A mobile application data full life cycle security risk prediction method and system

Abstract

This invention relates to the field of security risk assessment technology, specifically a method and system for predicting security risks throughout the entire lifecycle of mobile application data. The method first acquires real-time mobile application data entities and flow information, constructing a dynamic data lineage graph containing the data flow status throughout the entire lifecycle, using data entities as nodes and data stage flow as directed edges. Then, based on the edges and corresponding nodes, it obtains the edge risk prediction value for a single stage, and distinguishes between high and medium risks according to the magnitude of the edge risk prediction value. When it is at high risk, the single-stage risk prediction result is directly output. When it is at medium risk, the features of the edge to be tested and the corresponding node are fused to obtain edge semantic fusion features, and combined with edge context features, it accurately identifies composite risks that may have been missed in a single stage, obtaining cross-stage risk prediction results, thus improving the accuracy and efficiency of security risk assessment throughout the entire lifecycle of mobile application data.

Description

Technical Field

[0001] This invention relates to the field of security risk assessment technology, specifically to a method and system for predicting security risks throughout the entire lifecycle of mobile application data. Background Technology

[0002] With the deepening of digital transformation, mobile applications have become the core data processing carriers in fields such as industrial control, financial services, and retail consumption. Data security is directly related to the safety of enterprise operations, the protection of user privacy, and even the stability of industrial supply chains. For example, the leakage of equipment operation data in industrial scenarios may lead to production interruptions, and the illegal dissemination of user payment information in the service industry will cause compliance risks. Therefore, mobile application data security testing has become a core guarantee requirement for the development of the digital economy.

[0003] Existing mobile application data security detection methods mostly adopt static rule matching mode, which cannot adapt to the dynamic flow of data entities. At the same time, existing security detection methods often focus on single-stage risk detection, such as only monitoring the permission configuration in the storage stage or the encryption status in the propagation stage, ignoring the compound risks that may be formed when data flows across stages, resulting in low comprehensiveness and accuracy of existing mobile application data security detection. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for predicting security risks throughout the entire lifecycle of mobile application data.

[0005] The technical solution of this invention is as follows:

[0006] A method for predicting security risks throughout the entire lifecycle of mobile application data includes the following operations:

[0007] S1. Real-time acquisition of data entities and data flow information in mobile applications, using data entities as nodes and data stage flow as directed edges between nodes to construct a dynamic data lineage graph; data stages include generation stage, processing stage, release stage, propagation stage, storage stage, and destruction stage;

[0008] S2. Based on the edge features in the dynamic data lineage graph, as well as the corresponding source node features and target node features, obtain the edge risk prediction value; if the edge risk prediction value is not less than the first risk threshold of the corresponding edge type, obtain the edge risk type, and form a single-stage risk prediction result with the corresponding edge risk prediction value; if the edge risk prediction value is between the second risk threshold and the first risk threshold of the corresponding edge type, take the corresponding edge as the edge to be tested, and execute S3.

[0009] S3. The source node features and target node features corresponding to the edge to be tested are respectively aggregated with neighbor information through a graph attention network. After attention processing, they are nonlinearly fused with the edge features of the edge to be tested to obtain the edge semantic fusion features. Starting from the edge to be tested, a random walk is performed along the corresponding meta-path to sample multiple context paths. The temporal structure dependency features are obtained and then aggregated to obtain the edge context features. Based on the edge semantic fusion features and edge context features, the cross-stage risk prediction value is obtained. If the cross-stage risk prediction value is greater than the cross-stage risk prediction threshold, the cross-stage risk type is obtained. Together with the corresponding cross-stage risk prediction value, the cross-stage security risk prediction result is formed.

[0010] In S1, node features are formed based on the basic attribute features, content features, semantic tag features, and historical behavior features of the corresponding data entity; edge features are formed by data stage type and flow timestamp.

[0011] In S2, the operation of obtaining the edge risk type can be achieved by concatenating the source node features, edge features, and target node features as the search key, and then performing risk type matching in a preset risk type library.

[0012] The method for obtaining context paths in S3 is as follows: match the edge to be tested with the meta-path template and instantiate it to obtain several meta-paths; jump from the edge to be tested according to several meta-paths until the jump termination condition is met, and then end the jump to obtain multiple context paths.

[0013] The method for obtaining edge context features in S3 is as follows: The node edge pairs of each context path are sorted in ascending order according to the flow timestamp of the edges in the context path to obtain multiple temporal sequences; each temporal sequence is processed by temporal convolution, graph convolution and global average pooling to obtain its own context path representation; all context path representations are weighted and aggregated to obtain edge context features.

[0014] In weighted aggregation, the weights of the context path representation are obtained by performing multilayer perceptron processing, sigmoid function processing, and normalization processing on the context path representation, the edge features of the edge to be tested in the path, the number of risk nodes in the path, and the number of cross-stages.

[0015] The method for obtaining cross-stage risk prediction values ​​in S3 is as follows: After projecting the edge semantic fusion features and edge context features onto the same dimension, layer normalization is performed separately to obtain edge semantic normalized features and edge context normalized features. The similarity matrix of the edge semantic normalized features and edge context normalized features is obtained. Based on the similarity matrix, the attention weights of the edge semantic normalized features and edge context normalized features are normalized, and then weighted with the semantic normalized features and edge context normalized features respectively to obtain edge semantic weighted features and edge context weighted features. After nonlinear interaction processing, the edge semantic weighted features and edge context weighted features are concatenated with the edge semantic weighted features and edge context weighted features to obtain the initial cross-stage fusion features. The initial cross-stage fusion features are residually connected with the edge semantic normalized features and edge context normalized features to obtain the cross-stage residual fusion features. The cross-stage residual fusion features are processed by a multilayer perceptron and a sigmoid function to obtain the cross-stage risk prediction value.

[0016] A security risk prediction system for the entire lifecycle of mobile application data, used to implement the aforementioned security risk prediction method for the entire lifecycle of mobile application data, includes:

[0017] The dynamic data lineage graph generation module is used to acquire data entities and data flow information in mobile applications in real time. It uses data entities as nodes and data stage flow as directed edges between nodes to construct a dynamic data lineage graph. The data stages include generation stage, disposal stage, release stage, propagation stage, storage stage, and destruction stage.

[0018] The single-stage risk prediction module is used to obtain the edge risk prediction value based on the edge features in the dynamic data lineage graph, as well as the corresponding source node features and target node features. If the edge risk prediction value is not less than the first risk threshold of the corresponding edge type, the edge risk type is obtained, and together with the corresponding edge risk prediction value, a single-stage risk prediction result is formed. If the edge risk prediction value is between the second risk threshold and the first risk threshold of the corresponding edge type, the corresponding edge is taken as the edge to be tested, and the cross-stage risk prediction module is executed.

[0019] The cross-stage risk prediction module uses the source node features and target node features corresponding to the edge to be tested. Neighbor information is aggregated through a graph attention network and combined with the edge features of the edge to be tested. After attention processing, a non-linear fusion process is performed to obtain the edge semantic fusion features. Starting from the edge to be tested, a random walk is performed along the corresponding meta-path to sample multiple context paths. Temporal structure dependency features are obtained from these paths and then aggregated to obtain the edge context features. Based on the edge semantic fusion features and edge context features, a cross-stage risk prediction value is obtained. If the cross-stage risk prediction value is greater than the cross-stage risk prediction threshold, the cross-stage risk type is obtained, and together with the corresponding cross-stage risk prediction value, a cross-stage security risk prediction result is formed.

[0020] A mobile application data lifecycle security risk prediction device includes a processor and a memory, wherein the processor executes a computer program stored in the memory to implement the aforementioned mobile application data lifecycle security risk prediction method.

[0021] A computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned method for predicting security risks throughout the entire lifecycle of mobile application data.

[0022] The beneficial effects of this invention are as follows:

[0023] This invention provides a method for predicting security risks throughout the entire lifecycle of mobile application data. First, by acquiring real-time mobile application data entities and flow information, a dynamic data lineage graph is constructed using data entities as nodes and data stage flow as directed edges. This graph fully covers the entire data lifecycle trajectory, providing a structured and traceable foundation for risk assessment. Then, based on the edges and their corresponding source and target nodes, the predicted edge risk value for a single stage is quickly obtained. Based on the magnitude of the predicted edge risk value, high and medium risks are distinguished. When the risk is high, the single-stage risk prediction result is directly output; when the risk is medium, the edge to be tested and its corresponding node are... By fusing edge semantic fusion features and combining them with edge context features obtained from random walk sampling based on meta-paths, cross-stage risk prediction results are obtained, accurately identifying composite risks that may be missed in a single stage and improving assessment accuracy. The entire method not only achieves quantitative assessment of mobile application security risks through quantitative prediction values, but also balances high accuracy (full lifecycle coverage and deep feature fusion), high efficiency (tiered processing to optimize resources), and fast response (real-time graph and rapid tiered judgment) in risk assessment by constructing a basic graph, quickly screening in a single stage, and conducting in-depth cross-stage analysis. This provides reliable and efficient support for the prevention and control of mobile application data security risks. Attached Figure Description

[0024] The solutions and advantages of this application will become clear to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of the invention.

[0025] In the attached diagram:

[0026] Figure 1 This is a flowchart illustrating the method of this embodiment. Detailed Implementation

[0027] Exemplary embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings.

[0028] Example 1

[0029] This embodiment provides a method for predicting security risks throughout the entire lifecycle of mobile application data. (See also...) Figure 1 This includes the following operations:

[0030] S1. Real-time acquisition of data entities and data flow information in mobile applications, using data entities as nodes and data stage flow as directed edges between nodes to construct a dynamic data lineage graph; data stages include generation stage, processing stage, release stage, propagation stage, storage stage, and destruction stage;

[0031] S2. Based on the edge features in the dynamic data lineage graph, as well as the corresponding source node features and target node features, obtain the edge risk prediction value; if the edge risk prediction value is not less than the first risk threshold of the corresponding edge type, obtain the edge risk type, and form a single-stage risk prediction result with the corresponding edge risk prediction value; if the edge risk prediction value is between the second risk threshold and the first risk threshold of the corresponding edge type, take the corresponding edge as the edge to be tested, and execute S3.

[0032] S3. The source node features and target node features corresponding to the edge to be tested are respectively aggregated with neighbor information through a graph attention network. After attention processing, they are nonlinearly fused with the edge features of the edge to be tested to obtain the edge semantic fusion features. Starting from the edge to be tested, a random walk is performed along the corresponding meta-path to sample multiple context paths. The temporal structure dependency features are obtained and then aggregated to obtain the edge context features. Based on the edge semantic fusion features and edge context features, the cross-stage risk prediction value is obtained. If the cross-stage risk prediction value is greater than the cross-stage risk prediction threshold, the cross-stage risk type is obtained. Together with the corresponding cross-stage risk prediction value, the cross-stage security risk prediction result is formed.

[0033] The specific operating steps are detailed below.

[0034] S1. Real-time acquisition of data entities and data flow information in mobile applications, using data entities as nodes and data stage flow as directed edges between nodes to construct a dynamic data lineage graph.

[0035] By acquiring data entities and data flow information in mobile applications in real time, and using data entities as nodes and data stage flow as directed edges between nodes, a dynamic data lineage graph can be constructed that clearly presents the data stage flow information throughout the entire lifecycle of mobile application data.

[0036] In a dynamic data lineage graph, nodes are the basic units, representing the state of data at different stages or the entities that carry the data (data entities). They are concrete instances of data at a specific stage of its lifecycle. Node types are categorized based on data objects (e.g., user notes, comments, assets, orders, images, user profiles, etc.), processing units (e.g., algorithm processing, a data transformation process), storage locations (e.g., local databases, cloud storage buckets, caches, etc.), user roles (e.g., ordinary users, administrators, third-party applications), devices and locations (e.g., mobile devices, servers, geographic locations), and policy rules (e.g., access control policies, data retention policies).

[0037] Taking mobile applications in the service industry as an example, node types include: content nodes (such as draft notes, published notes, and comments in mobile applications), user identity nodes (such as user identities with clear registration information and user profiles without clear registration information), transaction asset nodes (such as orders, payment vouchers, and preferential assets / coupons), and infrastructure nodes (algorithm strategies and storage locations).

[0038] In a dynamic data lineage graph, if an edge points from node A to node B, then node A is the source node and node B is the target node. Node features (including source node features and target node features) are formed by embedding the basic attribute features, content features, semantic label features, and historical behavior features of the nodes (corresponding data entities), followed by splicing and standardization.

[0039] The basic attributes of a node consist of node type, node ID, and node creation timestamp.

[0040] The content features of a node consist of its text content, image content, and structured data.

[0041] The semantic labeling features of a node consist of business dimension labels, sensitivity labels, and compliance labels. Taking mobile applications in the service industry as an example, business dimension labels include content community, e-commerce transactions, and social messaging; sensitivity labels include public, internal, confidential, PII, and payment information; and compliance labels include those subject to protection laws and those not subject to protection laws.

[0042] The behavior and historical characteristics of a node are determined by the node creator's historical behavior (such as the number of historical violations by the creator, reputation score, etc.), the node access pattern (such as the frequency of access, the time of the most recent access, the distribution of visitors, etc.), and the node's historical risk record (such as the number of times the node has been marked with historical risks and the corresponding risk level).

[0043] In a dynamic data lineage graph, data stage transitions are represented by directed edges between nodes, signifying the flow of data. Data stages include generation, disposal, publication, propagation, storage, and destruction. Edge features are formed by the data stage type and the transition timestamp. Specifically, the data stage type is encoded as a one-hot vector, and the transition timestamp is processed by minimum programming normalization before being concatenated to form the edge features.

[0044] S2. Based on the features of each edge in the dynamic data lineage graph, as well as the corresponding source node features and target node features, obtain the edge risk prediction value; if the edge risk prediction value is not less than the first risk threshold of the corresponding edge type, obtain the edge risk type, and form a single-stage risk prediction result with the corresponding edge risk prediction value; if the edge risk prediction value is between the second risk threshold and the first risk threshold of the corresponding edge type, execute S3.

[0045] Based on edge features and corresponding source node features and target node features, the edge risk prediction value for a single stage is quickly obtained. According to the magnitude of the edge risk prediction value, high risk and medium risk are distinguished. When it is high risk, the single-stage risk prediction result is directly output. When it is medium risk, the cross-stage security risk prediction of S3 is performed to ensure that no potential cross-stage risks are missed, thereby improving the flexibility and accuracy of security detection throughout the entire life cycle of mobile data.

[0046] First, a single-stage security risk detection is performed on each data stage (edge) in the dynamic data lineage graph. Taking any edge (data stage) as an example, the edge risk prediction value is obtained based on the edge features in the dynamic data lineage graph, as well as the corresponding source node features and target node features.

[0047] Specifically, the edge features, source node features, and target node features are weighted separately and then concatenated to obtain the edge fusion feature. This edge fusion feature is then processed by a trained risk prediction model (including but not limited to graph neural network models and multilayer perceptron models) to obtain the edge risk prediction value. During the weighting process, semantic label features in the source and target node features have the highest weight, while edge stages in the edge features have the highest weight, to highlight the contribution of key risk-related features such as sensitivity labels and data stage types.

[0048] The method for obtaining the training risk prediction model is as follows: using the risk labels of historical data flow as supervision signals, inputting a large number of edge fusion features into the risk prediction model, learning the mapping function, using the softmax function to convert the output value of the mapping function into a probability distribution, and taking the risk value corresponding to the highest probability as the edge risk prediction value.

[0049] Then, if the predicted edge risk value is not less than the first risk threshold of the corresponding edge type, it indicates that the security of the corresponding data stage is low. The edge risk type is then obtained, and the corresponding edge risk predicted value is used to form the edge risk prediction result, which serves as the risk prediction result for the corresponding single stage.

[0050] The operation to obtain the edge risk type is as follows: the source node feature, edge feature, and target node feature are concatenated and used as the search key to perform risk type matching in the preset risk type library.

[0051] If the predicted risk value of an edge is between the second risk threshold and the first risk threshold of the corresponding edge type (the second risk threshold is less than the first risk threshold), the security of the corresponding data stage is lower, but data security risks may still occur. In order to further conduct data security detection, the corresponding edge is taken as the edge to be tested, and cross-stage security risk detection in S3 is performed.

[0052] If the predicted risk value of an edge is not greater than the second risk threshold of the corresponding edge type, there is no single-stage risk.

[0053] S3. The source node features and target node features corresponding to the edge to be tested are respectively aggregated with neighbor information through a graph attention network. After attention processing, they are nonlinearly fused with the edge features of the edge to be tested to obtain the edge semantic fusion features. Starting from the edge to be tested, a random walk is performed along the corresponding meta-path to sample multiple context paths. The capture temporal and structural dependency features are obtained respectively and then aggregated to obtain the edge context features. Based on the edge semantic fusion features and edge context features, the cross-stage risk prediction value is obtained. If the cross-stage risk prediction value is greater than the cross-stage risk prediction threshold, the cross-stage risk type is obtained. Together with the corresponding cross-stage risk prediction value, the cross-stage security risk prediction result is formed.

[0054] The source node features and target node features corresponding to the edge to be tested are aggregated with neighbor information through a graph attention network, and then nonlinearly fused with attention features to obtain edge semantic fusion features. Combined with the edge context features aggregated after sampling the meta-path random walk and capturing temporal structure dependencies, the dual feature fusion obtains the cross-stage risk prediction value and threshold judgment output result. This not only strengthens the local semantic association between nodes and edges and the value of neighbor information, but also fully covers the global context of cross-stage flow. It can accurately identify composite risks and hidden flow vulnerabilities missed in single stages, improve the reliability of cross-stage risk prediction, and improve the accuracy of mobile data full life cycle security risk detection.

[0055] First, the source node features and target node features are respectively aggregated with neighbor information through a graph attention network. After attention processing, they are fused nonlinearly with the edge features to strengthen the semantic association between nodes and edges, capture the risk of direct interaction between nodes and edges, and obtain edge semantic fusion features.

[0056] Then, starting from the edge to be tested, a random walk is performed along the corresponding meta-path to sample and obtain the context path that covers the cross-stage flow, providing multiple context paths with flow trajectory, semantic association and temporal dependency for cross-stage risk prediction.

[0057] The steps to obtain the context path are as follows.

[0058] Step 1: Match the edge to be tested with the meta-path template and instantiate it to obtain several meta-paths. The meta-path templates include: cross-stage processing flow, cross-stage access flow, and multi-source convergence flow.

[0059] For ease of understanding, let's take an example: Cross-stage processing flow: Data object (generated) → Processing unit (disposal) → Data object (published) → Storage location (storage); Cross-stage access flow: User role (generated) → Data object (propagation) → Storage location (storage) → Policy rules (access control); Multi-source convergence flow: Data object A (generated) → Processing unit (disposal) → Data object C (storage), Data object B (generated) → Processing unit (disposal) → Data object C (storage).

[0060] If the data stage corresponding to the edge to be tested is the processing stage, and the source node and target node are data object D and processing unit E respectively, then the edge to be tested is matched with the cross-stage processing flow in the meta-path template, and the corresponding path is found (instantiated) in the dynamic data lineage graph to obtain the meta-path data object D → processing unit E → data object F → storage location G.

[0061] Step 2: According to several meta-paths, jump from the edge to be tested (processing unit) (for example, the meta-path is data object → processing unit → data object → storage location, and the next hop can only be a neighbor node of the data object type) until the jump end condition is met, and then end the jump to obtain multiple context paths.

[0062] The conditions for terminating a jump include: the length of a single path is within the preset length range (to ensure that path redundancy is avoided even when crossing stages), or the path has covered two or more data stages (for example, if the generation → disposal → publication conditions are met, the jump can be terminated in advance), or a destruction stage node or an isolated node (without a neighbor that matches the meta path) is encountered.

[0063] Next, after obtaining the temporal structure dependency features of each context path, they are aggregated to obtain their respective edge context features.

[0064] Specifically, the node-edge pairs of each context path are sorted in ascending order according to the flow timestamp of the edges in the context path to obtain multiple temporal sequences. Each temporal sequence is then processed by temporal convolution (formed by stacking two convolutional layers to capture the temporal dependency between adjacent steps), graph convolution, and global average pooling to capture temporal structural dependency features and obtain their respective context path representations. All context path representations are then weighted and aggregated to obtain edge context features.

[0065] In weighted aggregation, the weights of context paths are obtained by representing the context path, the edge features of the edges to be tested in the path, the number of high-risk nodes and the number of cross-stages in the path, and then processing them using a multilayer perceptron, a sigmoid function, and normalization. This adaptively highlights the contributions of high-risk, strongly correlated paths, suppresses interference from low-value paths, and the aggregated edge context features are more focused on core risk links, improving the accuracy of cross-stage risk prediction.

[0066] The formula for calculating the weight of a context path is as follows:

[0067] ,

[0068] ,

[0069] , The first k Weights of each context path, initial weights, , , The first k The context path representation of each context path, the edge features of the edge to be tested, and the path risk score (calculated from the number of high-risk nodes and the number of cross-stages in the path). , These are processed by a multilayer perceptron and by a sigmoid function, respectively.

[0070] In addition, risk nodes in the path are set based on the definition of sensitivity labels. For example, nodes with confidential labels in their sensitivity labels are designated as risk nodes.

[0071] Based on edge semantic fusion features and edge context features, cross-stage risk prediction values ​​are obtained. Edge semantic fusion features, which capture risks of direct node-edge interactions, are fused with edge context features, which acquire risks associated with multiple paths across stages. This achieves dual coverage of local details and a global panorama, enabling accurate identification of complex risks that cannot be detected in a single stage, such as "internal confidential data + third-party payment information → unencrypted cloud storage." Specific steps are detailed below.

[0072] Step 1: After projecting the edge semantic fusion features and edge context features onto the same dimension, perform layer normalization processing on each to obtain edge semantic normalized features and edge context normalized features.

[0073] Step 2: Obtain the similarity matrix of the edge semantic normalized features and the edge context normalized features. Based on the similarity matrix, normalize the attention weights of the edge semantic normalized features and the edge context normalized features (this can be achieved by multiplying the similarity matrix with their respective attention weights and then performing a softmax function). Then, weight the features with the semantic normalized features and the edge context normalized features respectively. This process ensures that the two types of features perceive each other's importance while avoiding information loss during the fusion process, resulting in edge semantic weighted features and edge context weighted features. After nonlinear interaction processing, the edge semantic weighted features and the edge context weighted features capture the composite risk features of local semantics and global context. These features are then concatenated with the edge semantic weighted features and the edge context weighted features to obtain the initial cross-stage fusion features. Finally, residual connections are made between the initial cross-stage fusion features and the edge semantic normalized features and the edge context normalized features to add initial shallow features, resulting in the cross-stage residual fusion features.

[0074] Step 3: The cross-stage residual fusion features are processed by a multilayer perceptron and a sigmoid function to obtain the cross-stage risk prediction value.

[0075] Finally, if the predicted cross-stage risk value is not greater than the cross-stage risk prediction threshold, there is no cross-stage risk; if the predicted cross-stage risk value is greater than the cross-stage risk prediction threshold, the cross-stage risk type is obtained, and together with the corresponding cross-stage risk prediction value, a cross-stage security risk prediction result is formed. The cross-stage risk type is obtained based on edge semantic fusion features and edge context features. The method of obtaining it is similar to the method of obtaining edge risk types in S2, and will not be repeated here to save space.

[0076] This embodiment also provides a security risk prediction system for the entire lifecycle of mobile application data, used to implement the above-mentioned security risk prediction method for the entire lifecycle of mobile application data, including:

[0077] The dynamic data lineage graph generation module is used to acquire data entities and data flow information in mobile applications in real time. It uses data entities as nodes and data stage flow as directed edges between nodes to construct a dynamic data lineage graph. The data stages include generation stage, disposal stage, release stage, propagation stage, storage stage, and destruction stage.

[0078] The single-stage risk prediction module is used to obtain the edge risk prediction value based on the edge features in the dynamic data lineage graph, as well as the corresponding source node features and target node features. If the edge risk prediction value is not less than the first risk threshold of the corresponding edge type, the edge risk type is obtained, and together with the corresponding edge risk prediction value, a single-stage risk prediction result is formed. If the edge risk prediction value is between the second risk threshold and the first risk threshold of the corresponding edge type, the corresponding edge is taken as the edge to be tested, and the cross-stage risk prediction module is executed.

[0079] The cross-stage risk prediction module uses the source node features and target node features corresponding to the edge to be tested. Neighbor information is aggregated through a graph attention network and combined with the edge features of the edge to be tested. After attention processing, a non-linear fusion process is performed to obtain the edge semantic fusion features. Starting from the edge to be tested, a random walk is performed along the corresponding meta-path to sample multiple context paths. Temporal structure dependency features are obtained from these paths and then aggregated to obtain the edge context features. Based on the edge semantic fusion features and edge context features, a cross-stage risk prediction value is obtained. If the cross-stage risk prediction value is greater than the cross-stage risk prediction threshold, the cross-stage risk type is obtained, and together with the corresponding cross-stage risk prediction value, a cross-stage security risk prediction result is formed.

[0080] This embodiment also provides a mobile application data full lifecycle security risk prediction device, including a processor and a memory, wherein the processor executes the computer program stored in the memory to implement the above-mentioned mobile application data full lifecycle security risk prediction method.

[0081] This embodiment also provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the above-mentioned method for predicting security risks throughout the entire lifecycle of mobile application data.

[0082] This embodiment provides a method for predicting security risks throughout the entire lifecycle of mobile application data. First, by acquiring real-time mobile application data entities and flow information, a dynamic data lineage graph is constructed using data entities as nodes and data stage flow as directed edges. This graph fully covers the entire data lifecycle trajectory, providing a structured and traceable foundation for risk assessment. Then, based on the edges and their corresponding source and target nodes, the predicted edge risk value for a single stage is quickly obtained. Based on the magnitude of the predicted edge risk value, high and medium risks are distinguished. When the risk is high, the single-stage risk prediction result is directly output; when the risk is medium, the edge to be tested and its corresponding node are further analyzed. By fusing edge semantic features and combining them with edge context features obtained from random walk sampling based on metapaths, cross-stage risk prediction results are obtained, accurately identifying composite risks that may be missed in a single stage and improving assessment accuracy. The entire method not only achieves quantitative assessment of mobile application security risks through quantitative prediction values, but also balances high accuracy (full lifecycle coverage and deep feature fusion), high efficiency (tiered processing to optimize resources), and fast response (real-time graph and rapid tiered judgment) in risk assessment by constructing a basic graph, quickly screening in a single stage, and conducting in-depth cross-stage analysis. This provides reliable and efficient support for the prevention and control of mobile application data security risks.

Claims

1. A method for predicting security risks throughout the entire lifecycle of mobile application data, characterized in that, This includes the following operations: S1. Real-time acquisition of data entities and data flow information in mobile applications, using data entities as nodes and data stage flow as directed edges between nodes to construct a dynamic data lineage graph; data stages include generation stage, processing stage, release stage, propagation stage, storage stage, and destruction stage; S2. Based on the edge features in the dynamic data lineage graph, as well as the corresponding source node features and target node features, the edge risk prediction value is obtained; If the predicted edge risk value is not less than the first risk threshold of the corresponding edge type, the edge risk type is obtained, and together with the corresponding edge risk predicted value, a single-stage risk prediction result is formed. If the predicted risk value of an edge is between the second risk threshold and the first risk threshold of the corresponding edge type, the corresponding edge will be taken as the edge to be tested, and S3 will be executed. S3. The source node features and target node features corresponding to the edge to be tested are respectively aggregated with neighbor information through a graph attention network, and then combined with the edge features of the edge to be tested through attention processing and nonlinear fusion processing to obtain the edge semantic fusion features. Starting from the edge to be tested, a random walk is performed along the corresponding meta-path to sample multiple context paths. After obtaining the temporal structure dependency features respectively, they are aggregated to obtain the edge context features. Based on edge semantic fusion features and edge context features, cross-stage risk prediction values ​​are obtained; Specifically, the edge semantic fusion features and edge context features are projected onto the same dimension, and then layer normalization is performed separately to obtain edge semantic normalized features and edge context normalized features. Obtain the similarity matrix of edge semantic normalized features and edge context normalized features. Based on the similarity matrix, normalize the attention weights of edge semantic normalized features and edge context normalized features, and then perform weighted processing with the semantic normalized features and edge context normalized features respectively to obtain edge semantic weighted features and edge context weighted features. The edge semantic weighted features and edge context weighted features are processed by nonlinear interaction and then concatenated with the edge semantic weighted features and edge context weighted features to obtain the initial cross-stage fusion features of the edge. The initial cross-stage fusion features of the edge are residually connected with the edge semantic normalized features and the edge context normalized features to obtain the cross-stage residual fusion features; The cross-stage residual fusion features are processed by a multilayer perceptron and a sigmoid function to obtain cross-stage risk prediction values; If the cross-stage risk prediction value is greater than the cross-stage risk prediction threshold, the cross-stage risk type is obtained, and together with the corresponding cross-stage risk prediction value, a cross-stage safety risk prediction result is formed.

2. The method for predicting security risks throughout the entire lifecycle of mobile application data according to claim 1, characterized in that, In S1, node features are formed based on the basic attribute features, content features, semantic tag features, and historical behavior features of the corresponding data entity; edge features are formed by the data stage type and the flow timestamp.

3. The method for predicting security risks throughout the entire lifecycle of mobile application data according to claim 1, characterized in that, In S2, the operation of obtaining the edge risk type can be achieved by concatenating the source node features, edge features, and target node features as the search key, and then performing risk type matching in the preset risk type library.

4. The method for predicting security risks throughout the entire lifecycle of mobile application data according to claim 1, characterized in that, In S3, the method for obtaining the context path is as follows: The edge to be tested is matched with the meta-path template and instantiated to obtain several meta-paths. According to the several meta-paths, the jump is performed from the edge to be tested until the jump termination condition is met, and then the jump ends, resulting in multiple context paths.

5. The method for predicting security risks throughout the entire lifecycle of mobile application data according to claim 1, characterized in that, In S3, the method for obtaining edge context features is as follows: Based on the flow timestamps of the edges in the context path, the node edge pairs of each context path are sorted in ascending order to obtain multiple temporal sequences. Each temporal sequence is then processed by temporal convolution, graph convolution, and global average pooling to obtain its own context path representation. All context path representations are then weighted and aggregated to obtain the edge context features.

6. The method for predicting security risks throughout the entire lifecycle of mobile application data according to claim 5, characterized in that, In weighted aggregation, the weights of the context path representation are obtained by performing multilayer perceptron processing, sigmoid function processing, and normalization processing on the context path representation, the edge features of the edge to be tested in the path, the number of risk nodes in the path, and the number of cross-stages.

7. A security risk prediction system for the entire lifecycle of mobile application data, used to implement the security risk prediction method for the entire lifecycle of mobile application data as described in claim 1, characterized in that, include: The dynamic data lineage graph generation module is used to acquire data entities and data flow information in mobile applications in real time. It uses data entities as nodes and data stage flow as directed edges between nodes to construct a dynamic data lineage graph. The data stages include generation stage, disposal stage, release stage, propagation stage, storage stage, and destruction stage. The single-stage risk prediction module is used to obtain edge risk prediction values ​​based on edge features in dynamic data lineage graphs, as well as the corresponding source node features and target node features. If the predicted edge risk value is not less than the first risk threshold of the corresponding edge type, the edge risk type is obtained, and together with the corresponding edge risk predicted value, a single-stage risk prediction result is formed. If the predicted risk value of an edge is between the second risk threshold and the first risk threshold of the corresponding edge type, the corresponding edge will be used as the edge to be tested, and the cross-stage risk prediction module will be executed. The cross-stage risk prediction module uses the source node features and target node features corresponding to the edge to be tested to aggregate neighbor information through a graph attention network. After attention processing, these features are then fused nonlinearly to obtain the edge semantic fusion features. Starting from the edge to be tested, a random walk is performed along the corresponding meta-path to sample multiple context paths. After obtaining the temporal structure dependency features respectively, they are aggregated to obtain the edge context features. Based on edge semantic fusion features and edge context features, cross-stage risk prediction values ​​are obtained; If the cross-stage risk prediction value is greater than the cross-stage risk prediction threshold, the cross-stage risk type is obtained, and together with the corresponding cross-stage risk prediction value, a cross-stage safety risk prediction result is formed.

8. A mobile application data full lifecycle security risk prediction device, characterized in that, It includes a processor and a memory, wherein the processor executes a computer program stored in the memory to implement the security risk prediction method for the entire lifecycle of mobile application data as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, Used to store a computer program, wherein the computer program, when executed by a processor, implements the method for predicting security risks throughout the entire lifecycle of mobile application data as described in any one of claims 1-6.

Images