Security system and security method

Abstract

A security method executed by a computer device is provided. The security method comprises the following steps. Firstly, in the training stage, user operation data of the computer device is acquired. Then, the user operation data is used to train a behavior model. In the predicting stage, the trained behavior model is used to determine whether a current operation on the computer device is an abnormal operation or not. When it is determined that the current operation is the abnormal operation, an abnormal notification message is generated. A security system is also provided.

Description

Technical Field

[0001] This case relates to the technical field of security protection, and in particular to a security protection system and method applicable to a computer device. Prior Technology

[0002] Existing computer security systems (especially standalone systems) lack sufficient real-time detection and response capabilities when facing increasingly complex network threats, making it difficult to effectively protect user privacy and system security.

[0003] For example, existing computer security systems cannot effectively identify malicious users, nor can they effectively prevent malicious software from monitoring screen and keyboard input, or from accessing data without authorization. Summary of the Invention

[0004] This case provides a security protection method executed by a computer device, which includes the following steps: In the training phase, firstly, user operation data of the computer device is acquired, and then a behavioral model is trained using the user operation data. In the prediction phase, the trained behavioral model is used to determine whether a current operation of the computer device is an abnormal behavior. If the current operation is confirmed to be abnormal, an abnormal behavior prompt message is generated.

[0005] This application also provides a security protection system applicable to a computer device. This security protection system includes a behavior model, a training unit, a behavior judgment unit, and an alert unit. The training unit is electrically coupled to the behavior model and is adapted to acquire user operation data of the computer device and train the behavior model using the user operation data. The behavior judgment unit is electrically coupled to the behavior model and is adapted to use the trained behavior model to determine whether a current operation of the computer device is an abnormal behavior. The alert unit is electrically coupled to the behavior judgment unit; if the current operation is determined to be abnormal, the behavior judgment unit notifies the alert unit to generate an abnormal behavior prompt message.

[0006] Existing computer security systems (especially standalone systems) lack sufficient real-time detection and response capabilities to address increasingly complex network threats, making it difficult to effectively protect user privacy and system security. In contrast, the security method and system provided in this case can acquire user operation data from computer devices to train a behavioral model, and use the trained behavioral model to determine whether the current operation of a computer device is abnormal. In this way, malicious users and unauthorized operations can be identified based on changes in the computer device's operating patterns, preventing malicious software from monitoring screen and keyboard input or accessing data without authorization. Simple Explanation of the Diagram

[0007] The first figure is a block diagram illustrating the security protection system implemented during the training phase according to an embodiment of this case; The second figure is a block diagram illustrating the security protection system in the prediction phase according to an embodiment of this case; The third figure is a block diagram of a security protection system provided according to another embodiment of this case; Figure 4 is a flowchart of a security protection method provided according to an embodiment of this case; and Figure 5 is a flowchart of a security protection method provided according to another embodiment of this case. Implementation

[0008] The specific implementation methods of this case will be described in more detail below with reference to the schematic diagrams. The advantages and features of this case will become clearer based on the following description and the scope of the patent application. It should be noted that the drawings are all in a very simplified form and use non-precise proportions, and are only used to facilitate and clarify the illustration of the embodiments of this case.

[0009] The first figure is a block diagram illustrating the security protection system 100 performing during the training phase according to an embodiment of this invention. The second figure is a block diagram illustrating the security protection system 100 performing during the prediction phase according to an embodiment of this invention.

[0010] This security system 100 is suitable for installation on a computer device 10 to provide security protection for the computer device 10. The computer device 10 may be a desktop computer, a laptop computer, a tablet computer, a smartphone, or other terminal device. However, it is not limited to these. In other embodiments, the computer device 10 may also be a server.

[0011] As shown in the figure, this security protection system 100 includes a behavior model M1, a behavior detection unit 110, a training unit 120, a storage unit 130, a behavior judgment unit 140, and an alert unit 150.

[0012] Please refer to the first figure as well. During the training phase, the behavior detection unit 110 is adapted to detect the training operation behavior OT of one of the computer devices 10 to obtain user operation data D1 corresponding to the training operation behavior OT.

[0013] Training unit 120 is electrically coupled to behavior detection unit 110 and behavior model M1, and is adapted to process user operation data D1 to generate training data D2, and use training data D2 to train behavior model M1. Behavior model M1 trained by training unit 120 is stored in storage unit 130 for use in subsequent prediction stages.

[0014] This behavioral model M1 can be a binary classification model, such as a Support Vector Machine (SVM) model. A Support Vector Machine is a supervised machine learning algorithm that classifies data by finding the optimal straight line or hyperplane that maximizes the distance between each class in N-dimensional space. In this case, the goal is to train the behavioral model M1 to determine whether the operation of the computer device 10 is abnormal (categorized as abnormal or non-abnormal).

[0015] User operation data D1 may include system resource usage data and privacy settings data. System resource usage data refers to system operation status data related to the computer device, such as CPU usage, memory usage, hard disk access frequency and number of accesses, network bandwidth and traffic. For example, system resource usage data may include CPU load percentage, memory (e.g., RAM) usage status, disk read / write counts, network connection records, etc. Privacy settings data refers to system settings and authorization status related to user privacy. For example, privacy settings data may include microphone and camera activation status, application access permission settings, location information sharing settings, etc. In one embodiment, this computer device 10 may be equipped with a personalized control unit 12. This personalized control unit 12 allows the user to set the system resource usage status and privacy status of the computer device 10. The personalized control unit 12 can control a system setting value VS of the computer device 10 in response to a control command CI input by the user. The behavior detection unit 110 can acquire the system setting value VS as user operation data D1 and provide it to the training unit 120 for training the behavior model M1.

[0016] The training unit 120 provided in this embodiment is configured to consider the behavior model M1 as having completed training and store it in the storage unit 130 after training with a preset number of user operation data D1. For ease of explanation, the trained behavior model is labeled as M2 in the figure. In one embodiment, this preset number is 20,000 user operation data D1. However, this embodiment is not limited to this. In other embodiments, the behavior model M2 that has initially completed training can be further trained using operation data obtained in the prediction phase (e.g., current operation data D3).

[0017] Please refer to Figure 2 as well. During the prediction phase, the behavior detection unit 110 is adapted to detect the current operation behavior OP1 of the computer device 10 to obtain the current operation data D3 corresponding to the current operation behavior OP1. For example, the current operation data D3 may be the abnormal system resource usage status detected in real time, such as abnormally high load on the central processing unit or memory, abnormal network connection status, or the detection of unauthorized access to user privacy settings change records.

[0018] In one embodiment, the personalized control unit 12 can control the system setting value VS of the computer device 10 in response to the control command CI input by the user. The behavior detection unit 110 can obtain the system setting value VS as current operation data D3 and provide it to the behavior judgment unit 140 to determine whether the current operation behavior is abnormal.

[0019] The behavior judgment unit 140 is electrically coupled to the behavior detection unit 110 and the storage unit 130, and is adapted to acquire the current operation data D3 and process the current operation data D3 to generate the data to be predicted D4. The aforementioned conversion method from the current operation data D3 to the data to be predicted D4 is similar to the aforementioned conversion method from the user operation data D1 to the training data D2 during the training phase.

[0020] The behavior judgment unit 140 inputs the data to be predicted, D4, into the trained behavior model M2 to obtain a classification result, R1. This classification result, R1, can be used to confirm whether the current operation behavior OP1 is an abnormal behavior. When it is confirmed that the current operation behavior OP1 is an abnormal behavior, the behavior judgment unit 140 generates a trigger message ST to trigger the alarm unit 150 to activate.

[0021] The warning unit 150 is electrically coupled to the behavior judgment unit 140 and is adapted to receive the trigger message ST and generate an abnormal behavior prompt message NS accordingly. This abnormal behavior prompt message NS may, for example, be a warning screen, a warning light, or a warning sound.

[0022] In one embodiment, the user can further confirm the accuracy of the judgment result of the behavior model M1 based on the abnormal behavior prompt message NS and provide feedback to the behavior model M1. The training unit 120 can obtain this data to continuously train (fine-tune) the behavior model M1.

[0023] In the embodiments shown in the first and second figures above, the security protection system 100 alerts the user to abnormal behavior through an abnormal behavior prompt signal generated by the warning unit 150. However, this invention is not limited to this.

[0024] In actual use, sometimes the user is not near the computer device 10, or is delayed by other matters and cannot respond in time to the abnormal behavior prompts generated by the warning unit 150. The third figure is a block diagram of a security protection system 300 provided according to another embodiment of this case.

[0025] As shown in the figure, this security protection system 300 includes a behavior model M1, a behavior detection unit 310, a training unit 320, a storage unit 330, a behavior judgment unit 340, an alert unit 350, and a protective action execution unit 360.

[0026] The protective action execution unit 360 is electrically coupled to the behavior judgment unit 340. When the behavior judgment unit 340 confirms that the current operation behavior OP1 is abnormal, the behavior judgment unit 340 immediately notifies the protective action execution unit 360 to control the computer device 10 to shut down, log out the user, or disconnect the network connection of the computer device 10 through the control console of the computer device 10, so as to avoid the abnormal behavior from causing harm to the computer device 10. The above three security protection actions are only illustrative examples. Depending on the actual needs, the protective operations that the protective action execution unit 360 can perform are not limited to these.

[0027] Other components of the security protection system 300 in this embodiment, such as the behavior model M1, behavior detection unit 310, training unit 320, storage unit 330, behavior judgment unit 340, and warning unit 350, are similar to the embodiments shown in the first and second figures, and will not be described in detail here.

[0028] In addition, it is worth noting that before the behavioral model M1 provided in the aforementioned embodiments completes training (that is, during the training phase), the computer device 10 uses its own other security protection mechanisms, such as data backup and protection mechanisms (such as data compression, backup storage, and restore tools), resource monitoring modules (such as central processing unit monitoring, memory monitoring, and network monitoring), privacy protection modules (such as folder encryption, application locking, and screen and keyboard monitoring), and core protection modules (such as malware scanning, intrusion detection, and secure deletion functions) for protection.

[0029] Once the behavior model M1 provided in the aforementioned embodiments has been trained, it can provide additional security protection functions for monitoring abnormal behavior in addition to the security protection mechanisms already present in the computer device 10, thereby enhancing the protection of user privacy and effectively making up for the deficiencies of traditional security protection mechanisms.

[0030] Figure 4 is a flowchart of a security protection method provided according to an embodiment of this case. This security protection method can be executed by the security protection system 100 shown in Figures 1 and 2. This security protection system 100 can be installed on a computer device 10. This computer device 10 can be a desktop computer, a laptop computer, a tablet computer, a smartphone, or other terminal device. However, it is not limited to these. In other embodiments, this computer device 10 can also be a server.

[0031] As shown in the figure, the security protection method in this embodiment can be divided into a training phase and a prediction phase.

[0032] During the training phase, firstly, as described in step S410, user operation data D1 from computer device 10 is acquired. Subsequently, as described in step S420, the user operation data D1 is processed to generate training data D2. Specifically, step S420 involves converting the user operation data D1 acquired by computer device 10 into training data D2 suitable for training behavior model M1.

[0033] Then, as described in step S430, a behavior model M1 is trained using the training data D2. After confirming that the behavior model M1 has completed training, as described in step S440, the trained behavior model M2 is stored.

[0034] The aforementioned user operation data D1 may include system resource usage data and privacy setting data. System resource usage data refers to the various hardware resource usage and monitoring data generated by the computer device during operation. For example, system resource usage data may include processor load information, memory usage, storage device read / write frequency, network traffic, and connection status information. Privacy setting data refers to the relevant setting information generated by the user to control and set personal privacy. For example, privacy setting data may include system permission setting data, personal data sharing setting status, and the on / off status of peripheral devices (such as microphones and cameras). The aforementioned steps S420 to S440 may be executed by the training unit 120 in the first figure.

[0035] In the prediction phase, firstly, as described in step S450, the current operation behavior OP1 of the computer device 10 is detected, and the current operation data D3 corresponding to the current operation behavior OP1 is acquired. Subsequently, as described in step S460, the current operation data D3 is processed to generate the data to be predicted D4. Specifically, step S460 is to convert the current operation data D3 acquired by the computer device 10 into the data to be predicted D4 suitable for input behavior model M2 for prediction.

[0036] Next, as described in step S470, the trained behavior model M2 is used to determine whether the current operation behavior OP1 is an abnormal behavior. In one embodiment, step S470 involves inputting the data to be predicted D4 into the trained behavior model M2 and determining whether the current operation behavior OP1 is an abnormal behavior based on the output of the behavior model M2. This step can be performed by the behavior judgment unit 140 in the first figure in conjunction with the trained behavior model M2.

[0037] If the current operation OP1 is confirmed to be abnormal, the process proceeds to step S480, generating an abnormal behavior prompt message NS. This step can be executed by the warning unit 150 in the first figure. Conversely, if the current operation OP1 is confirmed not to be abnormal, the process returns to step S450 and continues to monitor the computer device 10.

[0038] Figure 5 is a flowchart of a security protection method provided according to another embodiment of this case. This security protection method can be executed by the security protection system 100 shown in Figure 3. This security protection system 100 can be installed on a computer device 10.

[0039] As shown in the figure, the security protection method in this embodiment can be divided into a training phase and a prediction phase.

[0040] During the training phase, firstly, as described in step S510, user operation data D1 of computer device 10 is acquired. Subsequently, as described in step S520, the user operation data D1 is processed to generate training data D2.

[0041] Then, as described in step S530, a behavior model M1 is trained using the training data D2. After confirming that the behavior model M1 has completed training, as described in step S540, the trained behavior model M2 is stored. The aforementioned steps S520 to S540 can be executed by the training unit 120 in the third figure.

[0042] In the prediction phase, firstly, as described in step S550, the current operation behavior OP1 of the computer device 10 is detected, and the current operation data D3 corresponding to the current operation behavior OP1 is obtained. Subsequently, as described in step S560, the current operation data D3 is processed to generate the data to be predicted D4.

[0043] Next, as described in step S570, the data to be predicted, D4, is input into the trained behavior model M2 to confirm whether the current operation behavior OP1 is an abnormal behavior. This step can be performed by the behavior judgment unit 140 in the third figure in conjunction with the trained behavior model M2.

[0044] If the current operation OP1 is confirmed to be abnormal, as shown in step S580, an abnormal behavior prompt message NS is generated and a security protection action is executed. This step can be executed by the warning unit 150 and the protection action execution unit 360 in the third figure. For example, this security protection action could be to shut down the computer device 10, log out the user, or disconnect the network connection of the computer device 10. However, it is not limited to these.

[0045] Conversely, if it is confirmed that the current operation OP1 is not abnormal, the process returns to step S550 and continues to monitor computer device 10.

[0046] Existing computer security systems 100 (especially standalone systems) lack sufficient real-time detection and response capabilities when facing increasingly complex network threats, making it difficult to effectively protect user privacy and system security. In contrast, the security protection method and system 100 provided in this case can obtain user operation data D1 from the computer device 10 to train a behavioral model M1, and use the trained behavioral model M2 to confirm whether the current operation behavior OP1 of the computer device 10 is abnormal. In this way, malicious users and unauthorized operation behaviors can be identified based on changes in the operating mode of the computer device 10, preventing malicious software from monitoring screen and keyboard input or accessing data without authorization.

[0047] The above are merely preferred embodiments of this case and do not limit the scope of this case in any way. Any equivalent substitutions or modifications made by those skilled in the art to the technical means and content disclosed in this case without departing from the scope of the technical means of this case shall be deemed to have remained within the scope of protection of this case.

[0048] 10: Computer devices 12: Personalized control unit 100, 300: Security Protection System 110,310: Behavior Detection Unit 120, 320: Training units 130, 330: Storage Unit 140, 340: Behavioral Judgment Unit 150, 350: Warning Unit 360: Protective Action Execution Unit OT: Training operational behavior D1: User Operation Data D2: Training Materials CI: Control Commands VS: System Settings OP1: Current operation behavior D3: Current Operation Data D4: Data to be predicted R1: Classification result ST: Trigger Message NS: Abnormal Behavior Alerts M1, M2: Behavioral Models S410, S420, S430, S440, S450, S460, S470, S480, S510, S520, S530, S540, S550, S560, S570, S580: Steps

Claims

1. A security protection method, executed by a computer device, the security protection method comprising: acquiring user operation data of the computer device; processing the user operation data to generate training data; training a behavior model using the training data; storing the trained behavior model; detecting the current operation behavior of the computer device to acquire current operation data corresponding to the current operation behavior; processing the current operation data to generate prediction data; inputting the prediction data into the trained behavior model to confirm whether the current operation behavior is an abnormal behavior; and if the current operation behavior is confirmed to be the abnormal behavior, generating an abnormal behavior prompt message, wherein the user operation data includes privacy setting data, the privacy setting data referring to system settings and authorization status related to the user's personal privacy.

2. The security protection method as described in claim 1, wherein, This user operation data includes system resource usage information.

3. The security protection method as described in claim 1, wherein, If the current operation is confirmed to be abnormal, it may include shutting down the computer device.

4. The security protection method as described in claim 1, wherein, If the current operation is confirmed to be abnormal, it also includes logging out the user on the computer device.

5. The security protection method as described in claim 1, wherein, If the current operation is confirmed to be abnormal, it may include disconnecting the computer device from the network.

6. The security protection method as described in claim 1, wherein, This computer device is a terminal device.

7. The security protection method as described in claim 1, wherein, This behavioral model is a support vector machine (SVM) model.

8. The security protection method as described in claim 1, wherein, The computer device has a humanized control unit adapted to control a system setting value of the computer device in response to a control command input by the user; wherein, acquiring the user operation data of the computer device is to acquire the system setting value as the user operation data.

9. A security protection system for a computer device, the security protection system comprising: a behavior model; a behavior detection unit adapted to detect a training operation behavior of the computer device during a training phase to obtain user operation data corresponding to the training operation behavior, and adapted to detect a current operation behavior of the computer device during a prediction phase to obtain current operation data corresponding to the current operation behavior, wherein the user operation data includes privacy setting data, the privacy setting data referring to system settings and authorization status related to user personal privacy; a training unit electrically coupled to the behavior detection unit and the behavior model, adapted to process the user operation data to generate training data, and to train the behavior model using the training data; and a storage unit adapted to store the trained behavior model. A behavior determination unit, electrically coupled to the behavior detection unit and the storage unit, is adapted to process the current operation data to generate prediction data, input the prediction data into the trained behavior model to confirm whether the current operation behavior is an abnormal behavior, and generate a trigger message when the current operation behavior is confirmed to be an abnormal behavior; and an alert unit, electrically coupled to the behavior determination unit, is adapted to receive the trigger message and generate an abnormal behavior prompt message accordingly.

10. The security protection system as described in claim 9, wherein, This user operation data includes system resource usage information.

11. The security protection system as described in claim 9 further includes a protection action execution unit electrically coupled to the behavior determination unit, adapted to receive the trigger message and thereby control the computer device to shut down.

12. The security protection system as described in claim 9, wherein, This computer device is a terminal device.

13. The security protection system as described in claim 9, wherein, This behavioral model is a support vector machine (SVM) model.

14. The security protection system as described in claim 9, wherein, The computer device has a personalized control unit adapted to control a system setting value of the computer device in response to a control command input by the user. The training unit is electrically coupled to the personalized control unit and adapted to acquire the system setting value as the user's operating data.

Images