Terminal application safety protection method based on omni-channel system and omni-channel system

Abstract

The invention provides a safety protection method for a terminal application based on an omni-channel system and the omni-channel system.The method comprises the steps that events of the terminal application are obtained through a data collection system of the omni-channel system, and the events comprise one or more of an APP event, a light application event and a flow use event; according to the type of the event, a corresponding evaluation system of the omni-channel system is adopted for risk evaluation, an evaluation result is obtained, and the evaluation system comprises one or more of an APP evaluation system, a light application evaluation system and a flow evaluation system; and under the condition that the assessment result represents that the risk exists, a linkage analysis system of the omni-channel system is adopted to generate a defense instruction according to the assessment result, and the defense instruction is sent to a server used by the financial institution. The method solves the problem of low safety protection capability caused by fragmentation of a traditional application monitoring mode in the prior art.

Description

Technical Field

[0001] This application relates to the field of financial technology, and more specifically, to a security protection method for terminal applications based on an omnichannel system, a security protection device for terminal applications based on an omnichannel system, a computer program product, and an omnichannel system. Background Technology

[0002] As digital transformation deepens, enterprises and service providers are increasingly relying on web applications, mobile applications, APIs, and IoT devices to provide services. These multi-channel, multi-terminal application environments greatly enhance user experience and business efficiency.

[0003] Traditional security protection mechanisms, such as Web Application Firewalls (WAF), Intrusion Detection Systems (IDS), and App hardening solutions, are often deployed independently, with each technology focusing on specific endpoints or channels. For example, WAF mainly focuses on the protection of web applications, while App hardening focuses on the security of mobile applications.

[0004] Due to the limitations of security technology deployment, many attack methods can be carried out in places that cannot be detected, such as maliciously exploiting third-party API interfaces and carrying out covert attacks within mobile applications. These attack methods take advantage of the gaps between traditional security protections. This fragmented monitoring method will create monitoring blind spots, resulting in low security protection capabilities. Summary of the Invention

[0005] The main purpose of this application is to provide a security protection method, a security protection device, a computer program product, and an omnichannel system for terminal applications based on an omnichannel system, so as to at least solve the problem that the traditional application monitoring methods in the prior art are relatively fragmented, resulting in low security protection capabilities.

[0006] To achieve the above objectives, according to one aspect of this application, a security protection method for terminal applications based on an omnichannel system is provided. The method includes: acquiring events of the terminal application using the data acquisition system of the omnichannel system, wherein the events include one or more of APP events, mini-application events, and data usage events; performing a risk assessment using the corresponding assessment system of the omnichannel system according to the type of the event, and obtaining an assessment result, wherein the assessment system includes one or more of APP assessment systems, mini-application assessment systems, and data usage assessment systems; and, if the assessment result indicates the presence of risk, generating a defense instruction based on the assessment result using the linkage analysis system of the omnichannel system, and sending the defense instruction to a server used by a financial institution.

[0007] In existing technologies, traditional application monitoring methods are often limited to specific platforms or channels, such as web applications, mobile applications, or API interfaces. Moreover, each monitoring module operates independently, lacking an effective information sharing and collaboration mechanism. In this solution, however, all data collection and application monitoring are placed in an omnichannel system. The omnichannel system is like a large platform that integrates a data collection system, an assessment system, and a linkage analysis system. The data collection system can capture events from different terminals and platforms, the assessment system can perform risk assessments, and the linkage analysis system acts as the coordinator of the entire protection solution, monitoring the entire risk assessment process and generating collaborative defense instructions based on the assessment results. In this way, multiple systems can operate collaboratively, and all functions are integrated together, thereby improving security protection capabilities. Attached Figure Description

[0008] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0009] Figure 1 A hardware structure block diagram of a mobile terminal that performs a security protection method for terminal applications based on an omnichannel system, according to an embodiment of this application, is shown.

[0010] Figure 2 A flowchart illustrating a security protection method for terminal applications based on an omnichannel system, according to an embodiment of this application, is shown.

[0011] Figure 3 A schematic diagram of the end-to-end attack detection process is shown;

[0012] Figure 4 This diagram illustrates the end-to-end omnichannel API and business risk discovery and control architecture.

[0013] Figure 5 This diagram illustrates the entire architecture of user behavior data collection and processing.

[0014] Figure 6 This diagram illustrates the architecture and attack detection process of an end-to-end omnichannel API security platform.

[0015] Figure 7 A structural block diagram of a security protection device for a terminal application based on an omnichannel system, according to an embodiment of this application, is shown.

[0016] The above figures include the following reference numerals:

[0017] 102. Processor; 104. Memory; 106. Transmission device; 108. Input / output device. Detailed Implementation

[0018] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0019] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0020] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0021] Traditional attack detection methods have the following problems:

[0022] It has monitoring blind spots: independently deployed WAF and APP hardening solutions cannot cover all attack paths across all channels;

[0023] Untimely response: The strategies of each defense node are isolated and cannot work together to intercept cross-platform attacks;

[0024] The false positive rate is relatively high: detection based on static rules is difficult to identify new types of attacks;

[0025] Lack of evidence for tracing the source: Scattered logs make it difficult to analyze the attack chain and locate the breakthrough point;

[0026] The industry urgently needs integrated solutions to achieve a closed loop of monitoring, analysis, and defense.

[0027] For ease of description, the following explains some of the nouns or terms used in the embodiments of this application:

[0028] Omnichannel applications: Application systems that cover multiple terminal access paths, including Web, App, API, and IoT devices.

[0029] End-to-end monitoring: end-to-end data monitoring from user terminal request to server response.

[0030] Collaborative defense: A joint blocking mechanism across security devices.

[0031] Multimodal analysis: A comprehensive threat detection technology that combines rule matching, machine learning, and behavioral analysis.

[0032] The drawbacks of existing technologies are that they are performed after the fact and cannot be blocked in real time; correlation analysis is also difficult.

[0033] As described in the background section, traditional application monitoring methods in the prior art are fragmented, resulting in low security protection capabilities. To address the above problems, embodiments of this application provide a security protection method for terminal applications based on an omnichannel system, a security protection device for terminal applications based on an omnichannel system, a computer program product, and an omnichannel system.

[0034] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0035] The methods and embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a security protection method for terminal applications based on an omnichannel system, according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0036] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the security protection method for terminal applications based on an omnichannel system in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the aforementioned networks may include wireless networks provided by the mobile terminal's communication provider. In one instance, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0037] This embodiment provides a security protection method for terminal applications based on an omnichannel system that run on mobile terminals, computer terminals or similar computing devices. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Also, although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than that shown here.

[0038] Figure 2 This is a flowchart illustrating a security protection method for terminal applications based on an omnichannel system according to an embodiment of this application. Figure 2 As shown, the method includes the following steps:

[0039] Step S201: Use the data acquisition system of the above-mentioned omnichannel system to obtain events of the terminal application, wherein the above-mentioned events include one or more of APP events, mini-application events and data usage events;

[0040] Specifically, to achieve comprehensive coverage, a data acquisition system is employed. This system integrates APP probes, JS probes, and API asset management, enabling real-time capture of various events in terminal applications. These events include, but are not limited to, device status, application tampering, runtime risks, and user behavior in the APP environment; browser / container risks, JS behavior monitoring, API abuse, and phishing detection in the lightweight application environment; and protocol analysis, attack signature detection, and abnormal behavior monitoring at the traffic level. The collection of these events provides raw data support for subsequent in-depth analysis and risk assessment.

[0041] By acquiring events from all channels, this method eliminates blind spots in security monitoring and enables real-time detection and discovery of security threats across multiple terminals and platforms. Specifically, the integration of multi-channel data helps build a more complete and accurate profile of user behavior and device environments, thereby improving the accuracy and completeness of event generation and laying a solid foundation for subsequent risk assessment.

[0042] Step S202: Based on the type of the above-mentioned event, a risk assessment is conducted using the corresponding assessment system of the above-mentioned omnichannel system to obtain the assessment result. The above-mentioned assessment system includes one or more of the APP assessment system, the lightweight application assessment system, and the traffic assessment system.

[0043] Specifically, after receiving and initially processing the event data, this method uses an evaluation system to conduct in-depth analysis of the events and identify potential risks. The evaluation system consists of an APP environment risk analysis engine, a lightweight application environment risk analysis engine, and a traffic risk analysis engine. Each engine, targeting a specific type of event, uses preset rules, machine learning models, and behavioral analysis techniques to generate risk assessment results for the event. For example, the APP environment risk analysis engine checks whether the device is rooted, has malicious software installed, or is using an emulator; the lightweight application environment risk analysis engine monitors JavaScript code execution behavior, detects DOM manipulation, and sensitive data theft; and the traffic risk analysis engine focuses on identifying abnormal network-level activities, such as hacking and credential stuffing attacks.

[0044] By employing a multi-engine integrated evaluation approach, this method enables comprehensive and in-depth analysis of security incidents, reducing false positives and improving the ability to identify new types of attacks. Specifically, the collaborative work between different engines allows the system to cross-validate and correlate events from different sources, thereby more accurately identifying attack behaviors, reducing false positives or false negatives caused by a single detection method, and achieving precise analysis and assessment of security threats.

[0045] Step S203: If the above assessment results indicate the existence of risks, the above-mentioned omnichannel system linkage analysis system generates defense instructions based on the above assessment results and sends the above-mentioned defense instructions to the server used by the financial institution.

[0046] Specifically, once the evaluation system determines that an event has security risks, the linkage analysis system will conduct cross-channel correlation analysis based on the evaluation results, identify the attack chain, calculate the comprehensive risk score, and generate collaborative defense instructions accordingly. These instructions will be sent to the financial institution server through a secure communication channel to trigger corresponding defense measures, such as blocking malicious devices, restricting API call permissions, triggering two-factor authentication, etc., in order to timely block or mitigate the impact of security threats.

[0047] Through the end-to-end linkage risk analysis and collaborative defense mechanism, this method can achieve real-time blocking and proactive defense of security threats, significantly enhancing the security response ability and defense effect of financial institutions. Specifically, by conducting correlation analysis on events from different channels, the linkage analysis system can restore the complete attack chain, understand the attacker's intentions and paths, thereby generating more effective defense instructions, achieving precise interception of attack behaviors, preventing attackers from successfully breaking through a single protection layer through coordinated attacks across different channels, and enhancing the overall security and stability of the system.

[0048] In the prior art, traditional application monitoring methods are often limited to specific platforms or channels, such as Web applications, mobile applications, or API interfaces, and each monitoring module operates independently, lacking an effective information sharing and collaboration mechanism. In this solution, these data collections and application monitoring are placed in the omnichannel system. The omnichannel system is equivalent to a large platform that integrates the data collection system, the evaluation system, and the linkage analysis system. The data collection system can capture events from different terminals and platforms, the evaluation system can conduct risk assessment, and the linkage analysis system, as the coordinator of the entire protection solution, monitors the entire risk assessment process and generates collaborative defense instructions based on the evaluation results. In this way, multiple systems can operate collaboratively, and all functions are integrated together, thereby improving the security protection ability.

[0049] The above omnichannel system includes a data collection system, an evaluation system, and a linkage analysis system. The above data collection system is used to collect data. The above evaluation system is a software engine system with an evaluation function designed in advance based on one or more of rule matching technology, feature analysis technology, and behavior analysis technology. The above linkage analysis system is used to monitor the risk assessment process and generate decisions.

[0050] The aforementioned data acquisition system plays a crucial role in the entire security protection process, responsible for real-time monitoring and collection of various event data from multi-channel terminal applications. The data acquisition system can identify and acquire APP events, lightweight application events, and traffic usage events, covering comprehensive detection needs such as terminal access, application operation, and network communication. For APP events, the data acquisition system collects information such as device status, user behavior, and application operation through probes integrated into the APP. For lightweight application events, it uses JS probes running in the web view to monitor dynamic behavior and page content in the lightweight application environment. For traffic usage events, the data acquisition system collects network traffic data through server-side interfaces, including but not limited to requests, responses, and related parameters.

[0051] The aforementioned assessment system plays a core analytical and judgmental role, serving as the decision-making hub of the entire security protection approach. Based on the type of event, the assessment system sends it to the corresponding subsystem for in-depth analysis: APP events are sent to the APP assessment system, lightweight application events are handled by the lightweight application assessment system, and traffic usage events are handled by the traffic assessment system. Each of these subsystems is equipped with specialized analysis tools and algorithms, enabling refined risk assessments for different types of events. The APP assessment system focuses on analyzing threats in the client application environment, evaluating the overall security status of the APP's operating environment by detecting multiple indicators such as device status, application tampering, runtime risks, and abnormal behavior. The lightweight application assessment system focuses on lightweight applications running within web views or native applications, such as mini-programs or H5 pages, identifying security threats in the lightweight application environment by analyzing container risks, JS behavior, interface abuse, and phishing / fraud detection. Finally, the traffic assessment system is responsible for the network layer, assessing security risks in network traffic through protocol analysis, attack signature detection, abnormal behavior identification, and monitoring of sensitive data writes.

[0052] The aforementioned interconnected analysis system serves as the core of the entire methodology. It integrates and analyzes assessment results from various channels, generating and executing defensive commands. The system first performs in-depth analysis of the received risk assessment results to understand the nature and severity of each event. Then, based on this information, it constructs a correlation graph of risk events, identifying potential connections and attack chains between events. For example, if a user first probes with malicious traffic, then launches a lightweight application attack, and ultimately compromises the app environment, this correlation analysis allows the system to more comprehensively understand the attacker's methods and intentions. Based on the correlation analysis of risk events, the system calculates a risk score to quantify the severity of the current security situation. This scoring mechanism ensures that the system's response matches the threat level. When the risk score reaches a threshold of 0.8 or higher, the system automatically initiates an emergency defense process, generating a series of highly customized defensive commands, such as blocking malicious IP addresses, limiting app call frequency, and suspending transaction functions for suspicious accounts. The linkage analysis system also transforms risk events and assessment results into event datasets, which serve as important inputs for subsequent robot learning and model training. This not only promotes the system's self-optimization but also generates more accurate defense commands. For example, by learning from past event datasets, the system can automatically identify and respond quickly when faced with similar risks, shortening the time for generating prevention commands and improving defense efficiency.

[0053] In this solution, the end-to-end & omnichannel API security platform is the aforementioned omnichannel system, the event generation engine is the aforementioned data collection system, the APP environment risk analysis engine is the aforementioned APP evaluation system, the lightweight application environment risk analysis engine is the aforementioned lightweight application evaluation system, the traffic risk analysis engine is the aforementioned traffic evaluation system, and the end-to-end linkage risk analysis engine is the aforementioned linkage analysis system.

[0054] This invention discloses a multi-engine integrated end-to-end omnichannel attack detection method. To address the issues of fragmented security monitoring and delayed defense response in multi-terminal, multi-platform application scenarios, it utilizes multiple analysis engines to achieve real-time security threat detection across all channels. The end-to-end attack detection includes an event generation engine, an APP environment risk analysis engine, a lightweight application environment risk analysis engine, a traffic risk analysis engine, an end-to-end linked risk analysis engine, and a machine learning engine.

[0055] Specifically, such as Figure 3As shown, the starting point of the "end-to-end attack detection" process is the event generation engine. Taking security as an example, security events can be generated based on scenarios such as data security and business security. The generated security events are based on preset rules or simple logic. The processed data is identified and generated into structured basic security events, which are then distributed to a more professional risk analysis engine for in-depth analysis. This supports omnichannel monitoring and proactive defense, linking end-to-end risk analysis, and is an important component of achieving end-to-end security.

[0056] The information collected is authorized by the user or fully authorized by all parties. The collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant national and regional laws, regulations, and standards, and necessary confidentiality measures are taken. This process does not violate public order and good morals, and a corresponding access point is provided for users to choose whether to authorize or refuse the automated decision-making process. If the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0057] In the specific implementation process, before conducting risk assessment using the corresponding evaluation system of the aforementioned omnichannel system based on the type of the aforementioned event and obtaining the assessment result, the aforementioned method further includes the following steps: using the aforementioned data acquisition system of the aforementioned omnichannel system to obtain a recognition model, wherein the aforementioned recognition model is one of a decision tree model, an SVM model, or a CNN model; using the aforementioned data acquisition system of the aforementioned omnichannel system to form a first training set of historical events and corresponding type labels, using the aforementioned first training set to train the aforementioned recognition model to obtain a type recognition model, wherein the aforementioned type labels are the historical types corresponding to the aforementioned historical events in the aforementioned first training set; using the aforementioned data acquisition system of the aforementioned omnichannel system to input the aforementioned events into the aforementioned type recognition model to obtain the aforementioned type corresponding to the aforementioned events.

[0058] This solution utilizes machine learning models for event type identification, improving identification accuracy, reducing manual classification work, and accelerating response speed. By training the model on a first training set based on rich historical data, this solution enhances the accuracy and generalization ability of type identification, enabling effective classification of unknown event types. Through automatic event classification and identification, this solution accelerates the risk assessment process, enabling immediate response to security threats.

[0059] Specifically, machine learning models can automatically classify new events by learning the characteristics of historical events, avoiding false alarms based on static rules. Especially for events with complex and rapidly changing characteristics, the model's adaptability can effectively capture and classify them, thereby ensuring the accuracy of subsequent risk assessments, reducing invalid alarms, and improving the overall efficiency of security monitoring.

[0060] Trained on large-scale historical data, the model can not only identify known types of events, but also make reasonable inferences and classifications of unknown or mutated event types by learning the inherent relationships between event features. This expands the scope of event processing of the system, enhances the system's flexibility and adaptability, and reduces defense vulnerabilities caused by event classification errors.

[0061] Specifically, the rapid and accurate identification of event types is the first step in risk assessment and defense decision-making. It enables the system to assign events to the most suitable assessment engine for in-depth analysis as soon as possible, avoiding waste of resources, shortening the time interval from event detection to action, and thus improving the timeliness and effectiveness of security protection.

[0062] This solution further incorporates machine learning technology to enhance the accuracy and intelligence of event type recognition. The data acquisition system not only collects events but also acquires models for event type recognition. These models can be decision trees, support vector machines (SVM), convolutional neural networks (CNN), or other machine learning models suitable for event classification. In actual deployment, the most suitable model type can be selected based on specific application requirements and data characteristics. For example, if event types primarily rely on time-series features, decision tree models may be more suitable; while when event data contains a large amount of image or visual information, CNN models offer better performance. To build an efficient and accurate recognition model, the data acquisition system first collects a large number of historical events and their corresponding type labels, forming the first training set. These historical events include various types of security events, such as malware infections, network attack attempts, and abnormal traffic behavior. Each event is labeled with a type label predefined by experts, serving as the label data for training samples. The recognition model is trained using the first training set, enabling it to learn to automatically identify event types based on event characteristics, ultimately resulting in a type recognition model with high classification capabilities. When an event occurs, the data acquisition system feeds the captured event data into a pre-trained type recognition model. The model quickly analyzes the event based on its internal classification logic and outputs the event type. This process requires no manual intervention, achieving automatic event type identification and providing timely and accurate information for subsequent risk assessment and defense decisions.

[0063] In a typical enterprise information system, millions of event records are generated daily, including but not limited to user login attempts, API calls, and data access requests. To achieve efficient event type identification, a decision tree model trained on a first training set (containing over ten million historical events and their type labels from the past year) is used as part of the identification model. This model achieves an accuracy of over 95% on the test set, significantly outperforming simple rule-based identification methods. Specifically, a confidence threshold of 0.8 is set for model predictions. Only when the model's prediction confidence for a particular event type is higher than 0.8 is the classification result considered the final event type; otherwise, the event is marked as "uncertain type" and requires manual review. This threshold setting effectively balances the speed and accuracy of automated identification, ensuring stable system operation and a low false positive rate.

[0064] In some embodiments, risk assessment is performed using the corresponding omnichannel system assessment system based on the type of the aforementioned event, and the assessment result is obtained. This can be achieved through the following steps: If the event is an APP event, the omnichannel system's APP assessment system is used to determine whether the APP event carries a first risk, and the assessment result is obtained. The first risk includes one or more of the following: device usage risk, application tampering risk, APP operation risk, and abnormal user operation risk. If the event is a lightweight application event, the omnichannel system's lightweight application assessment system is used to determine whether the lightweight application event carries a second risk, and the assessment result is obtained. The second risk includes one or more of the following: browser risk, container risk, JS anomaly risk, interface abuse risk, phishing risk, and fraud risk. If the event is a traffic usage event, the omnichannel system's traffic assessment system is used to determine whether the traffic usage event carries a third risk, and the assessment result is obtained. The third risk includes one or more of the following: protocol anomaly risk, web attack risk, input anomaly risk, and sensitive data risk.

[0065] This solution utilizes an APP evaluation system for in-depth event analysis and risk assessment, enabling accurate identification of security threats in native application environments and effectively reducing false positives and false negatives. Through a lightweight application evaluation system for comprehensive risk assessment of lightweight application events, this solution effectively addresses complex security threats in lightweight application environments and enhances the ability to identify new types of attacks. Finally, by analyzing traffic usage events through a traffic evaluation system, this solution achieves real-time network-level security threat detection, preventing malicious traffic from damaging the system.

[0066] Specifically, detailed classification and risk assessment of APP events help the system quickly identify and respond to potential threats. For example, identifying device usage risks can prevent attacks launched by devices that have never been tampered with or controlled; detecting application tampering risks prevents the execution of malicious code; monitoring APP operation risks avoids dynamic attacks during runtime; and analyzing abnormal user operations helps identify malicious human operations. This multi-dimensional risk assessment mechanism greatly improves the system's security protection level and ensures a comprehensive, rapid, and accurate response to security threats.

[0067] Specifically, the polymorphic simulation analysis technology of the lightweight application assessment system can identify various risks in the lightweight application environment, including browser / container risks, abnormal JS behavior, interface abuse, phishing fraud, etc. This helps to fill the blind spots of traditional security monitoring at the lightweight application level. In particular, for cross-platform attacks that use lightweight applications as entry points, the system can identify and take action in a timely manner, improving the comprehensiveness and intelligence of overall security protection.

[0068] Specifically, the traffic assessment system's protocol analysis and attack signature detection capabilities can promptly detect and prevent network-level attacks, while anomaly detection and sensitive data leakage detection can identify potential internal threats and data breach risks, thereby ensuring the integrity and security of network traffic. This real-time monitoring and intelligent analysis mechanism enables the system to respond promptly to network attacks, preventing attackers from successfully infiltrating the system through traffic-level penetration and protecting the system's network boundary security.

[0069] When an incident involves a native mobile application, the app evaluation system will examine the device status, application tampering, runtime risks, and user behavior to determine if any primary risks have occurred. Specifically, the system will analyze whether the device is rooted, has malicious software installed, is running on an emulator, has debug mode enabled, or is connected to a proxy / VPN, all of which are typical signs of device usage risks. Simultaneously, the system will detect whether the app has been repackaged, has undergone code injection, or has had its signature tampered with; these behaviors constitute application tampering risks. Furthermore, the system will monitor the app's runtime for dynamic injection attacks such as Hook / Frida / Xposed, memory tampering, and critical function call hijacking; this is an app runtime risk detection. Finally, the system will analyze whether user operations conform to normal patterns and whether there are automated scripts, cracks, or high-frequency abnormal operations to determine if there are any abnormal user operation risks.

[0070] For lightweight applications running in WebView or mini-program environments, the lightweight application assessment system further analyzes browser or container security configurations, JavaScript code execution behavior, API call patterns, page content, and user interaction behavior to assess the existence of secondary risks. Specifically, this includes checking browser / container plugin status, debug mode activation, and WebView security configuration; monitoring JavaScript code execution behavior, such as DOM manipulation, sensitive data theft, keylogging, and UI overlay attacks; detecting unauthorized API calls, parameter tampering, and abnormal call frequencies; and analyzing page content, URLs, and user interaction behavior to identify fake login pages, phishing forms, and fraudulent transaction inducements—all potential sources of secondary risks.

[0071] For network traffic-level events, the traffic assessment system will focus on protocol analysis, attack signature detection, abnormal behavior monitoring, and sensitive data leakage detection. The system will parse protocols such as HTTP / HTTPS and WebSocket, extracting request / response content, header information, and parameters to check for protocol anomalies; utilize a rule base to detect common web attacks such as SQL injection, XSS, command injection, path traversal, SSRF, and CSRF; identify abnormally high-frequency requests, scanning and probing behaviors, login cracking, credential stuffing attacks, and data crawling; and monitor traffic for the leakage of sensitive information (such as ID card numbers, bank card numbers, and plaintext passwords). These are all criteria for identifying third-party risks.

[0072] Suppose that on a financial trading platform, a user login attempt triggers an app event, which is then automatically sent to the app assessment system for risk evaluation. The system detects that the device is connected to an unknown proxy server and shows signs of memory tampering. Based on a risk threshold of 0.7, the system determines this to be a high-risk login attempt, posing risks to both device usage and app operation, and the assessment indicates a significant security threat. In another scenario, a lightweight app event is captured: a user makes frequent abnormal transaction attempts within the lightweight app environment. This activity is identified by the lightweight app assessment system. By monitoring JavaScript behavior and API calls, the system finds that the frequency and pattern of transaction requests are significantly different from normal user behavior. Combined with page content analysis, the system determines this to be the second risk category: API abuse and fraud risk. The assessment result suggests that the transaction should be immediately blocked and the user's account suspended. Finally, at the traffic level, the system detects a series of abnormally high-frequency requests to a specific API. After analysis, the traffic assessment system determines this to be a typical credential stuffing attack, belonging to the third risk category: abnormal input risk. Based on the set frequency threshold of 100 times / minute, the system triggered an automatic defense mechanism, limiting the access frequency of the API and blocking the IP address initiating the attack, thus ensuring server security. Through the above specific implementation methods, it can be seen that the technical solution of this invention can effectively identify and respond to security threats from different channels in practical applications, not only improving the accuracy of risk assessment but also achieving proactive defense and significantly enhancing the overall security protection capability of the system.

[0073] Specifically, such as Figure 4 The diagram illustrates the architecture and risk classification system for omnichannel API risk discovery. Risks are categorized into: APP environment risks (e.g., HTTP anomalies, page hijacking, cloud function risks), suspected application environment risks (e.g., cheating risks, abnormal user behavior), omnichannel API risks (e.g., IP / UA / key anomalies, abnormal request parameters), traffic risks (e.g., malicious access, data leakage, unauthorized access), and machine learning risks (e.g., device fingerprinting, access frequency, transaction risks). The right side lists the dimensions for risk identification (device, method, channel, access frequency, behavior, message, etc.). From left to right, the diagram shows the entire data flow from the user access point (APP, WeChat H5, mini-program, Web, etc., collecting environment information through APP probes and JS probes), through switches and business gateways, to the backend service, thus achieving the collection and transmission of risk data.

[0074] Among them, the product architecture is as follows Figure 5As shown, the diagram presents the entire process of data acquisition from the client side to data storage, analysis, and visualization, along with the data flow logic. The client side includes the APP SDK and JS SDK, responsible for collecting user-side data and initiating requests. The access layer includes modules for behavior acquisition and intelligent anomaly detection interaction, serving as the entry point for data into the system. It also includes traffic probes and log probes for monitoring. The real-time processing layer contains real-time rule engine calculation and anomaly intelligent decision-making modules, performing real-time rule matching and anomaly decisions on the data. The caching layer includes user behavior caching and user risk data caching, used for temporary storage of frequently accessed data. The offline computing layer (streaming processing) includes offline computing modules for user behavior and risk data, performing batch data analysis. Persistent storage includes behavior data storage aggregation and feature data storage, used for long-term data preservation. Offline batch training (batch processing) includes risk model feature calculation training, indicator analysis, and LLM model calculation, supporting batch data training and analysis. The web page data dashboard provides external API services and Hadoop-based big data configurations for data visualization and external services.

[0075] In the specific implementation process, after conducting risk assessments using the corresponding omnichannel system's assessment system based on the type of the aforementioned events and obtaining the assessment results, the method further includes the following steps: when there are multiple events, the omnichannel system's linkage analysis system extracts the events that represent risks based on the assessment results, thus obtaining risk events; the omnichannel system's linkage analysis system extracts the generation time of all the aforementioned risk events; the omnichannel system's linkage analysis system sorts the risk events according to their generation time from earliest to latest, thus obtaining the sorted risk events, in order to reconstruct the attack chain.

[0076] This solution prioritizes security threats by extracting risk events, ensuring critical risks are addressed promptly. By extracting the generation time of risk events, it establishes an event time sequence, providing crucial clues for reconstructing the attack chain. Furthermore, by chronologically sequencing risk events, the solution enables accurate reconstruction of the attack chain, enhancing the system's attribution capabilities and understanding of attack intent.

[0077] Specifically, by filtering and focusing on risk events, the linkage analysis system can avoid excessive resource consumption on low-risk events and ensure that the system has sufficient response speed and processing capacity when dealing with high-risk security threats.

[0078] Specifically, recording the time of event generation helps the system identify temporal patterns of attack behavior. For example, whether a series of events occur in a short period of time may be an indication that attackers are trying to quickly breach security defenses. Through time series analysis, the attacker's action rhythm and strategy can be revealed, providing a basis for defense decisions.

[0079] Specifically, accurate reconstruction of the attack chain means that the system can track the entire process from the attacker's initial intrusion attempt to the final successful exploitation of the vulnerability. This not only helps to pinpoint the exact location of the security vulnerability, but also reveals the attacker's strategies and objectives, providing valuable practical experience for future defense planning. It also facilitates post-attack review and improves the system's self-improvement capabilities.

[0080] When the system detects multiple events simultaneously, the linkage analysis system will filter out those events marked as posing a security risk based on the evaluation results; these events are defined as risk events. Through this step, the system can concentrate resources, prioritizing and addressing high-risk events, improving the efficiency and targeting of security responses. The linkage analysis system further collects the generation time of all risk events, which is one of the key bases for event sequencing and attack chain reconstruction. By accurately recording the time of event occurrence, the system can construct a time series, laying the foundation for subsequent event correlation and analysis. The linkage analysis system will rearrange the risk events according to their chronological order, ensuring the spatiotemporal continuity of the events and helping the system reconstruct the true order of events. Through time sequencing, even if the original data sources are diverse and may have timestamp discrepancies, the system can correct these discrepancies and construct a coherent attack event timeline, which is crucial for understanding and tracking attacker behavior paths.

[0081] Suppose that within a single day, a financial institution experiences a series of security incidents across multiple electronic channels, including but not limited to one app incident (malware infection), two mini-app incidents (spoofed login pages and suspicious transactions), and five traffic usage incidents (abnormally high-frequency requests). The integrated analysis system first identifies risk events from the assessment results. For example, the malware-infected app incident is marked as a risk event because its device usage risk assessment result exceeds the threshold of 0.8; the spoofed login pages and suspicious transactions mini-app incidents are also classified as risk events due to the presence of secondary risks (phishing and fraud risks); three of the five traffic usage incidents are confirmed to have a tertiary risk (web attack risk), thus becoming a focus of attention. Next, the integrated analysis system extracts the generation time of all risk events, finding that the malware-infected app incident occurred at 10:00 AM, the spoofed login page mini-app incident followed closely at 10:05 AM, and the suspicious transaction incident occurred at 1:30 PM; while the abnormally high-frequency requests were detected at 10:10 AM, 12:00 PM, and 1:20 PM. The system rearranged these risk events chronologically, forming a clear timeline: from the initial malware infection of devices, to attempts to steal identities via spoofed login pages, to using illegally obtained identities for suspicious transactions, and finally to attempts to breach API security configurations through abnormally high-frequency requests. By chronologically sequencing these risk events, the system successfully reconstructed the attack chain, showing the attacker's process from preparation to attack execution and then to attempting to profit. This accurate identification of the attack chain enabled financial institutions to quickly implement targeted defensive measures, blocking infected devices, strengthening user login verification, freezing suspicious transactions, and restricting API call permissions for abnormal traffic, effectively curbing further attacker actions and protecting customer funds and data security.

[0082] Specifically, such as Figure 6 As shown, end-to-end attack detection integrates SDK / JS-SDK probes into the access terminal application and simultaneously accesses the server's access traffic. It comprehensively utilizes streaming, batch computing, and machine learning technologies to construct an end-to-end linked security monitoring system for electronic channels, covering all of the customer's electronic channels and supporting collaborative defense between channels. The specific architecture is as follows: The end-to-end full-channel application security monitoring and collaborative defense system includes APP probes, JS probes, API asset management, and end-to-end attack detection. End-to-end attack detection includes an event generation engine, an APP environment risk analysis engine, a lightweight application environment risk analysis engine, a traffic risk analysis engine, an end-to-end linked risk analysis engine, and a machine learning engine.

[0083] The event generation engine functions as follows: It is the starting point and core coordinator of the entire "end-to-end attack discovery" process.

[0084] The role of the event generation engine is as follows:

[0085] 1. Data Reception: Receives raw security events, logs, behavioral data, and anomaly signals reported in real time from various probes and asset management systems. 2. Preliminary Processing: Performs preliminary cleaning, formatting, and standardization on the raw data. 3. Event Generation: Based on preset rules or simple logic, identifies and generates structured basic security events from the processed data.

[0086] The APP environment risk analysis engine has the following functions: focusing on analyzing the risks of the native mobile application runtime environment.

[0087] The APP environment risk analysis engine serves the following purposes:

[0088] 1. Device Risk: Analyze device information reported by the APP probe to determine if the device is rooted, has malicious software installed, is using an emulator, is in debug mode, or is connected to a proxy / VPN, etc. 2. Application Tampering: Detect whether the APP has been repackaged, injected with code, or had its signature tampered with. 3. Runtime Risk: Detect whether there are dynamic injection attacks such as Hook / Frida / Xposed, memory tampering, or critical function call hijacking during APP operation. 4. Abnormal Behavior: Analyze whether user operation behavior conforms to normal patterns and whether there are automated scripts, cracks, or high-frequency abnormal operations. 5. Environment Correlation: Combine device risks and application behavior to assess the overall security risk level of the APP's operating environment.

[0089] The lightweight application environment risk analysis engine has the following functions: focusing on analyzing the risks of mini-programs / WebView / H5 application environments running within apps.

[0090] The role of the lightweight application environment risk analysis engine is as follows:

[0091] 1. Browser / Container Risks: Analyze browser / host app environment information reported by JS probes, such as plugin status, debug mode enabled status, and WebView security configuration. 2. JS Behavior Monitoring: Deeply analyze JS code execution behavior to detect DOM manipulation, sensitive data theft, keylogging, UI overlay attacks, WebSocket hijacking, and cross-site scripting attacks. 3. API Abuse: Monitor JS calls to APIs provided by the host app to detect unauthorized calls, parameter tampering, and abnormal call frequencies. 4. Phishing / Fraud Detection: Analyze page content, URLs, and user interaction behavior to identify fake login pages, phishing forms, and fraudulent transaction inducements. 5. Environment Correlation: Assess the overall security risk level of the lightweight application's operating environment.

[0092] The traffic risk analysis engine has the following functions: focusing on analyzing network-level traffic data.

[0093] The traffic risk analysis engine serves the following purposes:

[0094] 1. Protocol Analysis: Parses HTTP / HTTPS, WebSocket, and other protocols, extracting request / response content, header information, parameters, etc. 2. Attack Signature Detection: Detects common web attacks based on a rule-based database, including SQL injection, XSS, command injection, path traversal, SSRF, CSRF, API abuse, etc. 3. Abnormal Behavior Detection: Identifies abnormal high-frequency requests, scanning and probing behaviors, login cracking, credential stuffing attacks, data crawling, etc. 4. Sensitive Data Leakage Detection: Monitors traffic for the leakage of sensitive information (such as ID card numbers, bank card numbers, plaintext passwords). 5. Bot Management: Identifies and distinguishes between good and bad bot traffic.

[0095] The end-to-end collaborative risk analysis engine has the following functions: It is the key brain for realizing an "end-to-end" security perspective and "collaborative defense".

[0096] The end-to-end collaborative risk analysis engine serves the following purposes:

[0097] 1. Event Correlation: Receives and correlates advanced risk events and risk contexts output from different engines (APP environment, lightweight application environment, traffic). 2. Cross-Channel Correlation: Identifies attack behaviors across different channels. 3. Attack Chain Reconstruction: Constructs a complete attack chain from individual risk points scattered across various channels, based on dimensions such as time series, user sessions, device identification, and API call chains. Understands the attacker's intent, path, and ultimate goal. 4. Risk Aggregation and Scoring: Based on the correlated attack chain information, performs a more comprehensive and accurate risk assessment, calculating a comprehensive risk score. 5. Collaborative Defense Decision: Generates collaborative defense instructions based on the complete attack chain and risk score.

[0098] In some embodiments, the linkage analysis system of the aforementioned omnichannel system generates defense instructions based on the aforementioned evaluation results, which can be achieved through the following steps: The linkage analysis system of the aforementioned omnichannel system extracts all the ranked risk events, and determines a risk score based on the number of ranked risk events, wherein the number of ranked risk events and the risk score are positively correlated; The linkage analysis system of the aforementioned omnichannel system combines the ranked risk events and the risk scores into an event dataset; The linkage analysis system of the aforementioned omnichannel system obtains a generative model, wherein the generative model is one of a GNN model, a RL model, and a Bayesian model; The linkage analysis system of the aforementioned omnichannel system combines the historical event dataset and the corresponding instruction labels into a second training set, and trains the generative model using the second training set to obtain an instruction generation model, wherein the instruction labels are the historical defense instructions corresponding to the historical event dataset in the second training set; The linkage analysis system of the aforementioned omnichannel system inputs the event dataset into the instruction generation model to obtain the defense instructions corresponding to the event dataset.

[0099] This solution utilizes the positive correlation between the number of events and risk scores to achieve a quantitative assessment of security threats, effectively guiding the allocation of defense resources. By constructing an event dataset, the solution provides a structured and easily analyzable collection of security threat information, accelerating defense decision-making. Leveraging advanced generative models, the solution automatically generates the most suitable defense commands, enhancing the intelligence and dynamic adaptability of defense decisions. Through the construction of a second training set and model training, the solution enables personalized customization of defense commands, ensuring highly targeted and effective defense measures.

[0100] The positive correlation between the number of events and the risk score enables the system to identify situations requiring an urgent response. For example, when a large number of risk events are detected in a short period of time, the system will automatically increase the risk score and trigger higher-level defense measures to ensure that more resources can be mobilized in a timely manner to deal with a large-scale threat and prevent the attack from spreading.

[0101] The organization of the event dataset facilitates data analysis and pattern recognition by the system. In particular, the addition of risk scoring makes the severity of events immediately apparent, enabling the system to quickly identify events that require priority handling and saving valuable time in the formulation and implementation of defensive measures.

[0102] By employing GNN, RL, or Bayesian models, the system can learn and predict the best defense strategy based on historical data and the current security situation. This not only improves the efficiency of instruction generation but also enables the system to cope with evolving attack tactics, making defense measures more forward-looking and effective.

[0103] Specifically, based on successful cases of past event handling, the model learns how to generate the most suitable defense commands in similar situations. This means the system can generate refined responses to each unique attack, avoiding the inefficiencies and false alarms that may exist in general defense strategies. Through the dynamic decision-making of the command generation model, this solution can achieve immediate response and proactive defense against security threats, significantly improving the real-time performance and effectiveness of defense. Specifically, based on dynamic analysis of event datasets, the system can predict and generate defense commands in the early stages of an attack. This not only accelerates the defense response speed but also proactively blocks the attack source, preventing attackers from exploiting the time difference in defense decision-making for further penetration, thereby protecting the system from damage.

[0104] After organizing and ranking risk events, the linkage analysis system determines a risk score based on the number of events. More events result in a higher score, indicating a greater threat level. This scoring mechanism fully considers the cumulative effect of events and can quantify the severity of the overall security situation. The linkage analysis system combines the ranked risk events with their respective risk scores to form a detailed event dataset. This dataset not only contains basic information and types of events but also includes quantified risk scores, providing more comprehensive data support for subsequent analysis and defense. The linkage analysis system employs advanced algorithms such as Graph Neural Networks (GNNs), Reinforcement Learning (RL), or Bayesian models as generative models to achieve intelligent generation of defense commands. The choice of different models depends on the specific scenario requirements and data characteristics. For example, GNNs are suitable for handling complex relationships between events, RL is suitable for optimal decision-making in dynamic environments, while Bayesian models perform well under conditions of high uncertainty. The linkage analysis system uses historical event datasets and corresponding historical defense commands to create a second training set for training the generative model. By learning the correspondence between past events and defense commands, the model gradually learns how to generate effective defense commands based on event datasets. This learning process based on historical data improves the model's generalization ability and adaptability. Finally, the linkage analysis system inputs the current event dataset into the command generation model, which automatically generates a set of defense commands that match the event dataset based on its learned knowledge. This command generation process considers both the specific details of the events and incorporates the wisdom of historical event processing, ensuring accurate formulation and rapid response of defense measures.

[0105] Given that the financial institution suffered 10 high-risk events in a single day, involving multiple aspects such as device tampering, phishing attacks, and abnormal traffic, the linkage analysis system, following the guidelines in the disclosure document, first determined a risk score. In this case, due to the large number of events, the risk score was set to 9.5, indicating a very serious security threat. Next, the system combined these 10 events and their risk scores into an event dataset for subsequent defense command generation. To generate optimal defense commands, the system selected a Generative Neural Network (GNN) model as the generation model because the correlation between events was particularly prominent in this case; multiple events appeared to follow a specific temporal pattern and spatial distribution, and GNN could effectively analyze such complex relationships. The system used a second training set collected over the past three months, including over 10,000 event data points and their corresponding defense commands, to deeply train the GNN model, resulting in a command generation model. This model achieved an accuracy of 90% on the training set, demonstrating good learning ability and decision-making quality. Subsequently, the linkage analysis system input the current event dataset into the command generation model, and through the model's intelligent analysis, obtained a set of defense commands targeting this security threat. The instructions include, but are not limited to: blocking all detected malicious device IP addresses; suspending user accounts affected by phishing attacks until secondary verification is successful; limiting API call frequency to 20 times per second to alleviate the pressure of abnormal traffic; and notifying the security team to conduct an urgent investigation and handle the incident. Through this series of model-generated defense instructions, financial institutions can respond to security threats quickly and effectively, protecting not only customer account security but also maintaining the stable operation of the system, demonstrating the invention's superior defense performance and intelligent decision-making capabilities in dynamic environments.

[0106] In the specific implementation process, after conducting risk assessment using the corresponding evaluation system of the aforementioned omnichannel system according to the type of the aforementioned event and obtaining the evaluation result, the aforementioned method further includes: a learning step: using the machine learning system of the aforementioned omnichannel system to learn the aforementioned events and the corresponding evaluation results; a construction step: if the aforementioned events obtained in the next instance do not belong to the aforementioned APP events, the aforementioned mini-app events, and the aforementioned traffic usage events, using the aforementioned machine learning system of the aforementioned omnichannel system to construct a new evaluation system of the aforementioned omnichannel system, wherein the aforementioned new evaluation system is a system used to conduct risk assessment on the aforementioned events obtained in the next instance; an evaluation step: using the aforementioned new evaluation system of the aforementioned omnichannel system to conduct risk assessment on the aforementioned events obtained in the next instance, and obtaining the aforementioned evaluation result.

[0107] This solution employs a continuous learning mechanism to progressively optimize the accuracy of risk assessments and adapt to evolving attack patterns. By dynamically building new assessment systems, it continuously expands the coverage of security monitoring and enhances the ability to identify unknown threats. Through the application of these new assessment systems, the solution enables immediate response to unknown security threats, ensuring that the system's defensive capabilities keep pace with the development of attack techniques.

[0108] Specifically, machine learning systems can gradually improve their predictive models by learning the relationship between events and evaluation results, reducing false positives and false negatives. Especially when facing new types of attacks, the system's adaptive learning ability can help it quickly identify and correctly assess risks, improving the system's defensive flexibility and intelligence.

[0109] Specifically, the system can respond quickly to unknown event types. By building a new assessment system, it not only fills the gap in security monitoring but also conducts preliminary assessments of unknown threats, avoiding security vulnerabilities caused by insufficient monitoring methods and ensuring the system can promptly detect and respond to new types of attacks.

[0110] Specifically, the new assessment system is directly applied to the real-time monitoring and risk assessment of unknown events, which can effectively prevent and mitigate the impact of unknown threats on system security, and ensure the long-term stability and security of the system.

[0111] The aforementioned omnichannel system also includes a machine learning system. This system is used for self-learning and system creation. After each risk assessment, the machine learning system records the assessment results and performs deep learning on the event and its risk assessment results to identify potential connections between event characteristics and risks. This process allows the system to continuously accumulate experience and improve its ability to identify event types and risk levels. When encountering events that cannot be classified by the existing assessment system, the machine learning system will use its learned knowledge and patterns to build a new assessment system specifically for handling these new types of events. The construction of the new assessment system is based on deep analysis of the characteristics of unknown events. Through model training and validation, it ensures that it can accurately assess the risks of new types of events. Once the new assessment system is built, it will be used to analyze and assess the next unknown type of event encountered, generating risk assessment results. This process ensures that the system can adapt to environmental changes and continuously optimize its security capabilities. The machine learning engine is the aforementioned machine learning system.

[0112] Suppose that one day, a financial institution's monitoring system detects a new type of event. This event is neither a typical app event, a lightweight application event, nor a data usage event, but rather a new type of anomalous event involving IoT devices. The emergence of this event indicates for the first time that security threats are expanding to a wider range of electronic devices, and traditional assessment systems have limited capabilities in handling such events. To address this, the system first enters a learning phase. The machine learning system begins to learn the characteristics of this event and its correlation with other events. For example, it learns that these anomalous device events often have a temporal correlation with app events and data usage events, potentially indicating that attackers are conducting initial reconnaissance of IoT devices, preparing for a subsequent large-scale attack. Based on this discovery, the system enters a construction phase, using the learned knowledge to build a new assessment system specifically designed to analyze anomalous behavior of IoT devices, including but not limited to abnormal device status, abnormal data transmission, and abnormal operation commands. In the subsequent assessment phase, the system successfully performs risk assessments on subsequent anomalous IoT device events. For example, when the system detects that a device is frequently attempting to establish connections with an unknown server, and the connection frequency exceeds the threshold of 5 times per minute, the new assessment system determines that this may be a high-risk attempt to control the device. It then generates corresponding defensive instructions, including blocking the unknown server's IP address and restricting the device's network access permissions, effectively curbing potential IoT device attacks. Through this series of specific implementations, financial institutions have demonstrated the self-evolving capabilities of their security systems in the face of unknown threats. This not only protects the security of existing electronic channels but also proactively addresses IoT security, achieving comprehensive monitoring and intelligent response to emerging security threats. This highlights the significant advantages of this invention in continuous innovation and intelligent defense in the security field.

[0113] The functions of a machine learning engine are as follows: providing intelligent analysis and adaptive capabilities to the entire system, typically integrated into multiple engines or serving as a standalone support layer. Its roles include: Anomaly Detection Model: Training the model to learn the behavioral baselines of normal users, devices, applications, and API traffic to detect abnormal behavior deviating from the baseline and discover unknown threats. Attack Classification Model: Classifying detected events to distinguish specific attack types. Risk Scoring Model: Utilizing feature engineering and machine learning algorithms to calculate more accurate dynamic risk scores for events, sessions, users, and devices. Correlation Analysis Optimization: Assisting the end-to-end linkage engine, using graph algorithms, sequence analysis, etc., to more effectively discover complex cross-channel attack patterns. Adaptive Rule Optimization: Analyzing attack trends and rule hit / false positive rates, automatically optimizing or suggesting optimizations for existing detection rules. Threat Intelligence Generation: Automatically discovering new attack features, IOCs, etc., from massive amounts of data and generating threat intelligence.

[0114] In some embodiments, after performing risk assessment using the corresponding omnichannel system assessment system based on the type of the aforementioned event and obtaining the assessment result, the method further includes the following steps: using the linkage analysis system of the omnichannel system to determine whether each of the aforementioned events has a corresponding assessment result; in the case where there is an event without a corresponding assessment result, using the linkage analysis system of the omnichannel system to identify the event without the assessment result as an omitted event, and using the assessment system of the omnichannel system corresponding to the omitted event to perform risk assessment and obtain the assessment result.

[0115] This solution ensures the completeness of risk assessments by verifying each event against the assessment results, preventing any potential security risks from slipping through the cracks. Through automatic supplementary assessments of missed events, this solution eliminates blind spots in the assessment process, ensuring that all security events are properly analyzed.

[0116] Specifically, by confirming the evaluation results of each event, the linkage analysis system can ensure that the security protection system fully covers all potential threats, reduce security vulnerabilities caused by omissions in the evaluation, and improve the overall security and reliability of the system.

[0117] Specifically, supplementary assessments of missed events compensate for potential oversights in security assessments. Especially when the number of events is large and the system's processing capacity is limited, it ensures that no important security information is missed, further improving the system's defense integrity and efficiency.

[0118] After the risk assessment process is completed, the linkage analysis system automatically verifies whether each event has undergone the corresponding assessment procedure and obtained a clear assessment result. This mechanism ensures that no monitored event is overlooked, and that all events, whether high-risk or low-risk, are properly handled. For events for which assessment results are not obtained in a timely manner, the linkage analysis system marks them as missed events. Subsequently, the system automatically activates the assessment system matching the event type to conduct supplementary analysis on the missed events, ensuring that all events receive timely and accurate risk assessments.

[0119] Suppose that on a certain day, a financial institution's monitoring platform receives a large number of events during a busy trading period. Most of these events pass the risk assessments promptly through the APP evaluation system, lightweight application evaluation system, and traffic evaluation system. However, a few events, due to limitations in the system's instantaneous processing capacity, fail to receive immediate assessment results; these events are considered missed events. Following the guidance of this invention, the linkage analysis system automatically intervenes, first checking all events one by one to identify which events lacked assessment results. In this example, the system finds 10 events that failed to receive assessment within the specified time: 7 abnormal API call events, 2 failed user login attempts, and 1 abnormal device status report. None of these events received immediate assessment feedback. The linkage analysis system categorizes these missed events and activates the corresponding evaluation systems for supplementary risk assessments. For abnormal API call events, the traffic risk analysis engine is invoked to detect the risk of API abuse. For example, if an API is called more than 5000 times per hour within a unit of time, it is judged as high-risk, requiring further traffic restrictions and IP blocking. For user login attempt failures, the APP environment risk analysis engine is activated to check if the issue stems from device usage risks, such as whether the device is connected to an unknown proxy server or has debug mode enabled. For device status anomaly reports, the lightweight application environment risk analysis engine is activated to analyze for container risks or abnormal JS behavior, such as checking for unauthorized code injection attempts. After supplementary evaluation, all missed events received corresponding risk scores and assessment results, leaving no monitoring blind spots. For example, abnormal API call events were assessed as high-risk, user login attempt failures were classified as medium-risk, and device status anomaly reports were determined to be low-risk. This information is then fed back into the system for dynamically updating defense strategies, including but not limited to increasing API call frequency limits, strengthening user login authentication mechanisms, and conducting further security checks on relevant devices. This achieves comprehensive coverage and timely response to all security events, significantly enhancing the system's defense capabilities and security.

[0120] This solution proposes a multi-engine, end-to-end, multi-channel attack detection method, which fundamentally breaks through the limitations of traditional defense technologies. Specifically, it has the following advantages: comprehensive coverage: supports multi-channel monitoring; proactive defense: identifies potential threats in advance; end-to-end security: end-to-end linked risk analysis.

[0121] The main innovations of this invention are the end-to-end omnichannel data collection and standardization method and the multi-engine end-to-end omnichannel attack detection method.

[0122] This application also provides a security protection device for terminal applications based on an omnichannel system. It should be noted that this security protection device for terminal applications based on an omnichannel system can be used to execute the security protection method for terminal applications based on an omnichannel system provided in this application. This device is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0123] The following describes the security protection device for terminal applications based on an omnichannel system provided in the embodiments of this application.

[0124] Figure 7 This is a structural block diagram of a security protection device for terminal applications based on an omnichannel system, according to an embodiment of this application. (For example...) Figure 7 As shown, the device includes:

[0125] The first acquisition unit 10 is used to acquire events of the terminal application using the data acquisition system of the above-mentioned omnichannel system, wherein the above-mentioned events include one or more of APP events, mini application events and data usage events;

[0126] The first assessment unit 20 is used to conduct risk assessment using the corresponding assessment system of the above-mentioned omnichannel system according to the type of the above-mentioned event, and obtain the assessment result. The above-mentioned assessment system includes one or more of the APP assessment system, the lightweight application assessment system and the traffic assessment system.

[0127] The protection unit 30 is used to generate a defense instruction based on the assessment results when the above assessment results indicate that there is a risk, and to send the defense instruction to the server used by the financial institution.

[0128] In existing technologies, traditional application monitoring methods are often limited to specific platforms or channels, such as web applications, mobile applications, or API interfaces. Moreover, each monitoring module operates independently, lacking an effective information sharing and collaboration mechanism. In this solution, however, all data collection and application monitoring are placed in an omnichannel system. The omnichannel system is like a large platform that integrates a data collection system, an assessment system, and a linkage analysis system. The data collection system can capture events from different terminals and platforms, the assessment system can perform risk assessments, and the linkage analysis system acts as the coordinator of the entire protection solution, monitoring the entire risk assessment process and generating collaborative defense instructions based on the assessment results. In this way, multiple systems can operate collaboratively, and all functions are integrated together, thereby improving security protection capabilities.

[0129] In the specific implementation process, the above-mentioned device further includes a second acquisition unit, a first processing unit, and a second processing unit. The second acquisition unit is used to acquire a recognition model using the data acquisition system of the omnichannel system before performing a risk assessment using the corresponding evaluation system of the omnichannel system according to the type of the event and obtaining the assessment result. The recognition model is one of a decision tree model, an SVM model, and a CNN model. The first processing unit is used to use the data acquisition system of the omnichannel system to form a first training set of historical events and corresponding type labels, and to train the recognition model using the first training set to obtain a type recognition model. The type labels are the historical types corresponding to the historical events in the first training set. The second processing unit is used to input the event into the type recognition model using the data acquisition system of the omnichannel system to obtain the type corresponding to the event.

[0130] This solution utilizes machine learning models for event type identification, improving identification accuracy, reducing manual classification work, and accelerating response speed. By training the model on a first training set based on rich historical data, this solution enhances the accuracy and generalization ability of type identification, enabling effective classification of unknown event types. Through automatic event classification and identification, this solution accelerates the risk assessment process, enabling immediate response to security threats.

[0131] In some embodiments, the first evaluation unit includes a first evaluation module, a second evaluation module, and a third evaluation module. The first evaluation module is used to determine whether there is a first risk in the APP event when the event is the APP event, using the APP evaluation system of the omnichannel system, and obtain the evaluation result. The first risk includes one or more of the following: device usage risk, application tampering risk, APP operation risk, and abnormal user operation risk. The second evaluation module is used to determine whether there is a second risk in the lightweight application event when the event is the lightweight application event, using the lightweight application evaluation system of the omnichannel system, and obtain the evaluation result. The second risk includes one or more of the following: browser risk, container risk, JS anomaly risk, interface abuse risk, phishing risk, and fraud risk. The third evaluation module is used to determine whether there is a third risk in the traffic usage event when the event is the traffic usage event, using the traffic evaluation system of the omnichannel system, and obtain the evaluation result. The third risk includes one or more of the following: protocol anomaly risk, web attack risk, input anomaly risk, and sensitive data risk.

[0132] This solution utilizes an APP evaluation system for in-depth event analysis and risk assessment, enabling accurate identification of security threats in native application environments and effectively reducing false positives and false negatives. Through a lightweight application evaluation system for comprehensive risk assessment of lightweight application events, this solution effectively addresses complex security threats in lightweight application environments and enhances the ability to identify new types of attacks. Finally, by analyzing traffic usage events through a traffic evaluation system, this solution achieves real-time network-level security threat detection, preventing malicious traffic from damaging the system.

[0133] In the specific implementation process, the above-mentioned device further includes a first extraction unit, a second extraction unit, and a sorting unit. The first extraction unit is used to perform risk assessment using the corresponding evaluation system of the above-mentioned omnichannel system according to the type of the above-mentioned event. After obtaining the evaluation result, if there are multiple above-mentioned events, the above-mentioned linkage analysis system of the above-mentioned omnichannel system is used to extract the above-mentioned events that represent risks according to the evaluation results, and obtain risk events. The second extraction unit is used to extract the generation time of all the above-mentioned risk events using the above-mentioned linkage analysis system of the above-mentioned omnichannel system. The sorting unit is used to sort the above-mentioned risk events according to the generation time from first to last using the above-mentioned linkage analysis system of the above-mentioned omnichannel system, and obtain the sorted risk events, so as to restore the attack chain.

[0134] This solution prioritizes security threats by extracting risk events, ensuring critical risks are addressed promptly. By extracting the generation time of risk events, it establishes an event time sequence, providing crucial clues for reconstructing the attack chain. Furthermore, by chronologically sequencing risk events, the solution enables accurate reconstruction of the attack chain, enhancing the system's attribution capabilities and understanding of attack intent.

[0135] In some embodiments, the protection unit includes a first processing module, a composition module, an acquisition module, a second processing module, and a third processing module. The first processing module is used to extract all the sorted risk events using the aforementioned linkage analysis system of the omnichannel system, and determine a risk score based on the number of sorted risk events, wherein the number of sorted risk events and the risk score are positively correlated. The composition module is used to combine the sorted risk events and the risk scores into an event dataset using the aforementioned linkage analysis system of the omnichannel system. The acquisition module is used to acquire a generative model using the aforementioned linkage analysis system of the omnichannel system, wherein the generative model is one of a GNN model, a RL model, and a Bayesian model. The second processing module is used to combine the historical event dataset and the corresponding instruction labels into a second training set using the aforementioned linkage analysis system of the omnichannel system, and train the generative model using the aforementioned second training set to obtain an instruction generation model, wherein the instruction labels are historical defense instructions corresponding to the historical event dataset in the aforementioned second training set. The third processing module is used to input the event dataset into the instruction generation model using the aforementioned linkage analysis system of the omnichannel system to obtain the defense instructions corresponding to the event dataset.

[0136] This solution utilizes the positive correlation between the number of events and risk scores to achieve a quantitative assessment of security threats, effectively guiding the allocation of defense resources. By constructing an event dataset, the solution provides a structured and easily analyzable collection of security threat information, accelerating defense decision-making. Leveraging advanced generative models, the solution automatically generates the most suitable defense commands, enhancing the intelligence and dynamic adaptability of defense decisions. Through the construction of a second training set and model training, the solution enables personalized customization of defense commands, ensuring highly targeted and effective defense measures.

[0137] In specific implementation, the above-mentioned device further includes a learning unit, a construction unit, and a second evaluation unit. The learning unit is used to perform a learning step after obtaining an evaluation result by using the corresponding evaluation system of the omnichannel system to conduct a risk assessment based on the type of the event. The learning step includes: using the machine learning system of the omnichannel system to learn the event and the corresponding evaluation result. The construction unit is used to perform a construction step, which includes: if the next event obtained does not belong to the APP event, the lightweight application event, or the traffic usage event, using the machine learning system of the omnichannel system to construct a new evaluation system of the omnichannel system. The new evaluation system is a system used to conduct a risk assessment on the next event obtained. The second evaluation unit is used to perform an evaluation step, which includes: using the new evaluation system of the omnichannel system to conduct a risk assessment on the next event obtained, and obtaining the evaluation result.

[0138] This solution employs a continuous learning mechanism to progressively optimize the accuracy of risk assessments and adapt to evolving attack patterns. By dynamically building new assessment systems, it continuously expands the coverage of security monitoring and enhances the ability to identify unknown threats. Through the application of these new assessment systems, the solution enables immediate response to unknown security threats, ensuring that the system's defensive capabilities keep pace with the development of attack techniques.

[0139] In some embodiments, the above-described apparatus further includes a determining unit and a third processing unit. The determining unit is used to perform a risk assessment using the corresponding evaluation system of the omnichannel system according to the type of the event, and after obtaining the evaluation result, to determine whether each of the events has a corresponding evaluation result using the linkage analysis system of the omnichannel system. The third processing unit is used to determine the events without evaluation results as omission events using the linkage analysis system of the omnichannel system when there are events without corresponding evaluation results, and to perform a risk assessment using the evaluation system of the omnichannel system corresponding to the omission events to obtain the evaluation result.

[0140] This solution ensures the completeness of risk assessments by verifying each event against the assessment results, preventing any potential security risks from slipping through the cracks. Through automatic supplementary assessments of missed events, this solution eliminates blind spots in the assessment process, ensuring that all security events are properly analyzed.

[0141] The aforementioned security protection device for terminal applications based on an omnichannel system includes a processor and a memory. The first acquisition unit, the first evaluation unit, and the protection unit are all stored as program units in the memory, and the processor executes these program units stored in the memory to achieve their respective functions. All of the above modules are located in the same processor; alternatively, the modules may be located in different processors in any combination.

[0142] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can address the fragmentation inherent in traditional application monitoring methods, which leads to lower security protection capabilities.

[0143] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0144] This invention provides a computer-readable storage medium that includes a stored program, wherein, when the program is executed, it controls the device containing the computer-readable storage medium to perform the security protection method for terminal applications based on an omnichannel system.

[0145] This invention provides a processor for running a program, wherein the program executes the security protection method for terminal applications based on an omnichannel system.

[0146] This invention provides a device including a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements at least the security protection method steps for terminal applications based on an omnichannel system. The device described herein can be a server, PC, PAD, mobile phone, etc.

[0147] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing a program that initializes a security protection method step for a terminal application based on at least an omnichannel system.

[0148] The present invention also provides an omnichannel system, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include a security protection method for executing any of the above-described omnichannel system-based terminal applications.

[0149] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0150] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0151] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0152] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0153] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0154] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0155] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0156] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0157] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0158] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0159] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A security protection method for a terminal application based on a full-channel system, characterized by, The method comprises: An event of terminal application is acquired by a data acquisition system of the full-channel system, wherein the event comprises one or more of an APP event, a light application event and a traffic usage event; Risk assessment is performed on the event by a corresponding evaluation system of the full-channel system according to the type of the event, and an evaluation result is obtained, wherein the evaluation system comprises one or more of an APP evaluation system, a light application evaluation system and a traffic evaluation system; In the case that the evaluation result represents that there is a risk, a defense instruction is generated by a linkage analysis system of the full-channel system according to the evaluation result, and the defense instruction is sent to a server used by a financial institution.

2. The method of claim 1, wherein, Before the risk assessment is performed on the event by the corresponding evaluation system of the full-channel system according to the type of the event, the method further comprises: An identification model is acquired by the data acquisition system of the full-channel system, wherein the identification model is one of a decision tree model, an SVM model and a CNN model; A historical event and a corresponding type label are grouped into a first training set by the data acquisition system of the full-channel system, and the identification model is trained by using the first training set, and a type identification model is obtained, wherein the type label is a historical type corresponding to the historical event of the first training set; The event is input into the type identification model by the data acquisition system of the full-channel system, and the type corresponding to the event is obtained.

3. The method of claim 1, wherein, The risk assessment is performed on the event by the corresponding evaluation system of the full-channel system according to the type of the event, and the evaluation result is obtained, comprising: In the case that the event is the APP event, it is determined by the APP evaluation system of the full-channel system whether the APP event has a first risk, and the evaluation result is obtained, wherein the first risk comprises one or more of a device usage risk, an application tampering risk, an APP running risk and a user operation abnormality risk; In the case that the event is the light application event, it is determined by the light application evaluation system of the full-channel system whether the light application event has a second risk, and the evaluation result is obtained, wherein the second risk comprises one or more of a browser risk, a container risk, a JS abnormality risk, an interface abuse risk, a phishing risk and a fraud risk; In the case that the event is the traffic usage event, it is determined by the traffic evaluation system of the full-channel system whether the traffic usage event has a third risk, and the evaluation result is obtained, wherein the third risk comprises one or more of a protocol abnormality risk, a Web attack risk, an input abnormality risk and a sensitive data risk.

4. The method of claim 3, wherein, After the risk assessment is performed on the event by the corresponding evaluation system of the full-channel system according to the type of the event, the method further comprises: In the case that there are multiple events, the event whose evaluation result represents that there is a risk is extracted by the linkage analysis system of the full-channel system, and a risk event is obtained. The linkage analysis system of the full-channel system extracts the generation time of all the risk events; The linkage analysis system of the full-channel system sorts the risk events according to the generation time from early to late, to obtain sorted risk events, so as to restore the attack chain.

5. The method of claim 4, wherein, The linkage analysis system of the full-channel system generates a defense instruction according to the evaluation result, including: The linkage analysis system of the full-channel system extracts all the sorted risk events, and determines a risk score according to the number of the sorted risk events, wherein the number of the sorted risk events and the risk score are in a positive correlation relationship; The linkage analysis system of the full-channel system groups the sorted risk events and the risk score into an event data set; The linkage analysis system of the full-channel system obtains a generation model, wherein the generation model is one of a GNN model, an RL model and a Bayesian model; The linkage analysis system of the full-channel system groups a historical event data set and a corresponding instruction label into a second training set, trains the generation model using the second training set, and obtains an instruction generation model, wherein the instruction label is a historical defense instruction corresponding to the historical event data set of the second training set; The linkage analysis system of the full-channel system inputs the event data set into the instruction generation model to obtain the defense instruction corresponding to the event data set.

6. The method according to any one of claims 1 to 5, characterized in that, After the evaluation system of the corresponding full-channel system is used to evaluate the risk according to the type of the event, the method further includes: Learning step: using the machine learning system of the full-channel system to learn the event and the corresponding evaluation result; Construction step: in the case that the next obtained event does not belong to the APP event, the light application event and the traffic usage event, using the machine learning system of the full-channel system to construct a new evaluation system of the full-channel system, wherein the new evaluation system is a system for evaluating the risk of the next obtained event; Evaluation step: using the new evaluation system of the full-channel system to evaluate the risk of the next obtained event to obtain the evaluation result.

7. The method according to any one of claims 1 to 5, characterized in that, After the evaluation system of the corresponding full-channel system is used to evaluate the risk according to the type of the event, the method further includes: Using the linkage analysis system of the full-channel system to determine whether each event has a corresponding evaluation result; In the case that the event does not have the corresponding evaluation result, using the linkage analysis system of the full-channel system to determine the event without the evaluation result as a missing event, and using the evaluation system of the full-channel system corresponding to the missing event to evaluate the risk to obtain the evaluation result.

8. A security device for a terminal application based on a full channel system, characterized by The device includes: A first obtaining unit is configured to obtain an event of a terminal application by using a data collection system of the full-channel system, wherein the event comprises one or more of an APP event, a light application event, and a traffic usage event; A first evaluation unit is configured to perform risk evaluation according to a type of the event by using a corresponding evaluation system of the full-channel system to obtain an evaluation result, wherein the evaluation system comprises one or more of an APP evaluation system, a light application evaluation system, and a traffic evaluation system; A protection unit is configured to, in a case where the evaluation result indicates that there is a risk, generate a defense instruction according to the evaluation result by using a linkage analysis system of the full-channel system, and send the defense instruction to a server used by a financial institution.

9. A computer program product comprising a computer program, characterized in that, The computer program, when executed by a processor, implements the steps of the security protection method for the terminal application based on the full-channel system according to any one of claims 1 to 7.

10. A full channel system characterized by, Comprise: One or more processors, memories, and one or more programs, wherein the one or more programs are stored in the memories and configured to be executed by the one or more processors, and the one or more programs comprise a program for executing the security protection method for the terminal application based on the full-channel system according to any one of claims 1 to 7.

Images