Client compliance management method and device, terminal equipment and storage medium
By constructing a compliance knowledge graph and simulating a sandbox environment, the system dynamically detects client-side behavior, solving the problem of high false alarm rates in existing technologies and achieving efficient and accurate client-side compliance management and risk assessment.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-13
- Publication Date
- 2026-04-10
AI Technical Summary
Existing client-side compliance management methods suffer from high false alarm rates, are unable to effectively detect runtime permission abuse, and fail to distinguish between legitimate data collection and illegal privacy violations, resulting in low compliance quality.
By constructing a compliance knowledge graph, simulating client operation in a sandbox environment, acquiring operational behavior data and mapping it into the knowledge graph, dynamically detecting compliance, and combining it with risk assessment strategies, dynamic compliance mapping and risk assessment of the client can be achieved.
It improves the accuracy and efficiency of client-side compliance testing, reduces false alarm rates, enhances compliance quality, and enables risk assessment and control through compliance testing results.
Smart Images
Figure CN121834799A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of client compliance management, and more particularly to a client compliance management method, apparatus, terminal device, and storage medium. Background Technology
[0002] Currently, packages are typically distributed across multiple client platforms (Android, iOS, HarmonyOS, mini-games, Windows, etc.). Each client platform has its own corresponding compliance standards and may have security vulnerabilities, so the package body needs to be reviewed according to the compliance standards when distributing the package.
[0003] Existing technologies typically conduct compliance audits in the following ways: 1. Checklist-based checks: Manually verifying permission declarations and usage scenarios based on app store guidelines (such as Apple App Store Terms 4.2.3); 2. Offline analysis: Static string matching based on client binary files (such as detecting whether sensitive keywords are included).
[0004] However, existing technologies have the following problems: insufficient coverage of detection scenarios, inability to detect runtime permission abuse (such as silently obtaining location information in the background), and static scanning cannot distinguish between legitimate data collection (such as user device fingerprints and user profiles) and illegal privacy violations, resulting in a high false alarm rate and consequently low compliance quality. Summary of the Invention
[0005] The present invention aims to provide a client compliance management method, device, terminal equipment and storage medium, which can solve the problem of high false alarm rate in existing client compliance management methods, thereby improving the quality of client compliance detection and management.
[0006] The present invention provides a client compliance management method in a first aspect, the method comprising: responding to a user sending a compliance audit analysis instruction; dynamically mapping the client to be tested to compliance based on a preset sandbox environment and a preset compliance knowledge graph to obtain a compliance detection result; the compliance audit analysis instruction corresponding to the client to be tested; and performing a risk assessment on the client to be tested based on the compliance detection result and a preset risk scoring strategy to obtain a risk assessment result.
[0007] In one possible implementation, based on a preset sandbox environment and a preset compliance knowledge graph, dynamic compliance mapping is performed on the client to be tested to obtain compliance testing results. Specifically, this includes: controlling the client package to be tested to run in a preset sandbox environment based on the compliance audit analysis instructions, and mapping several obtained operational behavior data to a preset compliance knowledge graph to obtain target clauses corresponding to the operational behavior data; performing compliance assessment based on the target clauses and the corresponding operational behavior data to obtain compliance testing results corresponding to the operational behavior data.
[0008] In one possible implementation, the acquired operational behavior data is mapped to a preset compliance knowledge graph to obtain target clauses corresponding to the operational behavior data. Specifically, this includes: for each operational behavior data, searching for a target technology node corresponding to the operational behavior data in the preset compliance knowledge graph, retrieving the target regulatory node corresponding to the target technology node, and determining the target clause corresponding to the target regulatory node; wherein, the compliance knowledge graph includes: a number of technology nodes, a regulatory node corresponding to each technology node, and edges between every two nodes.
[0009] In one possible implementation, before dynamically mapping the client to be tested to compliance based on a preset sandbox environment and a preset compliance knowledge graph to obtain compliance testing results, the client compliance management method further includes: in response to receiving a compliance knowledge graph construction instruction sent by a user, acquiring multi-source regulatory clause data through a data acquisition method; the compliance knowledge graph construction instruction includes the data acquisition method and the graph subdivision domain; based on the graph subdivision domain, determining several target entity data in the multi-source regulatory clause data, and performing association parsing on every two target entity data to obtain the association data between every two target entity data; using target entity data whose entity type is clause content as regulatory nodes, target entities whose entity type is code behavior as technical nodes, and the remediation strategy after each technical node violation as a reference, and determining the edge between every two corresponding nodes based on the association data between every two target entity data, thereby constructing a compliance knowledge graph.
[0010] In one possible implementation, the compliance knowledge graph construction instruction further includes compliance granularity. The step of determining several target entity data based on the multi-source regulatory clause data includes: extracting the segmented text sequence corresponding to each regulatory clause statement in the multi-source regulatory clause data based on the graph's subdivision domain and natural language processing technology; performing entity recognition on each segmented text sequence to obtain initial entity data and word vectors corresponding to each regulatory clause statement; for every two regulatory clause statements, calculating cosine similarity based on the word vectors corresponding to the two regulatory clause statements to obtain the cosine similarity between the two regulatory clause statements; and merging the initial entity data of the two regulatory clause statements as target entity data when the cosine similarity is greater than a preset compliance granularity.
[0011] In one possible implementation, the compliance detection result includes: violation and compliance; the compliance assessment based on the target clause and the corresponding operational behavior data to obtain the compliance detection result corresponding to the operational behavior data includes: calculating the similarity value between the target clause and the operational behavior data; if the similarity value is greater than a preset similarity value threshold, then the compliance detection result of the current operational behavior data is determined to be a violation; otherwise, the compliance detection result of the current operational behavior data is determined to be compliant.
[0012] In one possible implementation, a risk assessment is performed on the client to be tested based on the compliance test results and a preset risk scoring strategy to obtain a risk assessment result. This includes: filtering operational behavior data that are found to be in violation of compliance test results, and identifying several violation behavior data accordingly; calculating a comprehensive risk score for the client package based on the risk score and weight coefficient of the target clause corresponding to each violation behavior data, and performing a weighted summation; and generating a risk assessment result for the client package based on the violation behavior data and the comprehensive risk score.
[0013] In one possible implementation, controlling the client package under test to run in a preset sandbox environment includes: controlling the client package under test to run simultaneously in several sandbox scenarios; for each sandbox scenario, when the client package under test is running, inputting preset adversarial operation simulation data, and collecting one or more of the interface call sequence, network behavior, and memory behavior of the client package under test based on the adversarial operation simulation data as runtime behavior data.
[0014] In one possible implementation, after obtaining the risk assessment result of the client packet to be tested, the method further includes: judging the comprehensive risk score; if the comprehensive risk score is greater than or equal to a first risk threshold, then enabling deep behavioral analysis and restricting network access; if the comprehensive risk score is greater than or equal to a second risk threshold and less than the first risk threshold, then increasing the logging frequency and maintaining baseline monitoring.
[0015] In a second aspect, the present invention provides a client-side compliance management device, comprising a compliance detection module and a risk assessment module, wherein the compliance detection module and the risk assessment module are communicatively connected; the compliance detection module is configured to respond to a user sending a compliance audit analysis command, and dynamically map the client to be tested to compliance based on a preset sandbox environment and a preset compliance knowledge graph, thereby obtaining a compliance detection result; the compliance audit analysis command corresponds to the client to be tested; the risk assessment module is configured to perform a risk assessment on the client to be tested based on the compliance detection result and a preset risk scoring strategy, thereby obtaining a risk assessment result.
[0016] In one possible implementation, the compliance detection module is further configured to: control the client package to be tested to run in a preset sandbox environment based on the compliance audit analysis instruction, and map the obtained operational behavior data to a preset compliance knowledge graph to obtain target clauses corresponding to the operational behavior data; perform compliance assessment based on the target clauses and the corresponding operational behavior data to obtain compliance detection results corresponding to the operational behavior data.
[0017] In one possible implementation, the compliance detection module is further configured to: for each operational behavior data, search for the target technical node corresponding to the operational behavior data in a preset compliance knowledge graph, retrieve the target regulatory node corresponding to the target technical node, and determine the target clause corresponding to the target regulatory node; wherein, the compliance knowledge graph includes: several technical nodes, a regulatory node corresponding to each technical node, and an edge between every two nodes.
[0018] In one possible implementation, the client-side compliance management device further includes a knowledge graph construction module, which is configured to: in response to receiving a compliance knowledge graph construction instruction sent by a user, acquire multi-source regulatory clause data through a data acquisition method; the compliance knowledge graph construction instruction includes the data acquisition method and a graph subdivision domain; based on the graph subdivision domain, determine several target entity data in the multi-source regulatory clause data, and perform correlation parsing on every two target entity data to obtain the correlation data between every two target entity data; use target entity data whose entity type is clause content as regulatory nodes, target entities whose entity type is code behavior as technical nodes, and use the remediation strategy after each technical node violates the rules as a reference; and determine the edge between every two corresponding nodes based on the correlation data between every two target entity data, thereby constructing a compliance knowledge graph.
[0019] In one possible implementation, the knowledge graph construction module is further configured to: extract the segmented text sequence corresponding to each legal clause statement in the multi-source legal clause data based on the graph subdivision domain and natural language processing technology; perform entity recognition on each segmented text sequence to obtain the initial entity data and word vectors corresponding to each legal clause statement; for every two legal clause statements, calculate the cosine similarity based on the word vectors corresponding to the two legal clause statements to obtain the cosine similarity between the two legal clause statements; and when the cosine similarity is greater than a preset compliance refinement, merge the initial entity data of the two legal clause statements as the target entity data.
[0020] In one possible implementation, the compliance detection module is further configured to: calculate the similarity value between the target clause and the operational behavior data; if the similarity value is greater than a preset similarity value threshold, then determine that the compliance detection result of the current operational behavior data is a violation; otherwise, determine that the compliance detection result of the current operational behavior data is compliant.
[0021] In one possible implementation, the risk assessment module is used to: screen operational behavior data whose compliance detection results are in violation, and determine a number of violation behavior data accordingly; perform weighted summation based on the risk score and weight coefficient of the target clause corresponding to each violation behavior data to calculate the comprehensive risk score of the client package to be tested; and generate the risk assessment result of the client package to be tested based on the violation behavior data and the comprehensive risk score.
[0022] In one possible implementation, the compliance detection module is further configured to: control the client package under test to run simultaneously in several sandbox scenarios; for each sandbox scenario, when the client package under test is running, input preset adversarial operation simulation data, and collect the interface call sequence, network behavior, and memory behavior of the client package under test based on the adversarial operation simulation data.
[0023] In one possible implementation, the client compliance management device further includes a risk control module, which is communicatively connected to the risk assessment module. The risk control module is used to: determine the comprehensive risk score; if the comprehensive risk score is greater than or equal to a first risk threshold, enable deep behavioral analysis and restrict network access; if the comprehensive risk score is greater than or equal to a second risk threshold and less than the first risk threshold, increase the log recording frequency and maintain baseline monitoring.
[0024] In a third aspect, the present invention provides a terminal device comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the client compliance management method as described above.
[0025] In a fourth aspect, the present invention provides a computer-readable storage medium comprising: a stored computer program, wherein, when the computer program is executed, it controls the device in which the computer-readable storage medium is located to perform the client compliance management method as described above.
[0026] The following benefits can be obtained by implementing the present invention: This invention discloses a client-side compliance management method, apparatus, terminal device, and storage medium. By pre-constructing a knowledge graph based on compliance requirements, a sandbox simulation is used during compliance testing to provide a runtime environment for the client, acquiring runtime behavior data. This runtime behavior data is mapped onto the knowledge graph to match corresponding technical nodes, determine target clauses, and dynamically perform compliance testing on the specific code behavior corresponding to the runtime behavior data based on the target clauses. This client-side compliance management method, apparatus, terminal device, and storage medium achieve high efficiency and accuracy in client-side compliance testing, reducing the false positive rate. Furthermore, the method, apparatus, terminal device, and storage medium also conduct risk assessments based on the compliance testing results and implement corresponding compliance controls, thereby further improving compliance quality. Attached Figure Description
[0027] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0028] Figure 1 This is a flowchart illustrating a client compliance management method according to an embodiment of the present invention; Figure 2This is a schematic diagram of the structure of a client compliance management device provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a client compliance management device provided in another embodiment of the present invention. Detailed Implementation
[0029] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0030] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.
[0031] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.
[0032] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.
[0033] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.
[0034] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).
[0035] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.
[0036] See Figure 1 An embodiment of the present invention provides a client compliance management method, comprising: Step S101: In response to the user's sending of a compliance audit analysis instruction, based on the preset sandbox environment and the preset compliance knowledge graph, perform dynamic compliance mapping on the client to be tested to obtain the compliance test results.
[0037] In this step, the compliance audit analysis instruction corresponds to the client to be tested and is used to indicate the package name of the client to be tested. In a specific embodiment, the compliance audit analysis instruction includes information for performing automatic compliance audit analysis.
[0038] Understandably, after receiving the compliance audit analysis instruction issued by the user, this embodiment first uses the preset sandbox environment of the corresponding client to detect the running behavior, and maps the detected running behavior data to the technical nodes of the compliance knowledge graph, finds the associated regulatory nodes, determines the corresponding target clause, and then performs a risk assessment on the specific code behavior corresponding to the running data behavior based on the target clause to obtain the risk assessment result.
[0039] In this embodiment, the preset sandbox environment includes several sandbox scenarios, including but not limited to application sandboxes, container sandboxes, and virtual machine sandboxes; the runtime behavior data includes: interface call sequences, network behavior, and memory behavior. Controlling the client package under test to run in the preset sandbox environment can obtain several runtime behavior data of the client package under test, and the runtime behavior data can reflect the behavior of the client package under test in the corresponding environment simulated by the sandbox, thereby providing data support for dynamic behavior compliance detection.
[0040] In one embodiment, controlling the client package under test to run in a preset sandbox environment to obtain runtime behavior data includes: controlling the client package under test to run simultaneously in several sandbox scenarios; for each sandbox scenario, when the client package under test is running, inputting preset adversarial operation simulation data, and collecting the interface call sequence, network behavior, and memory behavior of the client package under test based on the adversarial operation simulation data.
[0041] It should be noted that in practical applications of the sandbox environment, corresponding sandbox scenarios need to be built for different platforms. For example, HarmonyOS devices need to simulate multi-device collaboration (e.g., detecting permission violations during Bluetooth file transfer) to build a sandbox scenario (virtual machine sandbox); while iOS devices need to build a sandbox scenario based on re-signature detection and dynamic library injection monitoring (combined to determine whether it is a cracked application). Therefore, the runtime sandbox environment adopts a multi-layered isolation architecture (application sandbox), adapted to the characteristics of different platforms, as detailed in Table 1: Table 1 Sandbox Scene Technical Implementation Supported Platforms Application Sandbox System API Hook (such as Cydia-Substrate in iOS) iOS / Android Container Sandbox Landrun / Docker containers Windows / Linux Virtual machine sandbox QEMU / KVM Full Virtualization HarmonyOS Multi-Device Testing In the sandbox scenario, the core components include a behavior monitoring engine, an environment simulation module, and a dynamic analyzer. The behavior monitoring engine intercepts system-level calls (such as file read / write, network access, and permission calls). The environment simulation module designs adversarial operation simulation data, such as sensor data, geographical location, and device information, to counter sandbox detection. The dynamic analyzer records API call sequences, network behavior, memory behavior, etc. Through the sandbox scenario, the aforementioned behaviors of the client under test can be recorded when running in its simulated environment, thus serving as the data basis for subsequent evaluation of the compliance of dynamic behaviors.
[0042] Based on the above sandbox structure, the behavior analysis within the sandbox adopts a multi-dimensional dynamic monitoring approach, including: API call sequence tracing, network behavior analysis, memory behavior monitoring, and multi-device collaborative monitoring (for HarmonyOS).
[0043] In one specific embodiment, when an Android permission call is detected, the call stack is recorded and the risk is assessed based on the context.
[0044] In one specific embodiment, network behavior analysis includes: monitoring the transmission of sensitive data (e.g., HTTP-based transmission of contact information) over unencrypted channels and detecting communication with known malicious addresses (in conjunction with a threat intelligence feed).
[0045] In one specific embodiment, memory behavior monitoring includes detecting runtime code injection (e.g., dynamically loading dex files) and analyzing the processing of sensitive data in memory (e.g., caching plaintext credit card information).
[0046] In one specific embodiment, the acquisition of adversarial operation simulation data includes: 1. Simulating a real environment: injecting real user behavior patterns (e.g., random mouse movements, touch events); simulating device sensor data (e.g., gyroscope signals); 2. Setting up delayed execution traps: detecting time-accelerated attempts and marking them as suspicious behaviors; 3. Parallel execution comparison of multiple sandboxes: running virtualization-based and container-based sandboxes simultaneously in the same environment, comparing behavioral differences, and identifying evasion behaviors.
[0047] In one specific embodiment, the acquired operational behavior data is mapped to a preset compliance knowledge graph to obtain target clauses corresponding to the operational behavior data. Specifically, this includes: for each operational behavior data, searching for a target technology node corresponding to the operational behavior data in the preset compliance knowledge graph, retrieving the target regulatory node corresponding to the target technology node, and determining the target clause corresponding to the target regulatory node; wherein, the compliance knowledge graph includes: a number of technology nodes, a regulatory node corresponding to each technology node, and an edge between every two nodes.
[0048] In one specific embodiment, the regulatory node is used to represent regulatory clauses, corresponding risk scores, and weighting coefficients, while the technical node is used to represent the permission types and code behaviors of runtime behavior data.
[0049] In one possible implementation, before dynamically mapping the client to be tested to compliance based on a preset sandbox environment and a preset compliance knowledge graph to obtain compliance testing results, the client compliance management method further includes: in response to receiving a compliance knowledge graph construction instruction sent by a user, acquiring multi-source regulatory clause data through a data acquisition method; the compliance knowledge graph construction instruction includes the data acquisition method and the graph subdivision domain; based on the graph subdivision domain, determining several target entity data in the multi-source regulatory clause data, and performing association parsing on every two target entity data to obtain the association data between every two target entity data; using target entity data whose entity type is clause content as regulatory nodes, target entities whose entity type is code behavior as technical nodes, and the remediation strategy after each technical node violation as a reference, and determining the edge between every two corresponding nodes based on the association data between every two target entity data, thereby constructing a compliance knowledge graph.
[0050] In one specific embodiment, the data acquisition method for multi-source regulatory clauses is: parsing and obtaining data from channels such as application market review guidelines (e.g., Apple App Store, Google Play Policy), privacy regulations (e.g., GDPR, CCPA), and permission usage guidelines (e.g., Android Permissions Guidelines).
[0051] In one specific embodiment, the compliance knowledge graph construction instruction further includes compliance granularity. The step of determining several target entity data based on the multi-source regulatory clause data includes: extracting the segmented text sequence corresponding to each regulatory clause statement in the multi-source regulatory clause data based on the graph's subdivision domain and natural language processing technology; performing entity recognition on each segmented text sequence to obtain initial entity data and word vectors corresponding to each regulatory clause statement; for every two regulatory clause statements, calculating cosine similarity based on the word vectors corresponding to the two regulatory clause statements to obtain the cosine similarity between the two regulatory clause statements; and merging the initial entity data of the two regulatory clause statements as target entity data when the cosine similarity is greater than a preset compliance granularity.
[0052] In one specific embodiment, natural language processing (NLP) techniques are used to segment the text corresponding to each clause in the multi-source regulatory data, remove stop words, and perform dependency parsing to obtain a segmented text sequence. For example, the clause "Applications must explicitly inform users and obtain their consent before accessing the camera" is parsed as: Action subject: Application; Action: Access the camera; Constraints: Inform the user and obtain their consent; Timing: Notification must be completed before access.
[0053] The segmented text sequence is: application, access camera, inform user and obtain consent, notification must be completed before access.
[0054] In one specific embodiment, key entities (such as permission types, API calls, user data, etc.) are first extracted using a preset model (such as BERT+BiLSTM+CRF model). For example, fields such as "entity", "type", and "attribute" are first identified from multi-source regulatory clause data. Then, relationship extraction is performed, that is, the association between entities is established using rule-based and deep learning methods.
[0055] It should be noted that using the cosine similarity algorithm, merging regulatory clauses from different sources (e.g., aligning Apple 5.1.5 with Google Play Policy 9.3), and the similarity threshold (compliance accuracy) can be 85%.
[0056] In one specific embodiment, the structural design of the knowledge graph includes ontology structure design, node type design, and edge relationship type design.
[0057] The solution's ontology structure consists of four layers: a regulatory layer, an application layer, a detection layer, and an association layer. The regulatory layer includes laws and regulations, application market terms, and permission specifications. The application layer includes permission declarations, API calls, and data operations. The detection layer includes static scanning rules, dynamic behavior monitoring, and environmental context. The association layer includes violation patterns, risk propagation paths, and remediation suggestions.
[0058] This solution's node design includes three types of nodes: regulatory nodes, technical nodes, and related nodes. Regulatory nodes contain attributes such as clause number, scope of application, and effective date. Technical nodes contain specific elements in the corresponding code (such as API calls and permission declarations). Related nodes define violation patterns and risk propagation paths.
[0059] This solution has three types of edge relationships in its node design: requires indicates preconditions (e.g., LOCATION permission must be declared to access a location); triggers indicates triggering relationships (e.g., API calls without declared permissions trigger violations); and conflicts indicates conflicting relationships (e.g., background location access conflicts with the principle of minimizing data collection).
[0060] In one specific embodiment, the compliance detection result includes: violation and compliance; the compliance assessment based on the target clause and the corresponding operational behavior data to obtain the compliance detection result corresponding to the operational behavior data includes: calculating the similarity value between the target clause and the operational behavior data; if the similarity value is greater than a preset similarity value threshold, then the compliance detection result of the current operational behavior data is determined to be a violation; otherwise, the compliance detection result of the current operational behavior data is determined to be compliant.
[0061] Step S 102: Based on the compliance test results and the preset risk scoring strategy, perform a risk assessment on the client to be tested and obtain the risk assessment results.
[0062] In one specific embodiment, a risk assessment is performed on the client to be tested based on the compliance test results and a preset risk scoring strategy to obtain a risk assessment result. This includes: filtering operational behavior data that are found to be in violation of compliance test results, and identifying several violation behavior data accordingly; calculating a comprehensive risk score for the client package based on the risk score and weight coefficient of the target clause corresponding to each violation behavior data, and performing a weighted summation; and generating a risk assessment result for the client package based on the violation behavior data and the comprehensive risk score.
[0063] In one specific embodiment, after obtaining the risk assessment result of the client packet to be tested, the method further includes: judging the comprehensive risk score; if the comprehensive risk score is greater than or equal to a first risk threshold, then enabling deep behavioral analysis and restricting network access; if the comprehensive risk score is greater than or equal to a second risk threshold and less than the first risk threshold, then increasing the log recording frequency and maintaining baseline monitoring.
[0064] In one specific embodiment, the comprehensive risk score is calculated by weighted summation based on the risk score and weight coefficient of each violation data point.
[0065] In a specific implementation example scenario: Apple's terms of service require "explicit user consent before the collection of Advertising Identifier (IDFA)" → graph association advertisingIdentifier call point → sandbox verification pop-up appearance rate → no pop-up indicates violation.
[0066] In addition to the steps outlined above, the implementation of this solution in practical applications relies on the establishment of a real-time association engine. To further clarify this, the following example, though not exhaustive, illustrates the workflow of the real-time association engine after establishing a dynamic association mechanism between the knowledge graph and runtime behavior analysis: Step 1: Extraction of behavioral patterns: Extract features such as API call sequences, data flows, and permission operations from sandbox monitoring data.
[0067] Step 2: Knowledge Graph Mapping: Map behavioral features to technical nodes in the knowledge graph and find related regulatory nodes. The specific code is as follows: Step 3: Risk Quantitative Assessment: Calculate risk scores based on graph structure and behavioral context; Step 4: Implement dynamic feedback: Adjust the sandbox monitoring strategy in real time based on the risk score; To further describe the scheme, a typical rule example is given here, see Table 2: Table 2 runtime behavior data Risk Score Accessing the camera without declaring permissions High risk (90 / 100) The background continuously collects location information. Medium risk (65 / 100) Encrypted user data before being transmitted Low risk (30 / 100) In one specific embodiment, this embodiment also employs machine learning to achieve continuous optimization through the mining of regulatory clause data and automatic rule generation; wherein, the mining of regulatory clause data refers to the use of frequent subgraph mining algorithms to discover new regulatory clause data, and automatic rule generation refers to the transformation of newly discovered regulatory clause data into graph rules.
[0068] like Figure 2 As shown, based on the above method embodiments, corresponding apparatus embodiments are provided; The client-side compliance management device includes a compliance detection module 101 and a risk assessment module 102, which are communicatively connected.
[0069] The compliance detection module 101 is used to respond to the user's sent compliance audit analysis command, and to perform dynamic compliance mapping on the client to be tested according to the preset sandbox environment and the preset compliance knowledge graph to obtain the compliance detection result; the compliance audit analysis command corresponds to the client to be tested.
[0070] The risk assessment module 102 is used to perform a risk assessment on the client to be tested based on the compliance test results and a preset risk scoring strategy, and obtain a risk assessment result.
[0071] In one possible implementation, the compliance detection module 101 is further configured to: control the client package to be tested to run in a preset sandbox environment based on the compliance audit analysis instruction, and map the obtained several operational behavior data to a preset compliance knowledge graph to obtain target clauses corresponding to the operational behavior data; perform compliance assessment based on the target clauses and the corresponding operational behavior data to obtain compliance detection results corresponding to the operational behavior data.
[0072] In one possible implementation, the compliance detection module 101 is further configured to: for each operational behavior data, search for the target technical node corresponding to the operational behavior data in a preset compliance knowledge graph, retrieve the target regulatory node corresponding to the target technical node, and determine the target clause corresponding to the target regulatory node; wherein, the compliance knowledge graph includes: several technical nodes, a regulatory node corresponding to each technical node, and an edge between every two nodes.
[0073] In one possible implementation, the compliance detection module 101 is further configured to: calculate the similarity value between the target clause and the operational behavior data; if the similarity value is greater than a preset similarity value threshold, then determine that the compliance detection result of the current operational behavior data is a violation; otherwise, determine that the compliance detection result of the current operational behavior data is compliant.
[0074] In one possible implementation, the compliance detection module 101 is further configured to: control the client package under test to run simultaneously in several sandbox scenarios; for each sandbox scenario, when the client package under test is running, input preset adversarial operation simulation data, and collect the interface call sequence, network behavior and memory behavior of the client package under test based on the adversarial operation simulation data.
[0075] In one possible implementation, the risk assessment module 102 is further configured to: screen operational behavior data whose compliance detection results are violations, and determine a number of violation behavior data accordingly; perform weighted summation based on the risk score and weight coefficient of the target clause corresponding to each violation behavior data, and calculate the comprehensive risk score of the client package to be tested; and generate the risk assessment result of the client package to be tested based on the violation behavior data and the comprehensive risk score.
[0076] In one possible implementation, the client-side compliance management device further includes a knowledge graph construction module. This module is configured to: in response to receiving a compliance knowledge graph construction instruction from a user, acquire multi-source regulatory clause data through a data acquisition method; the compliance knowledge graph construction instruction includes the data acquisition method and a graph subdivision domain; based on the graph subdivision domain, determine several target entity data in the multi-source regulatory clause data, and perform correlation parsing on every two target entity data to obtain the correlation data between each pair of target entity data; designate target entity data whose entity type is clause content as regulatory nodes, target entities whose entity type is code behavior as technical nodes, and the remediation strategy after a violation of each technical node as a reference; and determine the edge between each pair of corresponding nodes based on the correlation data between each pair of target entity data, thereby constructing a compliance knowledge graph.
[0077] In one possible implementation, the knowledge graph construction module is further configured to: extract the segmented text sequence corresponding to each legal clause statement in the multi-source legal clause data based on the graph subdivision domain and natural language processing technology; perform entity recognition on each segmented text sequence to obtain the initial entity data and word vectors corresponding to each legal clause statement; for every two legal clause statements, calculate the cosine similarity based on the word vectors corresponding to the two legal clause statements to obtain the cosine similarity between the two legal clause statements; and when the cosine similarity is greater than a preset compliance refinement, merge the initial entity data of the two legal clause statements as the target entity data.
[0078] refer to Figure 3 In one possible implementation, the client compliance management device further includes a risk control module 104, which is communicatively connected to the risk assessment module 102. The risk control module 104 is used to: judge the comprehensive risk score; if the comprehensive risk score is greater than or equal to a first risk threshold, enable deep behavioral analysis and restrict network access; if the comprehensive risk score is greater than or equal to a second risk threshold and less than the first risk threshold, increase the log recording frequency and maintain baseline monitoring.
[0079] It is understood that the above-described device embodiments correspond to the method embodiments of the present invention, and can implement the client compliance management method provided by any of the above-described method embodiments of the present invention.
[0080] It should be noted that the device embodiments described above are merely illustrative, and some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can specifically be implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.
[0081] Based on the above embodiments of the client compliance management method, another embodiment of the present invention provides a terminal device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the client compliance management method of any embodiment of the present invention.
[0082] For example, in this embodiment, the computer program can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the terminal device.
[0083] The terminal device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.
[0084] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting all parts of the terminal device via various interfaces and lines.
[0085] Based on the above-described method embodiments, another embodiment of the present invention provides a computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the client compliance management method described in any of the above-described method embodiments of the present invention.
[0086] The modules / units integrated in the device / terminal equipment, if implemented as software functional units and sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.
[0087] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.
Claims
1. A client-side compliance management method, characterized in that, The compliance management methods include: In response to a user sending a compliance audit analysis command, the system dynamically maps the client to be tested to compliance based on a preset sandbox environment and a preset compliance knowledge graph, thereby obtaining compliance detection results; the compliance audit analysis command corresponds to the client to be tested. Based on the compliance test results and the preset risk scoring strategy, a risk assessment is performed on the client to be tested to obtain the risk assessment result.
2. The client compliance management method as described in claim 1, characterized in that, Based on a pre-defined sandbox environment and a pre-defined compliance knowledge graph, dynamic compliance mapping is performed on the client to be tested to obtain compliance testing results, specifically including: Based on the compliance audit analysis instructions, the client package to be tested is controlled to run in a preset sandbox environment, and the obtained operational behavior data is mapped to a preset compliance knowledge graph to obtain the target clauses corresponding to the operational behavior data. A compliance assessment is conducted based on the target terms and the corresponding operational behavior data to obtain compliance detection results corresponding to the operational behavior data.
3. The client compliance management method as described in claim 2, characterized in that, The acquired operational behavior data is mapped to a pre-defined compliance knowledge graph to obtain target clauses corresponding to the operational behavior data, specifically including: For each piece of operational behavior data, in a pre-defined compliance knowledge graph, the target technical node corresponding to the operational behavior data is searched, the target regulatory node corresponding to the target technical node is retrieved, and the target clause corresponding to the target regulatory node is determined; wherein, the compliance knowledge graph includes: several technical nodes, the regulatory node corresponding to each technical node, and the edge between every two nodes.
4. The client compliance management method as described in claim 1, characterized in that, Before performing dynamic compliance mapping on the client to be tested based on a preset sandbox environment and a preset compliance knowledge graph to obtain compliance testing results, the client compliance management method further includes: In response to receiving a compliance knowledge graph construction instruction from a user, the system acquires multi-source regulatory clause data through data acquisition channels; the compliance knowledge graph construction instruction includes the data acquisition channels and the graph sub-domains. Based on the subdivided domains of the map, several target entity data are identified in the multi-source regulatory clause data, and the correlation analysis is performed on every two target entity data to obtain the correlation data between every two target entity data. The target entity data with the entity type of clause content is used as the regulatory node, the target entity with the entity type of code behavior is used as the technical node, the remediation strategy after each technical node is violated is used as the edge between each pair of corresponding nodes based on the correlation data between each pair of target entity data, and then the compliance knowledge graph is constructed.
5. The client compliance management method as described in claim 4, characterized in that, The compliance knowledge graph construction instructions also include compliance granularity, wherein the determination of several target entity data based on the multi-source regulatory clause data includes: Based on the aforementioned graph subdivision domain and natural language processing technology, the word segmentation text sequence corresponding to each legal clause statement in the multi-source legal clause data is extracted; Entity recognition is performed on each segmented text sequence to obtain the initial entity data and word vectors corresponding to each legal clause statement; For every two legal clauses, cosine similarity is calculated based on the word vectors corresponding to the two legal clauses to obtain the cosine similarity between the two legal clauses. When the cosine similarity is greater than the preset compliance granularity, the initial entity data of the two legal clauses are merged as the target entity data.
6. The client compliance management method as described in claim 3, characterized in that, The compliance detection results include: violations and compliance; the compliance assessment based on the target terms and corresponding operational behavior data, to obtain compliance detection results corresponding to the operational behavior data, includes: Calculate the similarity value between the target clause and the operational behavior data; If the similarity value is greater than the preset similarity value threshold, the compliance detection result of the current running behavior data is determined to be a violation; Otherwise, the compliance test result of the current operational behavior data is determined to be compliant.
7. The client compliance management method as described in claim 5, characterized in that, Based on the compliance testing results and the preset risk scoring strategy, a risk assessment is performed on the client to be tested to obtain the risk assessment results, including: Screen operational behavior data that are found to be non-compliant in compliance testing, and identify a number of non-compliant behavior data accordingly; Based on the risk score and weight coefficient of the target clause corresponding to each violation data, a weighted sum is performed to calculate the comprehensive risk score of the client package under test; Based on the violation data and comprehensive risk score, a risk assessment result is generated for the client package to be tested.
8. A client-side compliance management device, characterized in that, The client-side compliance management device includes a compliance detection module and a risk assessment module; the compliance detection module and the risk assessment module are communicatively connected. The compliance detection module is used to respond to the user's compliance audit analysis command, and to perform dynamic compliance mapping on the client to be tested based on a preset sandbox environment and a preset compliance knowledge graph to obtain the compliance detection result; the compliance audit analysis command corresponds to the client to be tested. The risk assessment module is used to perform a risk assessment on the client to be tested based on the compliance test results and a preset risk scoring strategy, and obtain a risk assessment result.
9. A terminal device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the client compliance management method as described in any one of claims 1-7.
10. A computer-readable storage medium, characterized in that, include: A stored computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform the client compliance management method as described in any one of claims 1-7.