Plug-in security verification method based on behavior analysis, medium and device

Abstract

The invention belongs to the technical field of computer security, and provides a plug-in security verification method based on behavior analysis, a medium and a device. The method comprises the following steps: S1, acquiring plug-in information; s2, establishing a behavior pattern library; s3, in the plug-in installation and operation process, behaviors of the plug-in are monitored in real time, and risk judgment is carried out; s4, optimizing a behavior pattern library; and S5, monitoring the dynamic behavior of the plug-in based on the optimized behavior pattern library. According to the method, the dynamic behaviors of the plug-in are monitored in real time through the steps, dual analysis of static information and the dynamic behaviors is fused, the behavior pattern library is constructed, the behavior pattern library is dynamically optimized through machine learning, and the method has the advantages of being comprehensive in monitoring, high in real-time performance, high in accuracy and the like.

Description

Technical Field

[0001] This invention belongs to the field of computer security technology, specifically, it relates to a plug-in security verification method, medium and device based on behavior analysis. Background Technology

[0002] Over the past few years, with the widespread use of plugins in various software and applications, plugin security issues have become increasingly prominent. Currently, security verification for plugins mainly employs static security verification methods. However, traditional static security verification methods struggle to capture the dynamic behavior of plugins, such as access permissions, configuration changes, and network communications. Therefore, the field needs a new security verification method capable of monitoring and analyzing plugin behavior in real time to accurately assess its security. Summary of the Invention

[0003] The purpose of this invention is to provide a plugin security verification method based on behavior analysis to solve the technical problems existing in the prior art.

[0004] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A plugin security verification method based on behavior analysis includes the following steps: Step S1: Obtain plugin information: Extract relevant plugin information from the plugin installation package or source code; Step S2: Establish a behavior pattern library: Based on historical normal plugin behavior logs and malicious plugin behavior logs, establish a baseline behavior pattern library including permission request patterns, network communication patterns and configuration change patterns. At the same time, build an unknown behavior detection module to identify unregistered behaviors. Step S3: During the installation and operation of the plugin, monitor the plugin's behavior in real time and assess the risks. The specific method is as follows: (1) Monitor permission request calls. When a request is detected that the permission is not in the necessary permission whitelist or the request frequency exceeds the threshold, it is marked as high risk. (2) Analyze network communication traffic and mark high risk when the domain name exists in the malicious IP database, the amount of a single data transmission exceeds the threshold and the content is a binary stream, or an abnormal TLS fingerprint is detected; (3) Track configuration file modification operations, calculate cumulative weights based on the file modification impact scoring model, and mark high risk when the weight value exceeds the threshold; Step S4: Behavior pattern library optimization: The high-risk behaviors marked in step S3 are used as clues for machine learning classification algorithms to optimize the behavior pattern library; Step S5: Monitor the dynamic behavior of the plugin based on the optimized behavior pattern library.

[0005] Preferably, the method for obtaining relevant information in step S1 is as follows: extract permission declarations from the plugin installation package, scan security annotation identifiers in the plugin source code, parse the metadata configuration file in the resource directory, and obtain the permission list, dependency library list, and code feature fingerprint.

[0006] Preferably, the specific method of step S2 is as follows: Step S2.1: Collect historical behavior data: Obtain normal plugin behavior logs and malicious plugin behavior logs, and preprocess the above data; Step S2.2: Generate three benchmark patterns and build a benchmark behavior pattern library: (1) Permission request pattern: Extract the characteristics of permission call sequence and generate a permission call chain pattern set; (2) Network communication mode: Calculate the domain name risk value and generate a network behavior feature set by combining the data packet size distribution; (3) Configuration change mode: Extract configuration file and modify path mode; Step S2.3: Construct an unknown behavior detection module: Calculate the mean values ​​of historical normal behavior parameters. and standard deviation And based on the mean of the parameters and standard deviation Define the normal value range for each behavior.

[0007] Preferably, the threshold in step S3 is set as follows: (1) The threshold for request frequency exceeding the threshold is set as follows: the request frequency is a multiple of the average value of similar plugins; (2) The threshold for a single data transfer exceeds the following: a single data transfer ≥ 100KB; (3) The weight value exceeding the threshold is set as follows: the cumulative risk weight is 0.7.

[0008] Preferably, in step S3, the file modification impact scoring model is as follows:

[0009] In the formula, This represents the cumulative risk weight, where n is the total number of configuration change operations detected, and i is the operation sequence number. The type weight for the i-th operation. Let i be the timestamp of the i-th operation. This is a time decay function.

[0010] Preferably, the type weight Including: (1) Modification weight of the system core configuration file =0.9; (2) Other application configuration file modification weights =0.6; (3) User data file modification weight =0.3.

[0011] Preferably, the specific method of step S4 is as follows: Step S4.1: Data preprocessing: Collect the high-risk behavior data marked in step S3, and preprocess the behavior data to obtain the raw data; Step S4.2: Feature Extraction: Extract features from the raw data to provide input for the classification algorithm model; Step S4.3: Use the Support Vector Machine model as the classification algorithm model and train the model; Step S4.4: Model Optimization: Use the test set to evaluate the classification algorithm model, assess the model's accuracy, precision, and recall, determine the model's performance, and optimize it to obtain the optimized behavior pattern library.

[0012] To achieve the above objectives, the present invention also provides a computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the aforementioned behavior analysis-based plug-in security verification method.

[0013] To achieve the above objectives, the present invention also provides an apparatus for browser version detection and automatic suggestion, comprising: a processor and a memory; the memory for storing a computer program; the processor being connected to the memory and for executing the computer program stored in the memory, so that the apparatus for browser version detection and automatic suggestion performs the aforementioned behavior analysis-based plug-in security verification method.

[0014] Compared with the prior art, the present invention has the following beneficial effects: (1) The present invention has superior real-time monitoring capabilities, enabling real-time monitoring of plugin behavior and timely detection of abnormal or malicious behavior.

[0015] (2) The present invention has superior accuracy: based on machine learning and pattern recognition, it can intelligently identify abnormal behavior of plugins and accurately assess their security.

[0016] (3) The present invention has better adaptability: it can continuously optimize the behavior pattern library to adapt to the ever-changing malicious behavior patterns.

[0017] (4) This invention enhances security: effectively improves the security of plug-ins and prevents malicious plug-ins from threatening the system and user data. Attached Figure Description

[0018] Figure 1 This is a flowchart of Embodiment 1 of the present invention.

[0019] Figure 2 This is a principle block diagram of Embodiment 3 of the present invention. Detailed Implementation

[0020] To enable those skilled in the art to have a clearer understanding of the present invention, the present invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described below are merely for illustrative purposes and to facilitate understanding. The technical solutions provided by the present invention are not limited to those provided in the following embodiments, nor should they limit the scope of protection of the present invention.

[0021] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Therefore, the drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the shape, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0022] Example 1 like Figure 1 As shown, this embodiment provides a plugin security verification method based on behavior analysis. By monitoring and analyzing the real-time behavior of plugins, its security can be assessed. This method, based on machine learning and pattern recognition technologies, can intelligently identify abnormal or malicious behavior in plugins, improving the accuracy and real-time performance of plugin security.

[0023] In this embodiment, the specific steps of the plugin security verification method based on behavior analysis are as follows: Step S1: Obtain plugin information Extract relevant information about the plugin from the plugin installation package or source code. The methods for obtaining this information are as follows: extract permission declarations (such as AndroidManifest.xml) from the plugin installation package, scan for security annotations (such as @RequirePermission) in the plugin source code, parse the metadata configuration file (such as metadata.json) in the resource directory, and obtain the permission list, dependency library list, and code feature fingerprint.

[0024] The permission list can be used to establish a whitelist of necessary permissions and calculate the entropy feature of permission combinations; the dependency library list can be used to define a set of similar plugins to set dynamic monitoring thresholds; and the code feature fingerprint can be used for behavioral sample screening, incremental training deduplication, and risk score correction.

[0025] By taking the above steps, we can extract the basic characteristics of the plugin, ensure the integrity of the information, prevent malicious plugins from bypassing detection through covert means, and provide initial data support for behavioral analysis.

[0026] Step S2: Establish a behavioral pattern library Based on known historical normal plugin behavior logs and malicious plugin behavior logs as samples, a behavior pattern library was established, including permission request patterns, network communication patterns, configuration change patterns, etc.

[0027] The specific method for this step is as follows: Step S2.1: Collect historical behavior data: Obtain normal plugin behavior logs and malicious plugin behavior logs, and preprocess the above data. Examples of preprocessing methods include: time alignment, invalid behavior filtering, and sliding window segmentation. Step S2.2: Generate three benchmark patterns and build a benchmark behavior pattern library: (1) Permission request pattern: Extract the permission call sequence features through the DBSCAN clustering algorithm to generate a permission call chain pattern set, example: {CAMERA→LOCATION→MICROPHONE}). (2) Network communication mode: The domain risk value is calculated based on the PageRank algorithm (e.g., the domain score of the associated malicious IP database is 0.9), and the network behavior feature set is generated by combining the data packet size distribution (e.g., 80% of normal plugin data packets are ≤50KB). (3) Configuration change mode: Extract the modification path of frequently used configuration files (such as / etc / system / config); Step S2.3: Construct an unknown behavior detection module: Calculate the mean values ​​of historical normal behavior parameters. and standard deviation And based on the mean of the parameters and standard deviation Define the normal value range for each behavior (see example:) ).

[0028] The baseline behavior pattern library can identify known malicious plugin behaviors, such as illegal permission requests, abnormal network communication activities, and malicious changes to system configurations. The unknown behavior detection module identifies unregistered behaviors, including: (1) not registered in the baseline behavior library; (2) key indicators exceeding the normal value range. This can enhance the ability to identify zero-day attacks. The combination of the above two aspects improves the accuracy of identification.

[0029] 3. Step S3: During the installation and operation of the plugin, monitor the plugin's behavior in real time and perform risk assessment. The input for this step is the plugin's real-time behavior data stream. High-risk behaviors are marked through this step, as detailed below: (1) Monitor permission request calls. When a request for permission is detected that is not in the necessary permission whitelist (such as a computing plugin requesting SMS permission) or the request frequency exceeds the threshold, it is marked as high risk. The following is an example of setting the threshold: 2 to 3 times the average of similar plugins; (2) Analyze network communication traffic. Mark high risk when the domain name exists in the malicious IP database, the amount of a single data transmission exceeds the threshold and the content is a binary stream, or an abnormal TLS fingerprint is detected. The following is an example of setting the threshold: the amount of a single data transmission > 100KB; (3) Track configuration file modification operations, calculate the cumulative weight based on the file modification impact scoring model, and mark high risk when the weight value exceeds the threshold. The threshold setting example is as follows: the cumulative risk weight is 0.7; the cumulative risk weight is calculated through the file modification impact scoring model, and the model expression is as follows:

[0030] In the formula, This represents the cumulative risk weight, where n is the total number of monitored configuration change operations (a positive integer), and i is the operation sequence number (1 ≤ ... ). i ≤n), Let the type weight be the type weight for the i-th operation. Including: (1) Modification weight of the system core configuration file =0.9; (2) Other application configuration file modification weights =0.6; (3) User data file modification weight =0.3; Let i be the timestamp of the i-th operation. This is a time decay function. This is a preset coefficient (example: 0.001). This represents the time difference since the operation occurred. By combining type weighting and time decay with the above scheme, the severity of the attack and the timeliness of the operation are accurately quantified, achieving dynamically adjusted composite weights. This gives recent high-risk operations (such as system tampering within 10 seconds) a timeliness coefficient of 0.99, while historical operations from 24 hours ago decay to a negligible 0.0001. On the one hand, this effectively avoids the "zombie alert" problem; on the other hand, it enables targeted capture of key stages in the attack chain.

[0031] This step, based on a three-pronged threshold design (frequency, magnitude, and weight), can reduce false alarms, improve accuracy, and prioritize recent high-risk operations. The marked high-risk behaviors can provide clues for machine learning classification algorithms to use.

[0032] IV. Step S4: Optimization of the Behavioral Pattern Library The high-risk behavior data marked in the above steps are used as input for machine learning classification algorithms to iteratively upgrade the detection model and optimize the behavior pattern library.

[0033] The specific implementation method for this step is as follows: Step S4.1: Data Preprocessing: Collect the high-risk behavior data marked in Step S3, and preprocess the behavior data to obtain the raw data; the preprocessing methods include data cleaning, handling missing values, data transformation, etc. Step S4.2: Feature Extraction: Extract features from the raw data (example features are as follows: frequency of permission calls, network traffic entropy value, depth of configuration modification path) to provide input for the classification algorithm model; Step S4.3: Model Training: Use the Support Vector Machine (SVM) classification algorithm to train the model with historical malicious behavior as positive samples; Step S4.4: Model optimization: Evaluate performance using the test set (precision ≥ 95%, recall ≥ 92%), and adjust kernel function parameters; based on the optimized classification algorithm model, perform behavior pattern library optimization operations.

[0034] Optimization example: When the support vector machine model achieves a recall rate > 95% and a false positive rate < 3% after being validated on the test set, the behavior pattern library optimization operation is performed: (a) parse the model decision function to generate new behavior rules; (b) sort the existing patterns according to the feature weights and eliminate patterns with weights lower than the threshold of 0.01; (c) convert the abnormal behavior samples corresponding to the support vectors into detection patterns.

[0035] This step employs a machine learning classification algorithm, inputting high-risk behavior data into the classification model for training and prediction. This further categorizes plugins to determine whether they constitute malicious behavior. By continuously optimizing the behavior pattern library and constantly updating and improving the algorithm model, the accuracy and reliability of the verification method can be enhanced, enabling better identification and prevention of malicious plugin threats.

[0036] V. Based on the optimized behavior pattern library, monitor the dynamic behavior of the plugin. A new round of plugin behavior monitoring is performed based on the optimized pattern library, forming an adaptive monitoring closed loop of "monitoring → optimization → re-monitoring". If the plugin's behavior matches a known malicious behavior pattern, a security alert is immediately triggered, and corresponding measures are taken, including immediately terminating the plugin's execution and notifying the administrator via SMS.

[0037] This embodiment achieves real-time monitoring of the dynamic behavior of the plugin through the above steps. It integrates the dual analysis of static information and dynamic behavior, constructs a behavior pattern library, and dynamically optimizes the behavior pattern library through machine learning. It has the advantages of comprehensive monitoring, strong real-time performance, and high accuracy.

[0038] Example 2 This embodiment provides a computer-readable storage medium on which a computer program is stored. The computer program is executed by a processor to implement the plug-in security verification method based on behavior analysis provided in Embodiment 1. Those skilled in the art will understand that all or part of the steps of the method provided in Embodiment 1 can be implemented by hardware related to the computer program. The aforementioned computer program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the method provided in Embodiment 1. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0039] Example 3 like Figure 2 As shown, this embodiment provides a plug-in security verification device based on behavior analysis, including: a processor and a memory; the memory is used to store a computer program; the processor is connected to the memory and is used to execute the computer program stored in the memory, so that the plug-in security verification device based on behavior analysis performs the plug-in security verification method based on behavior analysis provided in Embodiment 1.

[0040] Specifically, memory includes various media that can store program code, such as ROM, RAM, magnetic disks, USB flash drives, memory cards, or optical discs.

[0041] Preferably, the processor can be a general-purpose processor, including a central processing unit, a network processor, etc.; it can also be a digital signal processor, an application-specific integrated circuit, a field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component.

[0042] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

Claims

1. A plug-in security verification method based on behavior analysis, characterized in that, Includes the following steps: Step S1: Obtain plugin information: Extract relevant plugin information from the plugin installation package or source code; Step S2: Establish a behavior pattern library: Based on historical normal plugin behavior logs and malicious plugin behavior logs, establish a baseline behavior pattern library including permission request patterns, network communication patterns and configuration change patterns. At the same time, build an unknown behavior detection module to identify unregistered behaviors. Step S3: During the installation and operation of the plugin, monitor the plugin's behavior in real time and assess the risks. The specific method is as follows: (1) Monitor permission request calls and mark high risk when the requested permission is not in the necessary permission whitelist or the request frequency exceeds the threshold. (2) Analyze network communication traffic and mark high risk when the domain name exists in the malicious IP database, the amount of a single data transmission exceeds the threshold and the content is a binary stream, or an abnormal TLS fingerprint is detected. (3) Track configuration file modification operations, calculate cumulative weights based on the file modification impact scoring model, and mark high risk when the weight value exceeds the threshold; Step S4: Behavior pattern library optimization: The high-risk behaviors marked in step S3 are used as clues for machine learning classification algorithms to optimize the behavior pattern library; Step S5: Monitor the dynamic behavior of the plugin based on the optimized behavior pattern library.

2. The plug-in security verification method based on behavior analysis according to claim 1, characterized in that, The method for obtaining relevant information in step S1 is as follows: extract permission declarations from the plugin installation package, scan security annotation identifiers in the plugin source code, parse metadata configuration files in the resource directory, and obtain permission lists, dependency library lists, and code feature fingerprints.

3. The plug-in security verification method based on behavior analysis according to claim 2, characterized in that, The specific method for step S2 is as follows: Step S2.1: Collect historical behavior data: Obtain normal plugin behavior logs and malicious plugin behavior logs, and preprocess the above data; Step S2.2: Generate three benchmark patterns and build a benchmark behavior pattern library: (1) Permission request pattern: Extract the characteristics of permission call sequence and generate a set of permission call chain patterns; (2) Network communication mode: Calculate the domain name risk value and generate a network behavior feature set by combining the data packet size distribution; (3) Configuration change mode: Extract configuration file and modify path mode; Step S2.3: Construct an unknown behavior detection module: Calculate the mean μ and standard deviation σ of historical normal behavior parameters, and set the normal value range for each behavior based on the mean μ and standard deviation σ.

4. The plug-in security verification method based on behavior analysis according to claim 3, characterized in that, The threshold setting in step S3 is as follows: (1) The threshold for request frequency exceeding the threshold is set as follows: the request frequency is a multiple of the average value of similar plugins; (2) The threshold for single data transmission volume exceeding the limit is set as follows: single data transmission volume ≥ 100KB; (3) The weight value exceeding the threshold is set as follows: the cumulative risk weight is 0.

7.

5. The plug-in security verification method based on behavior analysis according to claim 4, characterized in that, In step S3, the file modification impact scoring model is as follows: In the formula, W represents the cumulative risk weight, n is the total number of monitored configuration change operations, i is the operation sequence number, and k is the cumulative risk weight. i Let t be the type weight of the i-th operation. i Let f(t) be the timestamp of the i-th operation. i ) is the time decay function.

6. The plug-in security verification method based on behavior analysis according to claim 5, characterized in that, The type weight k i Including: (1) Modifying the weight k of the system core configuration file i =0.9; (2) Modify the weight k in other application configuration files i =0.6; (3) User data file modification weight k i =0.

3.

7. The plug-in security verification method based on behavior analysis according to claim 6, characterized in that, The specific method for step S4 is as follows: Step S4.1: Data preprocessing: Collect the high-risk behavior data marked in step S3, and preprocess the behavior data to obtain the raw data; Step S4.2: Feature Extraction: Extract features from the raw data to provide input for the classification algorithm model; Step S4.3: Use the Support Vector Machine model as the classification algorithm model and train the model; Step S4.4: Model Optimization: Use the test set to evaluate the classification algorithm model, assess the model's accuracy, precision, and recall, determine the model's performance, and optimize it to obtain the optimized behavior pattern library.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer program is executed by a processor to implement the plug-in security verification method based on behavior analysis as described in any one of claims 1 to 7.

9. A plug-in security verification device based on behavior analysis, characterized in that, include: Processor and memory; The memory is used to store computer programs; The processor is connected to the memory and is used to execute the computer program stored in the memory, so that the behavior analysis-based plug-in security verification device performs the behavior analysis-based plug-in security verification method as described in any one of claims 1 to 7.

Images