Security system and security method

Abstract

本案提供一種安全防護方法，由一電腦裝置執行，此安全防護方法包含以下步驟。在訓練階段，首先，獲取電腦裝置之使用者操作資料，隨後，利用使用者操作資料訓練一行為模型。在預測階段，利用訓練完成之行為模型確認電腦裝置之一當前操作行為是否為一異常行為。若是確認此當前操作行為是異常行為，產生一異常行為提示訊息。本案並提供一種安全防護系統。

Claims

1. A security protection method, executed by a computer device, the security protection method comprising: acquiring user operation data of the computer device; processing the user operation data to generate training data; training a behavior model using the training data; storing the trained behavior model; detecting the current operation behavior of the computer device to acquire current operation data corresponding to the current operation behavior; processing the current operation data to generate prediction data; inputting the prediction data into the trained behavior model to confirm whether the current operation behavior is an abnormal behavior; and if the current operation behavior is confirmed to be the abnormal behavior, generating an abnormal behavior prompt message, wherein the user operation data includes privacy setting data, the privacy setting data referring to system settings and authorization status related to the user's personal privacy.

2. The security protection method as described in claim 1, wherein, This user operation data includes system resource usage information.

3. The security protection method as described in claim 1, wherein, If the current operation is confirmed to be abnormal, it may include shutting down the computer device.

4. The security protection method as described in claim 1, wherein, If the current operation is confirmed to be abnormal, it also includes logging out the user on the computer device.

5. The security protection method as described in claim 1, wherein, If the current operation is confirmed to be abnormal, it may include disconnecting the computer device from the network.

6. The security protection method as described in claim 1, wherein, This computer device is a terminal device.

7. The security protection method as described in claim 1, wherein, This behavioral model is a support vector machine (SVM) model.

8. The security protection method as described in claim 1, wherein, The computer device has a humanized control unit adapted to control a system setting value of the computer device in response to a control command input by the user; wherein, the user operation data of the computer device is obtained by acquiring the system setting value as the user operation data.

9. A security protection system for a computer device, the security protection system comprising: a behavior model; a behavior detection unit adapted to detect a training operation behavior of the computer device during a training phase to obtain user operation data corresponding to the training operation behavior, and adapted to detect a current operation behavior of the computer device during a prediction phase to obtain current operation data corresponding to the current operation behavior, wherein the user operation data includes privacy setting data, the privacy setting data referring to system settings and authorization status related to user personal privacy; a training unit electrically coupled to the behavior detection unit and the behavior model, adapted to process the user operation data to generate training data, and to train the behavior model using the training data; and a storage unit adapted to store the trained behavior model. A behavior determination unit, electrically coupled to the behavior detection unit and the storage unit, is adapted to process the current operation data to generate prediction data, input the prediction data into the trained behavior model to confirm whether the current operation behavior is an abnormal behavior, and generate a trigger message when the current operation behavior is confirmed to be an abnormal behavior; and an alert unit, electrically coupled to the behavior determination unit, is adapted to receive the trigger message and generate an abnormal behavior prompt message accordingly.

10. The security protection system as described in claim 9, wherein, This user operation data includes system resource usage information.

11. The security protection system as described in claim 9 further includes a protection action execution unit electrically coupled to the behavior determination unit, adapted to receive the trigger message and thereby control the computer device to shut down.

12. The security protection system as described in claim 9, wherein, This computer device is a terminal device.

13. The security protection system as described in claim 9, wherein, This behavioral model is a support vector machine (SVM) model.

14. The security protection system as described in claim 9, wherein, The computer device has a personalized control unit adapted to control a system setting value of the computer device in response to a control command input by the user. The training unit is electrically coupled to the personalized control unit and adapted to acquire the system setting value as the user's operating data.

Images