Security detection method and device, electronic equipment and storage medium
By performing multi-dimensional feature extraction and weighted processing on the APP's metadata, network configuration data, and dynamic application data, the problem of low accuracy in APP security detection in existing technologies has been solved, and efficient security detection of APP has been achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-08
- Publication Date
- 2026-04-14
AI Technical Summary
Existing technologies have low accuracy in security detection of applications (APPs) and cannot effectively detect potential security risks of APPs, especially when facing highly dynamic and adversarial security risk events.
By focusing on the metadata, network configuration data, and dynamic application data of the object to be detected, multi-dimensional data is used. Static analysis agents, network analysis agents, and dynamic analysis agents are used to extract static feature information, network feature information, and dynamic feature information. The feature information is weighted and processed to determine the target feature information. Based on the mapping relationship between feature information and security coefficient, the security level is determined, and finally, differentiated processing is performed.
It improves the accuracy of security detection of the target object, and can more comprehensively cover all scenarios of static attributes, network interaction and dynamic behavior, thus realizing efficient security detection of APP.
Smart Images
Figure CN121864427A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the fields of cybersecurity and artificial intelligence, and in particular to a security detection method, apparatus, electronic device, and storage medium. Background Technology
[0002] With the widespread adoption of mobile internet technology, applications (APPs) have become indispensable tools in daily life. In some scenarios, it is necessary to perform security checks on APPs to improve their security.
[0003] In related technologies, app security can be detected through rule-based matching. Specifically, detection rules can be manually constructed and stored on a server. The server determines the app's characteristics using its certificate information, permission requests, and other data. Then, the server matches these characteristics with the detection rules using regular expressions or hash value comparisons, determines the matching result, and decides whether the app is secure based on the result. However, the accuracy of app security detection using this method is relatively low. Summary of the Invention
[0004] This application provides a security detection method, apparatus, electronic device, and storage medium to solve the problem of low accuracy in security detection of objects to be detected.
[0005] In a first aspect, embodiments of this application provide a security detection method, the method comprising:
[0006] Receive a detection request, which is used to request security detection processing of the object to be detected;
[0007] Acquire multiple object data of the object to be detected, including the object's metadata, network configuration data, and dynamic application data;
[0008] Based on metadata, network configuration data, and dynamic application data, determine the target feature information of the object to be detected;
[0009] Based on the target feature information, the security level of the object to be detected is determined. The security level is used to indicate the degree of security of the object to be detected.
[0010] In one possible implementation, the target feature information of the object to be detected is determined based on metadata, network configuration data, and dynamic application data, including:
[0011] Static analysis of metadata is performed to determine the static feature information of the object to be detected;
[0012] Perform network analysis and processing on network configuration data to determine the network characteristic information of the object to be detected;
[0013] Dynamic analysis and processing of dynamic application data are performed to determine the dynamic characteristic information of the object to be detected.
[0014] Target feature information is determined based on static feature information, network feature information, and dynamic feature information.
[0015] In one possible implementation, the target feature information is determined based on static feature information, network feature information, and dynamic feature information, including:
[0016] Determine the type of the object to be detected;
[0017] Based on the type of the object to be detected, determine the first weight of static feature information, the second weight of network feature information, and the third weight of dynamic feature information;
[0018] Based on the first weight, second weight, and third weight, static feature information, network feature information, and dynamic feature information are processed to determine the target feature information.
[0019] In one possible implementation, determining the security level of the object to be detected based on target feature information includes:
[0020] The safety factor of the object to be detected is determined based on the mapping relationship between feature information and safety factor, and the target feature information.
[0021] The safety level is determined based on the safety factor.
[0022] In one possible implementation, determining the safety level based on a safety factor includes:
[0023] If the safety factor is greater than or equal to the first preset threshold, the safety level is determined to be a low-risk level.
[0024] If the safety factor is less than the first preset threshold and the safety factor is greater than or equal to the second preset threshold, the safety level is determined to be medium risk level; wherein the first preset threshold is greater than the second preset threshold.
[0025] If the safety factor is less than the second preset threshold, the safety level is determined to be high-risk.
[0026] In one possible implementation, the security detection method further includes:
[0027] Determine the processing method for the object to be tested based on the security level;
[0028] The object to be detected is processed based on the processing method.
[0029] In one possible implementation, the processing method for the object to be detected is determined based on the security level, including:
[0030] In cases where the security level is high-risk, the appropriate handling methods are blocking and alerting.
[0031] If the safety level is medium risk, the appropriate course of action is to issue a notification.
[0032] If the safety level is low-risk, the appropriate handling method is continuous monitoring.
[0033] Secondly, this application provides a security detection device, the device comprising:
[0034] The receiving module is used to receive detection requests, which are used to request security detection processing of the object to be detected.
[0035] The acquisition module is used to acquire multiple object data of the object to be detected, including the object's metadata, network configuration data, and dynamic application data.
[0036] The processing module is used to determine the target feature information of the object to be detected based on metadata, network configuration data, and dynamic application data.
[0037] The determination module is used to determine the security level of the object to be detected based on the target feature information. The security level is used to indicate the degree of security of the object to be detected.
[0038] In one possible implementation, the processing module is specifically used for:
[0039] Static analysis of metadata is performed to determine the static feature information of the object to be detected;
[0040] Perform network analysis and processing on network configuration data to determine the network characteristic information of the object to be detected;
[0041] Dynamic analysis and processing of dynamic application data are performed to determine the dynamic characteristic information of the object to be detected.
[0042] Target feature information is determined based on static feature information, network feature information, and dynamic feature information.
[0043] In one possible implementation, the processing module is specifically used for:
[0044] Determine the type of the object to be detected;
[0045] Based on the type of the object to be detected, determine the first weight of static feature information, the second weight of network feature information, and the third weight of dynamic feature information;
[0046] Based on the first weight, second weight, and third weight, static feature information, network feature information, and dynamic feature information are processed to determine the target feature information.
[0047] In one possible implementation, the determining module is specifically used for:
[0048] The safety factor of the object to be detected is determined based on the mapping relationship between feature information and safety factor, and the target feature information.
[0049] The safety level is determined based on the safety factor.
[0050] In one possible implementation, the determining module is specifically used for:
[0051] If the safety factor is greater than or equal to the first preset threshold, the safety level is determined to be a low-risk level.
[0052] If the safety factor is less than the first preset threshold and the safety factor is greater than or equal to the second preset threshold, the safety level is determined to be medium risk level; wherein the first preset threshold is greater than the second preset threshold.
[0053] If the safety factor is less than the second preset threshold, the safety level is determined to be high-risk.
[0054] In one possible implementation, the determining module is further configured to:
[0055] Determine the processing method for the object to be tested based on the security level;
[0056] The object to be detected is processed based on the processing method.
[0057] In one possible implementation, the determining module is further configured to:
[0058] In cases where the security level is high-risk, the appropriate handling methods are blocking and alerting.
[0059] If the safety level is medium risk, the appropriate course of action is to issue a notification.
[0060] If the safety level is low-risk, the appropriate handling method is continuous monitoring.
[0061] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;
[0062] The memory stores instructions that the computer executes;
[0063] The processor executes computer execution instructions stored in memory to implement the security detection method as described in the first aspect.
[0064] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the security detection method as described in the first aspect.
[0065] The security detection method, apparatus, electronic device, and storage medium provided in this application focus on multi-source, multi-dimensional data such as metadata, network configuration data, and dynamic application data of the object under test. This overcomes the limitations of single-data monitoring and ensures that the obtained target feature information covers the entire scenario of the object's static attributes, network interactions, and dynamic behaviors. Therefore, the security level obtained after processing the target feature information by the server is more accurate. Thus, the security detection method provided in this application improves the accuracy of security detection of the object under test. Attached Figure Description
[0066] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0067] Figure 1 A schematic diagram illustrating an application scenario provided in an embodiment of this application;
[0068] Figure 2 A schematic flowchart illustrating a security detection method provided in an embodiment of this application;
[0069] Figure 3 This application provides a schematic diagram of a process for determining target feature information in an embodiment of the present application.
[0070] Figure 4 A schematic diagram illustrating the determination of a security level, provided as an embodiment of this application;
[0071] Figure 5 This is a schematic diagram of a security detection system provided in an embodiment of this application;
[0072] Figure 6 This is a schematic diagram of the structure of a security detection device provided in an embodiment of this application;
[0073] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.
[0074] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to specific embodiments. Detailed Implementation
[0075] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.
[0076] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.
[0077] With the widespread adoption of mobile internet technology, apps have become indispensable tools in daily life. Consequently, the security risks associated with apps are also increasing. In some scenarios, security testing of apps is necessary to improve their usability.
[0078] In related technologies, app security can be detected through rule-based matching. Specifically, detection rules can be manually constructed and stored on a server. The server determines the app's characteristic information using static information such as certificate information and permission requests. Then, the server matches the characteristic information with the detection rules using regular expressions or hash value comparisons, determines the matching result, and determines whether the app is secure based on the matching result.
[0079] For example, if the detection rules contain rules that match the feature information, then the app is determined to be insecure; if the detection rules do not contain rules that match the feature information, then the app is determined to be secure.
[0080] However, the above methods can only detect known risks in an app, and they rely solely on the app's static features for detection, resulting in a low accuracy rate for app security testing.
[0081] In some embodiments, the related technologies can also detect the security of an app through dynamic analysis techniques using machine learning. Specifically, the server can run the app in a sandbox environment and obtain dynamic information such as network communication and system calls during the app's runtime. Then, the server uses traditional machine learning algorithms such as support vector machines and decision trees to build a classification model, and processes the information such as network communication and system calls through the classification model to determine the security of the app.
[0082] However, compared to rule-based matching, while the above methods achieve analysis of the dynamic characteristics of an app during runtime, they are insufficient to accurately detect potential security risks by relying on single pieces of information, as app security incidents become increasingly organized, technically sophisticated, and cross-platform. Therefore, the accuracy of app security detection using these methods remains low.
[0083] In some embodiments, the related technologies can also detect the security of an app through deep learning-based multimodal fusion technology. Specifically, the server can obtain static information such as the app's certificate information and permission requests, as well as dynamic information such as network communication and system calls, and input the app's static and dynamic information into a neural network model. The neural network model performs multi-dimensional information fusion processing on the app's static and dynamic information to determine the app's security.
[0084] However, the aforementioned methods mostly employ a centralized architecture with relatively fixed workflows, lacking flexibility for adjustment. Faced with constantly evolving security risks, these methods cannot dynamically optimize detection strategies or adjust internal collaboration mechanisms. Therefore, they are ill-suited for highly dynamic and aggressive security risks, resulting in low accuracy in app security testing.
[0085] Based on this, this application provides a security detection method. The server focuses on multi-source, multi-dimensional data such as metadata, network configuration data, and dynamic application data of the object to be detected, breaking through the limitations of single-data monitoring and ensuring that the obtained target feature information can cover the entire scenario of the static attributes, network interactions, and dynamic behaviors of the object to be detected. Thus, the security level obtained after the server processes the target feature information is more accurate. Therefore, the security detection method provided in this application improves the accuracy of security detection of the object to be detected.
[0086] To facilitate understanding, the following will be combined with... Figure 1 The application scenarios applicable to the embodiments of this application will be briefly described below.
[0087] Figure 1 This is a schematic diagram illustrating an application scenario provided by an embodiment of this application. Please refer to [link / reference]. Figure 1It includes a user device 11 and a server 12, wherein the user device 11 can be a front-end device such as a mobile phone or tablet. The server 12 is the back-end server of the security detection system that detects the APP.
[0088] In some embodiments, user equipment 11 deploys multiple apps. When user equipment 11 detects a security risk in any of the apps, it sends a detection request to server 12. This detection request requests security detection processing for the app. Upon receiving the detection request, server 12 obtains the app information and performs security detection processing on the app based on this information to determine the app's security level. The security level indicates the degree of security of the app. Then, server 12 sends the security level to user equipment 11.
[0089] It should be noted that the execution subject in each embodiment of this application can be a chip, chip module, processor, microprocessor, etc., or it can be a device integrating the above-mentioned chips, chip modules, processors, or microprocessors, such as a server. The specific execution subject in each embodiment of this application is not limited, and it can be selected and set according to actual needs. In the following embodiments, a server integrating the above-mentioned chips, chip modules, processors, or microprocessors is used as an example for description, which does not constitute a limitation on the actual execution subject.
[0090] It should be noted that, Figure 1 This is merely an example to illustrate one application scenario, and is not intended to limit the application scenario.
[0091] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.
[0092] Figure 2 This is a flowchart illustrating a security detection method provided in an embodiment of this application. Figure 2 As shown, the process may include the following steps:
[0093] S21. Receive a detection request. The detection request is used to request security detection processing of the object to be detected.
[0094] A detection request is a request initiated by a user device to request the server to perform security detection processing on an object to be detected. For example, assuming the object to be detected is object A, the detection request could be to perform security detection processing on object A.
[0095] The object to be detected is used to define the scope and target carrier of the security detection process performed by the server; that is, the object to be detected is the object on which the server performs security detection processing. In some embodiments, the object to be detected can be an application (APP).
[0096] In some embodiments, multiple apps are deployed on the user device. The user device monitors the security of any one of these apps in real time. If the user device detects a security risk in an app, it identifies that app as a target for detection, generates a detection request for that app, and then sends the detection request to the server.
[0097] S22. Obtain multiple object data of the object to be detected, including the metadata, network configuration data and dynamic application data of the object to be detected.
[0098] Object data refers to data related to the object to be detected, such as its own attributes, behavioral characteristics, and associated configurations. In some embodiments, object data includes the object's metadata, network configuration data, and dynamic application data.
[0099] Metadata is static data that describes the basic attributes of the object being inspected, reflecting its inherent characteristics. Metadata may include, for example, the object's code, name, version number, and signature certificate.
[0100] Network configuration data refers to the associated configuration information of the object under test when it runs in a network environment, which reflects the rule characteristics of the object under test during network interaction. In some embodiments, network configuration data may include, for example, the network connection protocol of the object under test, the server's Internet Protocol (IP) address, port number, Domain Name System (DNS) resolution configuration, and other data.
[0101] Dynamic application data refers to real-time behavioral data generated by the object under test during its runtime state, reflecting the dynamic characteristics of the object. In some embodiments, dynamic application data may include, for example, the object's system call behavior, permission request records, background process operations, and report data.
[0102] In some embodiments, the server may send a data acquisition request to the user equipment, the data acquisition request being used to request the acquisition of multiple object data of the object to be detected. After receiving the data acquisition request, the user equipment sends the multiple object data of the object to be detected to the server.
[0103] S23. Determine the target feature information of the object to be detected based on metadata, network configuration data, and dynamic application data.
[0104] Target feature information is a set of information used to reflect the security attributes of the object to be detected.
[0105] In some embodiments, the server can process metadata, network configuration data, and dynamic application data separately to determine the static feature information, network feature information, and dynamic feature information of the object to be detected. Then, the server performs feature fusion processing on the static feature information, network feature information, and dynamic features to obtain the target feature information of the object to be detected.
[0106] S24. Based on the target feature information, determine the security level of the object to be detected. The security level is used to indicate the degree of security of the object to be detected.
[0107] The safety level can be any of the following: low risk, medium risk, or high risk. A low risk level indicates a high level of safety for the object being tested; in this case, the object is safe and there are no safety risks. A medium risk level indicates a moderate level of safety for the object being tested; in this case, the object is safe, but there may be safety risks. A high risk level indicates a low level of safety for the object being tested; in this case, the object is unsafe and there are safety risks.
[0108] In some embodiments, the server can perform security analysis on the target feature information to determine the security level of the object to be detected.
[0109] exist Figure 2 In the illustrated embodiment, the server focuses on multi-source, multi-dimensional data such as metadata, network configuration data, and dynamic application data of the object to be detected. This overcomes the limitations of single-data monitoring and ensures that the obtained target feature information covers the entire scenario of the object's static attributes, network interactions, and dynamic behaviors. Thus, the security level obtained after processing the target feature information by the server is more accurate. Therefore, the security detection method provided in this application improves the accuracy of security detection of the object to be detected.
[0110] exist Figure 2 Based on the illustrated embodiment, the following, in conjunction with Figure 3 The process of determining the target feature information of the object to be detected in this application is further explained.
[0111] Figure 3 This is a schematic diagram illustrating a process for determining target feature information, provided as an embodiment of this application. Figure 3 As shown, the process may include the following steps:
[0112] S31. Perform static analysis on the metadata to determine the static feature information of the object to be detected.
[0113] Static feature information refers to the core attribute information inherent to the object under test, which is independent of its runtime state and extracted after static analysis of metadata. In some embodiments, static feature information focuses on the static essence of the object under test and can serve as the basis for security judgment in security testing of the object under test.
[0114] For example, static feature information can be used to determine whether the object to be detected has an abnormal signature, or whether the developer is an unregistered developer, or other security risk events.
[0115] In some embodiments, a static analysis agent is deployed on the server, and the server can input metadata into the static analysis agent. After performing static analysis on the metadata, the static analysis agent obtains the static feature information of the object to be detected.
[0116] S32. Perform network analysis and processing on the network configuration data to determine the network characteristic information of the object to be detected.
[0117] Network characteristic information is key information reflecting the network interaction rules and associated attributes of the object under test, obtained after network analysis and processing of network configuration data. Network characteristic information focuses on the interaction logic between the object under test and the network environment, and can determine the network behavior patterns of the object under test. Therefore, network characteristic information can serve as a basis for network security judgment when conducting security testing on the object under test.
[0118] For example, network feature information can be used to determine whether the object to be detected has security risk events such as using unconventional communication protocols or resolving fake domain names.
[0119] In some embodiments, a network analysis agent is deployed on the server. The server can input network configuration data into the network analysis agent. After performing network analysis processing on the network configuration data, the network analysis agent obtains the network characteristic information of the object to be detected.
[0120] S33. Perform dynamic analysis and processing on dynamic application data to determine the dynamic characteristic information of the object to be detected.
[0121] Dynamic feature information refers to the real-time behavioral and operational characteristics of an object under test, determined through dynamic analysis and processing of dynamic application data. Focusing on the dynamic behavior of the object under test, dynamic feature information can serve as a basis for determining operational security during security testing.
[0122] For example, dynamic feature information can be used to determine whether the object to be detected has security risk events such as information leakage or installation of abnormal plugins.
[0123] In some embodiments, a dynamic analysis agent is deployed on the server. The server can input dynamic application data into the dynamic analysis agent. After performing dynamic analysis on the dynamic application data, the dynamic analysis agent obtains the dynamic feature information of the object to be detected.
[0124] S34. Determine the target feature information based on static feature information, network feature information, and dynamic feature information.
[0125] In some embodiments, the server determines the target feature information in the following ways: determining the type of the object to be detected; determining a first weight of static feature information, a second weight of network feature information, and a third weight of dynamic feature information based on the type of the object to be detected; and processing the static feature information, network feature information, and dynamic feature information according to the first weight, the second weight, and the third weight to determine the target feature information.
[0126] The type of the object to be detected is the result of classifying and defining the object, indicating its core functions, application scenarios, and domain. For example, the type of the object to be detected could be a social networking app, an office app, or a game app.
[0127] The first weight is a quantitative indicator assigned to static feature information to characterize its importance in target feature fusion. In some embodiments, the first weight can be represented as a decimal less than 1 and greater than 0, and the larger the first weight, the higher the importance of static feature information in target feature fusion; the smaller the first weight, the lower the importance of static feature information in target feature fusion.
[0128] The second weight is a quantitative indicator assigned to network feature information to characterize its importance in target feature fusion. In some embodiments, the second weight can be represented as a decimal less than 1 and greater than 0, and the larger the second weight, the higher the importance of network feature information in target feature fusion; the smaller the second weight, the lower the importance of network feature information in target feature fusion.
[0129] The third weight is a quantitative indicator assigned to dynamic feature information to represent its importance in target feature fusion. In some embodiments, the third weight can be represented as a decimal less than 1 and greater than 0, and the larger the third weight, the higher the importance of dynamic feature information in target feature fusion; the smaller the third weight, the lower the importance of dynamic feature information in target feature fusion.
[0130] It should be noted that the sum of the first weight, the second weight, and the third weight is 1.
[0131] In some embodiments, the server can determine the first weight, the second weight, and the third weight by the mapping relationship between object type and weight, as well as the type of the object to be detected.
[0132] For example, suppose the mapping relationship between object type and weight is as shown in Table 1:
[0133] Table 1
[0134]
[0135] Assuming the type of the object to be detected is a social app, the first weight is determined to be 0.2, the second weight to be 0.6, and the third weight to be 0.2.
[0136] Then, the server performs weighted calculations on the static feature information, network feature information, and dynamic feature information based on the first weight, the second weight, and the third weight to determine the target feature information.
[0137] exist Figure 3 In the illustrated embodiment, the server first extracts three types of feature information—static, network, and dynamic—from metadata, network configuration data, and dynamic application data through targeted analysis, ensuring comprehensive feature coverage and alignment with data attributes. Then, the server dynamically assigns weights to the three types of feature information based on the type of the object to be detected, allowing the core risk dimension's feature information to dominate the target feature information. Finally, the target feature information is formed through weighted processing and integration. This approach balances the comprehensive value of multi-dimensional features while accurately matching the security risk characteristics of different types of objects, thereby improving the accuracy of determining the target feature information.
[0138] Based on the above embodiments, the following, in conjunction with Figure 4 This application provides a further explanation of the method used to determine the security level of the object to be detected based on target feature information.
[0139] Figure 4 This is a schematic diagram illustrating the determination of a security level, provided as an embodiment of this application. Figure 4 As shown, the process may include the following steps:
[0140] S41. Determine the safety factor of the object to be detected based on the mapping relationship between feature information and safety factor, and the target feature information.
[0141] The safety factor of the object under test is used to indicate the safety level of the object. In some embodiments, the safety factor of the object under test can be represented by a positive integer, and the larger the safety factor of the object under test, the higher the safety level of the object under test; the smaller the safety factor of the object under test, the lower the safety level of the object under test.
[0142] For example, suppose the mapping relationship between feature information and security factor can be as shown in Table 2:
[0143] Table 2
[0144]
[0145] Assuming the target feature information is feature information 1, the safety factor of the object to be detected is determined to be 10.
[0146] S42. Determine the safety level based on the safety factor.
[0147] In some embodiments, the server determines the security level based on the security coefficient as follows: if the security coefficient is greater than or equal to a first preset threshold, the security level is determined to be low-risk; if the security coefficient is less than the first preset threshold and the security coefficient is greater than or equal to a second preset threshold, the security level is determined to be medium-risk; wherein the first preset threshold is greater than the second preset threshold; if the security coefficient is less than the second preset threshold, the security level is determined to be high-risk.
[0148] Since a higher safety factor indicates a higher level of safety for the object under test, and a lower safety factor indicates a lower level of safety for the object under test, when the safety factor is greater than or equal to the first preset threshold, it indicates that the safety risk of the object under test is low, that is, the object under test is in a relatively safe state. At this time, the safety level can be determined as a low-risk level.
[0149] If the safety factor is less than the first preset threshold and the safety factor is greater than or equal to the second preset threshold, it indicates that the object to be tested has certain safety hazards, and the safety level can be determined as medium risk level.
[0150] If the safety factor is less than the second preset threshold, it indicates that there is a serious safety risk event in the large detection object, and the safety level can be determined as high risk level.
[0151] In some embodiments, after determining the security level of the object to be detected, the server can determine the processing method for the object to be detected based on the security level; and process the object to be detected based on the processing method.
[0152] Specifically, the server can determine the following processing methods for the object to be detected: if the security level is high-risk, the processing method is blocking and prompting; if the security level is medium-risk, the processing method is prompting; if the security level is low-risk, the processing method is continuous monitoring.
[0153] Blocking is a strong intervention method for high-risk targets. It refers to the server interrupting the network connection of the target through technical means to prevent the continued operation of security risk events.
[0154] Alert processing is a warning process for high-risk and medium-risk objects to be tested. It refers to the way the server sends alert information to the user device to indicate that the device under test has security risks.
[0155] Continuous monitoring and processing is a weak intervention method for low-risk objects to be monitored. It refers to the way in which the server sends monitoring and processing instructions to the user equipment so that the user equipment can continuously monitor the security of the object to be monitored.
[0156] In some embodiments, after determining the processing method for the object to be detected, the server processes the object to be detected based on the processing method.
[0157] In some embodiments, if the server determines that the security level of the object under test is high-risk, it terminates the network connection of the object under test. Simultaneously, the server sends a first alert to the user equipment to indicate that a security risk event exists. If the server determines that the security level of the object under test is medium-risk, it sends a second alert to the user equipment to indicate that a security vulnerability exists. If the server determines that the security level of the object under test is low-risk, it sends a continuous monitoring instruction to the user equipment to instruct the user equipment to continuously monitor the security of the object under test.
[0158] exist Figure 4 In the illustrated embodiment, the server first converts target features into quantified security coefficients based on the mapping relationship between feature information and security coefficients. Then, it constructs level determination rules through dual preset thresholds, stratifying the security coefficients into three security levels: high, medium, and low. Finally, it matches differentiated processing methods according to the level. This approach avoids subjectivity in level determination through quantified indicators and clear thresholds, and achieves targeted risk management through the adaptation between security levels and processing methods. It prevents the spread of high-risk hazards while avoiding excessive intervention in low-risk targets, thus improving the efficiency and reliability of security governance.
[0159] The security detection method provided in this application has been described in the above embodiments. Below, in conjunction with… Figure 5 The security detection system that implements the security detection method in the embodiments of this application will be described. The security detection system is a software system deployed on a server. Figure 5 This is a schematic diagram of a security detection system provided in an embodiment of this application, such as... Figure 5 As shown, there are security-aware intelligent agent clusters, multimodal analysis intelligent agent clusters, collaborative decision-making intelligent agent clusters, and dynamic response intelligent agent clusters.
[0160] The security-aware intelligent agent cluster is responsible for collecting and initially screening multi-source data. In some embodiments, the security-aware intelligent agent cluster includes static data collection agents, dynamic data collection agents, and network data collection agents. The static data collection agent is deployed in the user device's app store and can collect metadata of the object to be detected; the dynamic data collection agent is deployed in the user device and can collect dynamic application data of the object to be detected on the user device; the network data collection agent is deployed at the network boundary of the user device and can collect network configuration data of the object to be detected.
[0161] In some embodiments, after receiving a data acquisition request from the server, the user equipment collects metadata, network configuration data, and dynamic application data of the object to be detected through a static data acquisition agent, a dynamic data acquisition agent, and a network data acquisition agent. Then, it sends the metadata, network configuration data, and dynamic application data of the object to be detected to the server. Upon receiving the metadata, network configuration data, and dynamic application data of the object to be detected, the server performs data preprocessing on these data to obtain multiple object data sets for the object to be detected.
[0162] A multimodal analysis agent cluster is an agent cluster built using a neural network model. It includes static analysis agents, dynamic analysis agents, and network analysis agents. The static analysis agent performs static analysis on the metadata of the object to be detected, determining its static feature information. For example, the static analysis agent can process the code of the object to be detected using decompilation technology to extract its code features.
[0163] Dynamic analysis agents can dynamically analyze and process the dynamic application data of a target object to determine its dynamic characteristic information. For example, a dynamic analysis agent can detect the behavior of a target object in a sandbox environment based on dynamic application data to determine its dynamic characteristic information.
[0164] A network analysis agent can perform network analysis on the network configuration data of a target object to determine its network characteristics. For example, the network analysis agent can perform deep analysis on the network configuration information of the target object to determine its network characteristics.
[0165] In this way, the network analysis agent cluster can extract effective feature information from multi-source data, design a cross-modal feature alignment loss function, and solve the problem of data distribution differences across different modalities. Furthermore, the network analysis agent cluster supports standardized processing of various data formats, ensuring consistency in feature quality.
[0166] In some embodiments, after determining the static feature information, network feature information, and dynamic feature information of the object to be detected, the multimodal analysis agent cluster performs feature fusion processing on the static feature information, network feature information, and dynamic feature information to determine the target feature information of the object to be detected.
[0167] Specifically, the multimodal analysis agent cluster can determine the weights of each feature based on the type of the object to be detected, and then use an attention mechanism to focus the security detection system on the most relevant feature dimension, adaptively optimizing the contribution of multimodal features. It should be noted that the multimodal analysis agent cluster can dynamically optimize feature weight allocation based on the type of the object to be detected.
[0168] In some embodiments, the multimodal analysis agent cluster also includes knowledge graph agents to provide domain knowledge support for multimodal analysis. The knowledge graph agents can be continuously updated to ensure that the security detection system can respond to various new types of security risks and events.
[0169] The collaborative decision-making agent cluster is an agent cluster based on a reinforcement learning framework. It comprises a risk assessment agent, a policy generation agent, and a collaborative scheduling agent. The risk assessment agent processes target feature information to determine the security level of the object to be detected. The policy generation agent determines the processing method for the object to be detected based on its security level. The collaborative scheduling agent uses an improved contract network protocol to achieve task allocation and coordination, constructing an autonomous negotiation mechanism for intelligent health checks.
[0170] Specifically, the collaborative scheduling agents employ a standard communication language to define message formats and interaction specifications between agents, providing fundamental support for the dialogue framework between agents. In some embodiments, the communication protocol supports synchronous and asynchronous communication modes to adapt to the real-time requirements of different scenarios.
[0171] The collaborative scheduling agent achieves collaborative work among agents through an improved contract network protocol. Therefore, the collaborative scheduling agent supports dynamic load balancing, enabling task scheduling and resource allocation based on the real-time working status of each agent. Furthermore, the collaborative scheduling agent establishes a conflict detection and resolution mechanism to handle target conflicts and resource competition among agents. When conflicts occur, the system automatically coordinates through a negotiation algorithm to ensure the smooth execution of the workflow.
[0172] The dynamic handling agent cluster is responsible for executing the processing methods for the objects under detection. The cluster includes blocking agents and early warning / notification agents. The blocking agents work in conjunction with the network protection system; if the processing method for the object under detection is blocking, the blocking agents can interrupt the network access of the object under detection. The early warning / notification agents can send alerts to user devices through multiple channels, establishing cross-platform collaborative processing interface specifications and opening up communication channels with the network and user devices.
[0173] In some embodiments, the security detection system establishes a complete autonomous learning closed loop, enabling online optimization and continuous evolution of processing strategies. Specifically, the security detection system employs incremental learning technology to continuously optimize the model, combined with a multi-agent reinforcement learning framework, allowing the system to continuously learn from new samples during operation, maintaining the timeliness and accuracy of security detection capabilities. Simultaneously, the security detection system designs a multi-objective reward function to balance performance indicators such as detection accuracy and response timeliness. Thus, through online learning, the security detection system can autonomously explore optimal detection and response strategies. Furthermore, the security detection system establishes a multi-dimensional evaluation index system, ensuring continuous system improvement through a comparative verification platform, and constructing a dual reflection mechanism to enhance the interpretability of response decisions through result verification and process traceability. Evaluation results are fed back to the learning module in real time, forming a complete "detection-response-feedback" optimization closed loop.
[0174] Figure 6 This is a schematic diagram of a security detection device provided in an embodiment of this application. Please refer to... Figure 6 The security detection device 60 provided in this application embodiment includes: a receiving module 61, an acquiring module 62, a processing module 63, and a determining module 64, wherein:
[0175] The receiving module 61 is used to receive a detection request, which is used to request security detection processing of the object to be detected.
[0176] The acquisition module 62 is used to acquire multiple object data of the object to be detected, including the metadata, network configuration data and dynamic application data of the object to be detected.
[0177] Processing module 63 is used to determine the target feature information of the object to be detected based on metadata, network configuration data and dynamic application data;
[0178] The determination module 64 is used to determine the security level of the object to be detected based on the target feature information. The security level is used to indicate the degree of security of the object to be detected.
[0179] In one possible implementation, the processing module 63 is specifically used for:
[0180] Static analysis of metadata is performed to determine the static feature information of the object to be detected;
[0181] Perform network analysis and processing on network configuration data to determine the network characteristic information of the object to be detected;
[0182] Dynamic analysis and processing of dynamic application data are performed to determine the dynamic characteristic information of the object to be detected.
[0183] Target feature information is determined based on static feature information, network feature information, and dynamic feature information.
[0184] In one possible implementation, the processing module 63 is specifically used for:
[0185] Determine the type of the object to be detected;
[0186] Based on the type of the object to be detected, determine the first weight of static feature information, the second weight of network feature information, and the third weight of dynamic feature information;
[0187] Based on the first weight, second weight, and third weight, static feature information, network feature information, and dynamic feature information are processed to determine the target feature information.
[0188] In one possible implementation, the determining module 64 is specifically used for:
[0189] The safety factor of the object to be detected is determined based on the mapping relationship between feature information and safety factor, and the target feature information.
[0190] The safety level is determined based on the safety factor.
[0191] In one possible implementation, the determining module 64 is specifically used for:
[0192] If the safety factor is greater than or equal to the first preset threshold, the safety level is determined to be a low-risk level.
[0193] If the safety factor is less than the first preset threshold and the safety factor is greater than or equal to the second preset threshold, the safety level is determined to be medium risk level; wherein the first preset threshold is greater than the second preset threshold.
[0194] If the safety factor is less than the second preset threshold, the safety level is determined to be high-risk.
[0195] In one possible implementation, the determining module 64 is further configured to:
[0196] Determine the processing method for the object to be tested based on the security level;
[0197] The object to be detected is processed based on the processing method.
[0198] In one possible implementation, the determining module 64 is further configured to:
[0199] In cases where the security level is high-risk, the appropriate handling methods are blocking and alerting.
[0200] If the safety level is medium risk, the appropriate course of action is to issue a notification.
[0201] If the safety level is low-risk, the appropriate handling method is continuous monitoring.
[0202] The security detection device 60 provided in this application embodiment can execute the security detection method shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be described again here.
[0203] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 7 As shown, the electronic device 70 may include: a processor 71, and a memory 72 communicatively connected to the processor;
[0204] Memory 72 stores instructions executed by the computer;
[0205] The processor 71 executes computer execution instructions stored in the memory 72 to implement the security detection method shown in the above method embodiment.
[0206] Optionally, the aforementioned processor can be a central processing unit (CPU), a graphics processing unit (GPU), other general-purpose processors, a digital signal processor (DSP), or an application-specific integrated circuit (ASIC), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.
[0207] The electronic device 70 provided in this application embodiment can execute the security detection method shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be described again here.
[0208] This application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the security detection method shown in the above-described method embodiments.
[0209] This application provides a computer program product, including a computer program that, when executed by a processor, implements the security detection method shown in the above-described method embodiments.
[0210] This application provides a chip that stores a computer program. When the computer program is executed by the chip, it implements the security detection method shown in the above-described method embodiments.
[0211] This application provides a chip module on which a computer program is stored. When the computer program is executed by the chip module, it implements the security detection method shown in the above-described method embodiment.
[0212] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.
[0213] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.
[0214] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.
[0215] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.
[0216] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.
[0217] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.
[0218] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.
[0219] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.
[0220] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.
Claims
1. A security detection method, characterized in that, The method includes: Receive a detection request, the detection request being used to request security detection processing of the object to be detected; Acquire multiple object data of the object to be detected, the multiple object data including the metadata, network configuration data and dynamic application data of the object to be detected; Based on the metadata, the network configuration data, and the dynamic application data, the target feature information of the object to be detected is determined; Based on the target feature information, the security level of the object to be detected is determined, and the security level is used to indicate the degree of security of the object to be detected.
2. The method according to claim 1, characterized in that, The step of determining the target feature information of the object to be detected based on the metadata, the network configuration data, and the dynamic application data includes: The metadata is subjected to static analysis to determine the static feature information of the object to be detected; The network configuration data is subjected to network analysis processing to determine the network characteristic information of the object to be detected; The dynamic application data is dynamically analyzed and processed to determine the dynamic feature information of the object to be detected; The target feature information is determined based on the static feature information, the network feature information, and the dynamic feature information.
3. The method according to claim 2, characterized in that, Determining the target feature information based on the static feature information, the network feature information, and the dynamic feature information includes: Determine the type of the object to be detected; Based on the type of the object to be detected, determine the first weight of the static feature information, the second weight of the network feature information, and the third weight of the dynamic feature information; Based on the first weight, the second weight, and the third weight, the static feature information, the network feature information, and the dynamic feature information are processed to determine the target feature information.
4. The method according to any one of claims 1-3, characterized in that, Determining the security level of the object to be detected based on the target feature information includes: The security factor of the object to be detected is determined based on the mapping relationship between feature information and security factor, and the target feature information. The safety level is determined based on the safety factor.
5. The method according to claim 4, characterized in that, Determining the security level based on a security factor includes: If the safety factor is greater than or equal to a first preset threshold, the safety level is determined to be a low-risk level. If the safety factor is less than the first preset threshold and the safety factor is greater than or equal to the second preset threshold, the safety level is determined to be a medium-risk level; wherein the first preset threshold is greater than the second preset threshold. If the safety factor is less than the second preset threshold, the safety level is determined to be a high-risk level.
6. The method according to claim 5, characterized in that, The method further includes: Based on the security level, determine the processing method for the object to be detected; The object to be detected is processed based on the aforementioned processing method.
7. The method according to claim 6, characterized in that, The step of determining the processing method for the object to be detected based on the security level includes: When the security level is the high-risk level, the processing method is determined to be blocking processing and prompting processing; If the security level is the medium risk level, the processing method is determined to be the prompting processing; When the safety level is the low-risk level, the processing method is determined to be continuous monitoring.
8. A safety detection device, characterized in that, The device includes: The receiving module is used to receive a detection request, which is used to request security detection processing of the object to be detected. The acquisition module is used to acquire multiple object data of the object to be detected, including metadata, network configuration data and dynamic application data of the object to be detected. The processing module is used to determine the target feature information of the object to be detected based on the metadata, the network configuration data, and the dynamic application data. The determination module is used to determine the security level of the object to be detected based on the target feature information, wherein the security level is used to indicate the degree of security of the object to be detected.
9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the security detection method as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the security detection method as described in any one of claims 1 to 7.