also more accurate than those of existing technologies.

[0127] Accurate risk assessment and more efficient handling: Comprehensive analysis of multi-dimensional data can amplify more important points and avoid the undue influence of non-critical points on the final result, thus preventing distortion of the outcome.

[0128] Avoid secondary leaks caused by the transmission of sensitive information: Compared with existing technologies, it is no longer necessary to transmit file content (including file name, file summary, etc.). The risk of the terminal can be assessed by secondary analysis of the results of the terminal's file scan, combined with dimensions such as attack and Internet behavior.

[0129] Accurate identification of core risks: Once the core dimensions (number of medium-risk documents, alarm frequency, probability of being controlled) meet the standards, the high-risk status is locked, without being affected by the weight of auxiliary dimensions, thus avoiding misjudgment of "high risk, low score";

[0130] The risk classification is refined: the scores of the high-risk range are evenly distributed with a fixed step size, and the severity of the core risk can be quantified by the difference in scores to support differentiated treatment (e.g., 90 points require attention, 96 points require emergency treatment).

[0131] The scoring logic is practical: scores for non-zero dimensions are no lower than the preset minimum value (e.g., 1 point), which aligns with the practical understanding that "if there is risk, there should be a quantitative score," thus improving the credibility of the scoring.

[0132] The scoring range is controllable: the highest score is limited to a preset maximum value (e.g., 96 points) to avoid invalid scores, while the weighting logic is retained in low-risk scenarios to ensure scoring flexibility.

[0133] In addition, this application Figure 2 This application provides a terminal security assessment system based on nonlinear mapping technology. For example... Figure 2 As shown in the embodiments of this application, the system mainly includes:

[0134] The determination module 210 is used to obtain real-time data of the terminal's preset risk dimensions and determine whether the real-time data meets the preset risk triggering conditions; when the preset risk triggering conditions are met, the risk scoring mode is entered.

[0135] The determining module 210 includes a determining unit.

[0136] Used to obtain the number of alarms, alarm frequency, and probability of remote control of medium-risk files on the terminal within a preset window time period;

[0137] If the number of medium-risk document suspicion alarms is less than the baseline threshold for the number of medium-risk documents, the alarm frequency is less than the baseline threshold for alarm frequency, and the probability of being remotely controlled is less than the baseline threshold for the probability of being controlled, then the preset risk triggering conditions are not met; otherwise, the preset risk triggering conditions are met.

[0138] The module 220 is used to obtain the nonlinear calculation formula corresponding to the specific preset risk triggering conditions, extract the corresponding real-time data, and then use the nonlinear calculation formula to obtain the trigger risk score.

[0139] The weighting module 230 is used to obtain a comprehensive risk score by weighting real-time data based on preset risk dimensions when the risk scoring mode is not entered.

[0140] The rating module 240 is used to determine the current security risk level of the terminal based on the range in which the trigger risk score or the comprehensive risk score falls.

[0141] The above are method embodiments of this application. Based on the same inventive concept, this application also provides a terminal security assessment device based on nonlinear mapping technology. Figure 3 As shown, the device includes: a processor; and a memory storing executable code thereon, which, when executed, causes the processor to perform a terminal security assessment method based on nonlinear mapping technology as described in the above embodiments.

[0142] Specifically, the server obtains real-time data of the terminal's preset risk dimensions and determines whether the real-time data meets the preset risk triggering conditions. When the preset risk triggering conditions are met, the server enters the risk scoring mode: it obtains the non-linear calculation formula corresponding to the specific preset risk triggering condition, extracts the corresponding real-time data, and then uses the non-linear calculation formula to obtain the triggered risk score. When the server does not enter the risk scoring mode, it obtains a weighted comprehensive risk score based on the real-time data of the preset risk dimensions. The server determines the current terminal's security risk level based on the range in which the triggered risk score or the comprehensive risk score falls.

[0143] In addition, this application embodiment also provides a non-volatile computer storage medium storing executable instructions, which, when executed, implement the terminal security assessment method based on nonlinear mapping technology as described above.

[0144] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A terminal security assessment method based on nonlinear mapping technology, characterized in that, The method includes: Acquire real-time data of the terminal's preset risk dimensions and determine whether the real-time data meets the preset risk triggering conditions; when the preset risk triggering conditions are met, enter the risk scoring mode: where the preset risk dimensions include at least: the number of medium-risk file suspicion alarms, alarm frequency, and probability of being remotely controlled within the preset window time period; Furthermore, it acquires real-time data on preset risk dimensions of the terminal and determines whether the real-time data meets the preset risk triggering conditions, specifically including: The system acquires the number of medium-risk file suspicion alarms, alarm frequency, and probability of being remotely controlled within a preset window time period. If the number of medium-risk file suspicion alarms is less than the baseline threshold for the number of medium-risk files, the alarm frequency is less than the baseline threshold for alarm frequency, and the probability of being remotely controlled is less than the baseline threshold for the probability of being controlled, the system determines that the preset risk triggering conditions are not met. Otherwise, the preset risk triggering conditions are met. The process involves obtaining the nonlinear calculation formula corresponding to the specific preset risk triggering conditions, extracting the corresponding real-time data, and then using the nonlinear calculation formula to obtain the trigger risk score; specifically including: When the specific preset risk trigger condition is that the number of suspected medium-risk file alerts within a preset window time period is greater than or equal to a preset benchmark threshold for the number of medium-risk files, the trigger condition is determined by the formula: score_file = HIGH_RISK_START + min((fileCount - BASE_SUSPECTED_FILES) / step_file, MAX_SCORE - HIGH_RISK_START), calculates the first risk score score_file; where HIGH_RISK_START represents the starting value of the preset risk range, fileCount represents the number of medium-risk file suspicion alarms, BASE_SUSPECTED_FILES represents the preset baseline threshold for the number of medium-risk files, step_file represents the length of the first step, and step_file = (MAX_SCORE - HIGH_RISK_START) / (MAX_FILE_COUNT - BASE_SUSPECTED_FILES), MAX_SCORE represents the ending value of the preset risk range, and MAX_FILE_COUNT represents the preset high-risk upper limit for the number of medium-risk files; When the specific preset risk trigger condition is that the alarm frequency within a preset window time period is greater than or equal to the alarm frequency baseline threshold, the following formula is used: score_freq = HIGH_RISK_START + min((alertFreq - BASE_ALERT_FREQUENCY) / step_freq, MAX_SCORE - HIGH_RISK_START), calculates the second risk score score_freq; where alertFreq represents the alarm frequency, BASE_ALERT_FREQUENCY represents the baseline threshold for alarm frequency, step_freq represents the second step size, and step_freq = BASE_ALERT_FREQUENCY / (MAX_SCORE - HIGH_RISK_START); When the specific preset risk trigger condition is that the probability of being remotely controlled is greater than or equal to the baseline threshold of the controlled probability within a preset window time period, the following formula is used: score_prob = HIGH_RISK_START + min((ctrlProb - BASE_CTRL_PROBABILITY) / step_prob, MAX_SCORE - HIGH_RISK_START), calculates the third risk score score_prob; where ctrlProb represents the probability of being remotely controlled, BASE_CTRL_PROBABILITY represents the baseline threshold for the probability of being controlled, step_prob represents the third step size, and step_prob = (1.0 - BASE_CTRL_PROBABILITY) / (MAX_SCORE - HIGH_RISK_START); When there is only one specific preset risk trigger condition, the calculated risk score is the trigger risk score; otherwise, the maximum value is taken as the trigger risk score. When fileCount>0, alertFreq>0, ctrlProb>0, usageFreq>0, or disposalRate<1.0, and the trigger risk score is less than the preset minimum value, the trigger risk score is determined to be the preset minimum value; where usageFreq represents the terminal usage frequency threshold, and disposalRate represents the alarm handling rate. When the trigger risk score is greater than the preset maximum value, the trigger risk score is determined to be the preset maximum value; When the risk scoring mode is not activated, a comprehensive risk score is obtained by weighting real-time data based on preset risk dimensions. The current security risk level of the terminal is determined based on the range in which the trigger risk score or the comprehensive risk score falls.

2. The terminal security assessment method based on nonlinear mapping technology according to claim 1, characterized in that, When the risk scoring mode is not activated, a weighted comprehensive risk score is obtained based on real-time data from preset risk dimensions, specifically including: Through the formula: norm_file=min(fileCount / BASE_SUSPECTED_FILES,1.0)、 norm_freq=min(alertFreq / BASE_ALERT_FREQUENCY,1.0)、 norm_prob=min(max(ctrlProb,0.0),1.0)、 norm_usage=min(usageFreq / BASE_USAGE_FREQUENCY,1.0)、 norm_disposal=1.0-min(max(disposalRate,0.0),1.0); The calculations include the normalized number of risk files (norm_file), the normalized alarm frequency (norm_freq), the normalized controlled probability (norm_prob), the normalized usage frequency (norm_usage), and the normalized alarm disposal rate (norm_disposal). Among them, fileCount represents the number of alarms for medium-risk files, BASE_SUSPECTED_FILES represents the preset baseline threshold for the number of medium-risk files, alertFreq represents the alarm frequency, BASE_ALERT_FREQUENCY represents the baseline threshold for alarm frequency, ctrlProb represents the probability of being remotely controlled, usageFreq represents the terminal usage frequency, BASE_USAGE_FREQUENCY represents the terminal usage frequency threshold, and disposalRate represents the alarm handling rate. Through the formula: weighted_sum = norm_file × weight_file + norm_freq × weight_freq + norm_prob × weight_prob + norm_usage × weight_usage + norm_disposal × weight_disposal, and the initial comprehensive risk score weighted_sum is obtained by weighting. Among them, weight_file, weight_freq, weight_prob, weight_usage, and weight_disposal represent the preset weights; Through the formula: score_regular = round( min( max( weighted_sum, 0.0 ), 1.0 ) × (HIGH_RISK_START-1) ), which maps the initial comprehensive risk score to the interval [0, HIGH_RISK_START-1] to obtain the comprehensive risk score; When fileCount>0, alertFreq>0, ctrlProb>0, usageFreq>0, or disposalRate<1.0, and the overall risk score is less than the preset minimum value, the preset minimum value is determined to be the overall risk score. When the overall risk score is greater than the preset maximum value, the overall risk score is determined to be the preset maximum value.

3. The terminal security assessment method based on nonlinear mapping technology according to claim 1, characterized in that, The current terminal's security risk level is determined based on the range in which the trigger risk score or comprehensive risk score falls, specifically including: When the trigger risk score or the comprehensive risk score falls within the range [0, A), the current terminal's security risk level is determined to be no risk. When the trigger risk score or comprehensive risk score falls within the range [A, B), the current terminal's security risk level is determined to be low risk. When the trigger risk score or comprehensive risk score falls within the range [B, C), the current terminal's security risk level is determined to be medium risk. When the trigger risk score or comprehensive risk score falls within the range of [C,D], the current terminal's security risk level is determined to be high risk. And A < B < C < D.

4. The terminal security assessment method based on nonlinear mapping technology according to claim 1, characterized in that, Before acquiring real-time data of the terminal's preset risk dimensions and determining whether the real-time data meets the preset risk triggering conditions, the method further includes: Configure the preset risk triggering conditions, including the preset threshold for the number of medium-risk files, the starting value of the preset risk range, the ending value of the preset risk range, the preset high-risk upper limit for the number of medium-risk files, the alarm frequency benchmark threshold, the controlled probability benchmark threshold, the terminal usage frequency threshold, the specific range value of the range to be entered for each security risk level, and the preset minimum and maximum values ​​of the scoring constraints.

5. A terminal security assessment system based on nonlinear mapping technology, characterized in that, The system includes: The determination module is used to acquire real-time data of preset risk dimensions from the terminal and determine whether the real-time data meets preset risk trigger conditions; when the preset risk trigger conditions are met, the risk scoring mode is entered. The determination module includes a determination unit. Used to obtain the number of alarms, alarm frequency, and probability of remote control of medium-risk files on the terminal within a preset window time period; If the number of medium-risk document suspicion alarms is less than the baseline threshold for the number of medium-risk documents, the alarm frequency is less than the baseline threshold for alarm frequency, and the probability of being remotely controlled is less than the baseline threshold for the probability of being controlled, then the preset risk triggering conditions are not met; otherwise, the preset risk triggering conditions are met. The acquisition module is used to obtain the nonlinear calculation formula corresponding to the specific preset risk triggering conditions, extract the corresponding real-time data, and then use the nonlinear calculation formula to obtain the trigger risk score; specifically including: When the specific preset risk trigger condition is that the number of suspected medium-risk file alerts within a preset window time period is greater than or equal to a preset benchmark threshold for the number of medium-risk files, the trigger condition is determined by the formula: score_file = HIGH_RISK_START + min((fileCount - BASE_SUSPECTED_FILES) / step_file, MAX_SCORE - HIGH_RISK_START), calculates the first risk score score_file; where HIGH_RISK_START represents the starting value of the preset risk range, fileCount represents the number of medium-risk file suspicion alarms, BASE_SUSPECTED_FILES represents the preset baseline threshold for the number of medium-risk files, step_file represents the length of the first step, and step_file = (MAX_SCORE - HIGH_RISK_START) / (MAX_FILE_COUNT - BASE_SUSPECTED_FILES), MAX_SCORE represents the ending value of the preset risk range, and MAX_FILE_COUNT represents the preset high-risk upper limit for the number of medium-risk files; When the specific preset risk trigger condition is that the alarm frequency within a preset window time period is greater than or equal to the alarm frequency baseline threshold, the following formula is used: score_freq = HIGH_RISK_START + min((alertFreq - BASE_ALERT_FREQUENCY) / step_freq, MAX_SCORE - HIGH_RISK_START), calculates the second risk score score_freq; where alertFreq represents the alarm frequency, BASE_ALERT_FREQUENCY represents the baseline threshold for alarm frequency, step_freq represents the second step size, and step_freq = BASE_ALERT_FREQUENCY / (MAX_SCORE - HIGH_RISK_START); When the specific preset risk trigger condition is that the probability of being remotely controlled is greater than or equal to the baseline threshold of the controlled probability within a preset window time period, the following formula is used: score_prob = HIGH_RISK_START + min((ctrlProb - BASE_CTRL_PROBABILITY) / step_prob, MAX_SCORE - HIGH_RISK_START), calculates the third risk score score_prob; where ctrlProb represents the probability of being remotely controlled, BASE_CTRL_PROBABILITY represents the baseline threshold for the probability of being controlled, step_prob represents the third step size, and step_prob = (1.0 - BASE_CTRL_PROBABILITY) / (MAX_SCORE - HIGH_RISK_START); When there is only one specific preset risk trigger condition, the calculated risk score is the trigger risk score; otherwise, the maximum value is taken as the trigger risk score. When fileCount>0, alertFreq>0, ctrlProb>0, usageFreq>0, or disposalRate<1.0, and the trigger risk score is less than the preset minimum value, the trigger risk score is determined to be the preset minimum value; where usageFreq represents the terminal usage frequency threshold, and disposalRate represents the alarm handling rate. When the trigger risk score is greater than the preset maximum value, the trigger risk score is determined to be the preset maximum value; The weighting module is used to obtain a comprehensive risk score by weighting real-time data based on preset risk dimensions when the risk scoring mode is not entered. The rating module is used to determine the current security risk level of the terminal based on the range in which the trigger risk score or the comprehensive risk score falls.

6. A terminal security assessment device based on nonlinear mapping technology, characterized in that, The device includes: processor; And a memory storing executable code, which, when executed, causes the processor to perform a terminal security assessment method based on nonlinear mapping technology as described in any one of claims 1-4.

7. A non-volatile computer storage medium, characterized in that, It stores computer instructions, which, when executed, implement a terminal security assessment method based on nonlinear mapping technology as described in any one of claims 1-4.

Images