CN108764481A - A kind of information security ability evaluating method and system based on mobile terminal behavior - Google Patents

Abstract

A kind of the information security ability evaluating method and system based on mobile terminal behavior that the embodiment of the present invention proposes, pass through the behavioral data according to mobile terminal when users use, user information safety ability is evaluated and tested, it solves the problems, such as the unicity of existing information security capabilities evaluating method and evaluates comprehensive insufficient, emphasis considers importance of the objective behavior to ontological analysis so that information security ability evaluation result is with true and reliable.

Description

A method and system for evaluating information security capabilities based on mobile terminal behavior

technical field

The embodiments of the present invention relate to the technical field of information security capability evaluation, and in particular to a method and system for evaluating information security capability based on mobile terminal behavior.

Background technique

Information security capability is an indispensable basic capability in the rapid development of science and technology. The mobile Internet is the product of the combination of communication network and Internet, which has the characteristics of wireless and portable. Mobile terminals are devices that use the mobile Internet, so mobile terminals are open source and open. As the most popular device among the masses, mobile terminal devices can reflect the user's information security capabilities to a large extent. In recent years, security incidents such as stolen funds and privacy leaks have occurred frequently, seriously threatening the safety of people's lives and property. In order to avoid security incidents, it is necessary to evaluate information security capabilities, so as to guide individuals with insufficient information security capabilities and improve its information security capabilities. Therefore, the present invention will provide an information security capability evaluation method based on mobile terminal behavior to evaluate individual information security capabilities, find weak points and guide them, thereby improving information security capabilities.

Looking at the existing evaluation technologies, the commonly used methods can be classified into three categories:

1. Questionnaire survey method

Questionnaire survey is a commonly used method for evaluating users' information security capabilities. It can be designed as open, closed, and quantitative form-response, and is generally conducted by interviewing, mailing, and distributing methods. The basic principle of the questionnaire survey method is to choose a survey topic and use the questionnaire as the carrier of the questions that need to be investigated under this topic. The core of this method is to design the questionnaire. The questionnaire design needs to have a reasonable structure, careful logic, and be popular. Easy to understand, not only to achieve the purpose of conveying the questions to the respondents, but also to allow the investigators to answer truthfully. However, the questionnaire survey method mainly relies on the subjective answers of the respondents, lacks objective judgment, and the results obtained may not match the real situation. Moreover, the scope of knowledge involved in the questionnaire is not wide enough, and the survey efficiency is not high.

2. Serious Games

Serious game is a kind of electronic game for the purpose of teaching, providing professional skills training and simulation application, and its core is application elements such as knowledge and skills. The basic principle of this method is to educate and train users in the virtual reality scene, so as to achieve the purpose of training skills, improving professional ability and evaluating their ability. Serious game scenes are three-dimensional and changeable, and can provide users with a learning environment close to the real, with low cost, high benefit, and strong popularity. However, serious games can only be trained or evaluated for a single skill, and the development of information security incidents is changing, making it difficult to keep up with the development of the situation. In addition, the development cost of serious games is relatively high.

3. Test questions assessment

Test questions assessment is on the basis of software development, through the test questions to assess the individual's information security capabilities, to obtain the strength of the user's information security capabilities, and give positive feedback at the end of the test, and recommend learning materials on relevant topics for users' weak content, etc. , guiding and educating users on the knowledge and abilities related to information security. This method can assess the individual's information security ability to a certain extent, but it is difficult to ensure that the individual can perform the specific behavior corresponding to the correct answer in the test questions in daily life.

To sum up, the existing evaluation methods are difficult to better evaluate the information security capability.

Contents of the invention

In order to solve the above technical problems or at least partly solve the above technical problems, embodiments of the present invention provide a method and system for evaluating information security capabilities based on mobile terminal behavior.

In view of this, in the first aspect, the embodiment of the present invention provides an information security capability evaluation method based on mobile terminal behavior, including:

Collect behavior data when the mobile terminal is used by the user;

The behavior data is input into the pre-built information security capability fuzzy comprehensive evaluation model, and the information security capability level corresponding to the behavior data is output.

The construction of the information security capability fuzzy comprehensive evaluation model includes:

Collect multiple historical behavior data samples of mobile terminals;

Determine the security of historical behavior data samples, and establish unsafe behavior evaluation rules for evaluating behavior data security based on the security of historical behavior data samples;

According to the unsafe behavior evaluation rules, a fuzzy comprehensive evaluation model of information security capability is constructed.

Determine the security of historical behavior data samples, and establish unsafe behavior evaluation rules for evaluating behavior data security based on the security of historical behavior data samples, including:

Obtain preset dynamic behavior conditions and static behavior conditions;

According to the dynamic behavior conditions and the static behavior conditions, the historical behavior data samples are divided into dynamic behavior data samples and static behavior data samples;

determining the security of the dynamic behavior data sample and the static behavior data sample according to the prior knowledge database;

According to the security of dynamic behavior data samples and the security of static behavior data samples, dynamic unsafe behavior evaluation rules and static unsafe behavior evaluation rules are established.

Construct a fuzzy comprehensive evaluation model of information security capabilities according to the unsafe behavior evaluation rules, including:

Determine the evaluation indicators according to the unsafe behavior evaluation rules;

Constructing an information security capability evaluation index system and an evaluation set according to the evaluation indicators, and the evaluation set is used to evaluate the results obtained by the information security capability evaluation index system;

Establish the weight set of evaluation indicators in the information security capability evaluation index system;

Establish the membership degree of the evaluation index in the information security capability evaluation index system;

A fuzzy comprehensive evaluation matrix is constructed according to the weight set and the degree of membership.

Input the behavior data into the pre-built information security capability fuzzy comprehensive evaluation model, and output the information security capability level corresponding to the behavior data, including:

Input the behavior data into the pre-built information security capability fuzzy comprehensive evaluation model, and calculate the information security capability index through the information security capability evaluation index system;

According to the corresponding relationship between the preset information security capability index and the evaluation set, determine the information security capability level.

The elements of the evaluation set include four levels of information security capabilities: weak information security capabilities, general information security capabilities, strong information security capabilities, and strong information security capabilities.

Said behavioral data includes:

Call behavior, SMS behavior, hotspot connection behavior, application installation behavior, application running behavior, positioning behavior and network interaction behavior.

In the second aspect, the embodiment of the present invention also provides an information security capability evaluation system based on mobile terminal behavior, including:

The collection module is used to collect behavior data when the mobile terminal is used by the user;

An evaluation module, configured to input the behavior data into a pre-built information security capability fuzzy comprehensive evaluation model, and output an information security capability level corresponding to the behavior data.

The evaluation module includes a modeling sub-module for constructing a fuzzy comprehensive evaluation model of information security capability;

The modeling submodules include:

A collection unit, configured to collect a plurality of historical behavior data samples of the mobile terminal;

A rule unit is used to determine the security of historical behavior data samples, and establish unsafe behavior evaluation rules for evaluating the security of behavior data according to the security of historical behavior data samples;

A modeling unit, configured to construct a fuzzy comprehensive evaluation model of information security capabilities according to the unsafe behavior evaluation rules.

The rule unit includes:

Obtaining subunits for obtaining preset dynamic behavior conditions and static behavior conditions;

Dividing subunits for dividing the historical behavior data samples into dynamic behavior data samples and static behavior data samples according to the dynamic behavior conditions and static behavior conditions;

A determination subunit is used to determine the security of the dynamic behavior data samples and the static behavior data samples according to the prior knowledge database;

A subunit is established for establishing dynamic unsafe behavior evaluation rules and static unsafe behavior evaluation rules according to the security of dynamic behavior data samples and the security of static behavior data samples.

In the third aspect, the embodiment of the present invention also proposes a non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the computer described in the first aspect. method steps.

Compared with the existing technology, an information security capability evaluation method based on mobile terminal behavior proposed by the embodiment of the present invention solves the problem of existing information security by evaluating the user information security capability according to the behavior data of the mobile terminal when the user uses it. The singleness of the security capability evaluation method and the lack of comprehensiveness of the evaluation focused on the importance of objective behavior for ontology analysis, making the information security capability evaluation results authentic and reliable;

Compared with the questionnaire survey method, the present invention collects the behavior data of the user's mobile terminal, increases the objective judgment, and the obtained result will be closer to the real situation, and the efficiency is higher;

Compared with serious games, the present invention collects multi-level mobile terminal data, which involves a wide range, strong real-time performance, effectively reflects the user's information security capabilities in the current state, and has low cost;

Compared with examination questions, the present invention can evaluate information security capabilities based on user behavior, instead of relying on subjective answers, and has higher accuracy.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only some of the present invention. Embodiments, for those of ordinary skill in the art, other drawings can also be obtained according to these drawings without paying creative labor.

Fig. 1 is a flow chart of a method for evaluating information security capabilities based on mobile terminal behavior provided by the present invention;

FIG. 2 is a schematic diagram of an information security capability evaluation system based on mobile terminal behavior provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

As shown in Figure 1, Figure 1 is a method for evaluating information security capabilities based on mobile terminal behavior provided by the present invention, which may include the following steps:

Collect behavior data when the mobile terminal is used by the user;

The behavior data is input into the pre-built information security capability fuzzy comprehensive evaluation model, and the information security capability level corresponding to the behavior data is output.

The construction of the information security capability fuzzy comprehensive evaluation model includes:

Collect multiple historical behavior data samples of mobile terminals;

Determine the security of historical behavior data samples, and establish unsafe behavior evaluation rules for evaluating behavior data security based on the security of historical behavior data samples;

According to the unsafe behavior evaluation rules, a fuzzy comprehensive evaluation model of information security capability is constructed.

Determine the security of historical behavior data samples, and establish unsafe behavior evaluation rules for evaluating behavior data security based on the security of historical behavior data samples, including:

Obtain preset dynamic behavior conditions and static behavior conditions;

According to the dynamic behavior conditions and the static behavior conditions, the historical behavior data samples are divided into dynamic behavior data samples and static behavior data samples;

determining the security of the dynamic behavior data sample and the static behavior data sample according to the prior knowledge database;

According to the security of dynamic behavior data samples and the security of static behavior data samples, dynamic unsafe behavior evaluation rules and static unsafe behavior evaluation rules are established.

Construct a fuzzy comprehensive evaluation model of information security capabilities according to the unsafe behavior evaluation rules, including:

Determine the evaluation indicators according to the unsafe behavior evaluation rules;

Constructing an information security capability evaluation index system and an evaluation set according to the evaluation indicators, and the evaluation set is used to evaluate the results obtained by the information security capability evaluation index system;

Establish the weight set of evaluation indicators in the information security capability evaluation index system;

Establish the membership degree of the evaluation index in the information security capability evaluation index system;

A fuzzy comprehensive evaluation matrix is constructed according to the weight set and the degree of membership.

Input the behavior data into the pre-built information security capability fuzzy comprehensive evaluation model, and output the information security capability level corresponding to the behavior data, including:

Input the behavior data into the pre-built information security capability fuzzy comprehensive evaluation model, and calculate the information security capability index through the information security capability evaluation index system;

According to the corresponding relationship between the preset information security capability index and the evaluation set, determine the information security capability level.

The elements of the evaluation set include four levels of information security capabilities: weak information security capabilities, general information security capabilities, strong information security capabilities, and strong information security capabilities.

Said behavioral data includes:

Call behavior, SMS behavior, hotspot connection behavior, application installation behavior, application running behavior, positioning behavior and network interaction behavior.

Based on the same inventive concept, the present invention also provides an information security capability evaluation system based on mobile terminal behavior, as shown in Figure 2, which may include:

The collection module is used to collect behavior data when the mobile terminal is used by the user;

An evaluation module, configured to input the behavior data into a pre-built information security capability fuzzy comprehensive evaluation model, and output an information security capability level corresponding to the behavior data.

The evaluation module includes a modeling sub-module for constructing a fuzzy comprehensive evaluation model of information security capability;

The modeling submodules include:

A collection unit, configured to collect a plurality of historical behavior data samples of the mobile terminal;

A rule unit is used to determine the security of historical behavior data samples, and establish unsafe behavior evaluation rules for evaluating the security of behavior data according to the security of historical behavior data samples;

A modeling unit, configured to construct a fuzzy comprehensive evaluation model of information security capabilities according to the unsafe behavior evaluation rules.

The rule unit includes:

Obtaining subunits for obtaining preset dynamic behavior conditions and static behavior conditions;

Dividing subunits for dividing the historical behavior data samples into dynamic behavior data samples and static behavior data samples according to the dynamic behavior conditions and static behavior conditions;

A determination subunit is used to determine the security of the dynamic behavior data samples and the static behavior data samples according to the prior knowledge database;

A subunit is established for establishing dynamic unsafe behavior evaluation rules and static unsafe behavior evaluation rules according to the security of dynamic behavior data samples and the security of static behavior data samples.

In a specific example,

The experimental data is 431 pieces of behavior data of the Android 4.4.1 system real machine from August 2017 to December 2017. The specific process is as follows:

Step 1, collect experimental data such as call behavior, SMS behavior, hotspot connection behavior, application installation and running behavior, positioning behavior and network traffic behavior in mobile terminals.

Step 2, analyze the collected experimental data, and establish unsafe behavior evaluation rules.

Step 2.1, analyze the characteristics of the static behavior corresponding to the abstract concept and the participants in the dynamic behavior, the dynamic behavior and the relationship between the participant and the dynamic behavior, and divide the experimental data into static behavior data and dynamic behavior data.

In step 2.2, find the relationship between static behavior data and dynamic behavior data and information security capabilities, and formulate the unsafe behavior evaluation rules shown in Table 1 through expert consultation and expert knowledge.

Table 1. Unsafe behavior evaluation rules

Step 3: Build a fuzzy comprehensive evaluation model for information security capabilities to evaluate user information security capabilities.

Step 3.1, build an information security capability evaluation index system according to the unsafe behavior evaluation rules, which includes three first-level indicators and fifteen second-level indicators.

Step 3.2, define the information security capability evaluation set as a four-level information security capability level, the evaluation set V = {V ₁ , V ₂ , V ₃ , V ₄ } information security capability is weak, information security capability is average, and information security capability is strong , Strong information security capability}, V(V∈{0,1,2,3}), the strong information security capability of users is recorded as 3, the strong information security capability is recorded as 2, the information security capability is generally recorded as 1, and the information security capability is generally recorded as 1. Weak security capability is recorded as 0.

Step 3.3: Establish a judgment matrix for the first-level index, calculate the weight vector and perform a consistency check. If the consistency check fails, perform parameter correction, and use the value that passes the consistency check as the first-level index weight.

Step 3.4, establish a judgment matrix for the secondary index, calculate the weight vector and perform a consistency check. If the consistency check fails, perform parameter correction, and use the value that passes the consistency check as the weight of the secondary index.

Step 3.5: Issue questionnaires to experts to obtain the membership degree of the evaluation index, construct the fuzzy subset table of the membership degree, and obtain the fuzzy comprehensive evaluation matrix.

Step 3.6, calculate the user's information security capability index according to the following formula, and perform MIN-MAX normalization processing.

P＝W ₁ ×W ₂ ×I (1)

Among them, W ₁ is the weight matrix of the first-level indicators, W ₂ is the weight matrix of the second-level indicators, and I is a single indicator vector under the second-level indicators.

The calculation formula of a single indicator vector in the secondary indicator is as follows:

I=S×R×X (2)

Among them, S is the membership weight vector, R is the fuzzy matrix, X=(0 1 2 3) ^T is the information security capability level vector.

The calculation formula of MIN-MAX normalization processing is as follows:

Among them, P ^* is the normalized value of P, MAX is the maximum value of the index, and MIN is the minimum value of the index.

In step 3.7, classify the information security capability index into four grades: strong information security capability, strong information security capability, general information security capability and weak information security capability. Table 2 is the information security capability index rating table.

Table 2. Information security capability index rating table

Test results: The experiment evaluates the information security capability of a user who uses the Android 4.4.1 system from August 2017 to December 2017 based on the behavior of the mobile terminal, and obtains the results of the user's information security capability during this period. Based on the data of this example, this The method proposed by the invention can increase the evaluation efficiency by 10%-20%.

It should be understood that the embodiments described herein may be implemented by hardware, software, firmware, middleware, microcode or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (Application Specific Integrated Circuits, ASIC), digital signal processor (Digital Signal Processing, DSP), digital signal processing device (DSPDevice, DSPD), programmable logic device (ProgrammableLogicDevice, PLD ), Field-Programmable Gate Array (Field-Programmable GateArray, FPGA), general-purpose processor, controller, microcontroller, microprocessor, other electronic units for performing the functions described in this application, or a combination thereof.

For a software implementation, the techniques described herein are implemented by means of units that perform the functions described herein. Software codes can be stored in memory and executed by a processor. Memory can be implemented within the processor or external to the processor.

Those skilled in the art can appreciate that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present invention.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the embodiments provided in this application, it should be understood that the disclosed devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.

If the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media capable of storing program codes such as U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk.

It should be noted that, in this document, the term "comprising", "comprising" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article or apparatus comprising a set of elements includes not only those elements, It also includes other elements not expressly listed, or elements inherent in the process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus comprising that element.

The above are only preferred embodiments of the present invention, and are not intended to limit the scope of the present invention. Any equivalent structure or equivalent process conversion made by using the description of the present invention and the contents of the accompanying drawings, or directly or indirectly used in other related technical fields, All are equally included in the scope of protection of the present invention.

Claims (10)

1. a kind of information security ability evaluating method based on mobile terminal behavior, which is characterized in that including：

Behavioral data when acquisition mobile terminal is used by a user；

The behavioral data is input to the information security ability fuzzy evaluating model built in advance, output and the behavior The corresponding information security ability rating of data.

2. information security ability evaluating method according to claim 1, which is characterized in that described information security capabilities is fuzzy The structure of comprehensive evaluating model, including：

Acquire multiple historical behavior data samples of mobile terminal；

It determines the safety of historical behavior data sample, and according to the safety of historical behavior data sample, establishes for evaluating and testing The unsafe acts evaluation rule of behavioral data safety；

Information security ability fuzzy evaluating model is built according to the unsafe acts evaluation rule.

3. information security ability evaluating method according to claim 2, which is characterized in that determine historical behavior data sample Safety, and according to the safety of historical behavior data sample, establish the dangerous row for evaluating and testing behavioral data safety For evaluation rule, including：

Obtain preset dynamic behaviour condition and static behavior condition；

According to the dynamic behaviour condition and static behavior condition, the historical behavior data sample is divided into dynamic behaviour number According to sample and static behavior data sample；

The safety of the dynamic behaviour data sample and static behavior data sample is determined according to priori database；

According to the safety of the safety of dynamic behaviour data sample and static behavior data sample, dynamic unsafe acts are established Evaluation rule and static unsafe acts evaluation rule.

4. information security ability evaluating method according to claim 2, which is characterized in that commented according to the unsafe acts Gauge then builds information security ability fuzzy evaluating model, including：

Evaluation index is determined according to unsafe acts evaluation rule；

Information security ability evaluation metrics system is built according to evaluation index and evaluation and test collects, and the evaluation and test collection is for described information The result that security capabilities evaluation metrics system obtains is evaluated；

Establish the weight sets of evaluation metrics in information security ability evaluation metrics system；

Establish the degree of membership of evaluation metrics in information security ability evaluation metrics system；

Fuzzy overall evaluation matrix is built according to the weight sets and degree of membership.

5. information security ability evaluating method according to claim 4, which is characterized in that the behavioral data to be input to The information security ability fuzzy evaluating model built in advance exports corresponding information security ability of the remaining behavioral data etc. Grade, including：

The behavioral data is input to the information security ability fuzzy evaluating model built in advance, passes through information security energy Power evaluation metrics system computing obtains information security Capability index；

According to the correspondence of preset information security Capability index and evaluation and test collection, information security ability grade is determined.

6. information security ability evaluating method according to claim 4 or 5, which is characterized in that the element of the evaluation and test collection , information security ability weak including information security ability be general, information security ability is compared with the strong four information peace of strong, information security ability Full ability grade.

7. according to claim 1-6 any one of them information security ability evaluating methods, which is characterized in that the behavioral data Including：

Call behavior, short message behavior, hot spot connect behavior, are handed over using installation behavior, application operation behavior, positioning behavior and network Mutual behavior.

8. a kind of information security ability evaluating system based on mobile terminal behavior, which is characterized in that including：

Acquisition module, for acquiring behavioral data when mobile terminal is used by a user；

Evaluation and test module, for the behavioral data to be input to the information security ability fuzzy evaluating model built in advance, Output information security ability rating corresponding with the behavioral data.

9. information security ability evaluating system according to claim 8, which is characterized in that the evaluation and test module includes being used for Build the modeling submodule of information security ability fuzzy evaluating model；

The modeling submodule includes：

Collecting unit, multiple historical behavior data samples for acquiring mobile terminal；

Rules unit, the safety for determining historical behavior data sample, and according to the safety of historical behavior data sample, Establish the unsafe acts evaluation rule for evaluating and testing behavioral data safety；

Modeling unit, for building information security ability fuzzy evaluating model according to the unsafe acts evaluation rule.

10. information security ability evaluating system according to claim 9, which is characterized in that the rules unit includes：

Subelement is obtained, for obtaining preset dynamic behaviour condition and static behavior condition；

Subelement is divided, is used for according to the dynamic behaviour condition and static behavior condition, by the historical behavior data sample It is divided into dynamic behaviour data sample and static behavior data sample；

Determination subelement, for determining the dynamic behaviour data sample and static behavior data sample according to priori database This safety；

Subelement is established, the safety of the safety and static behavior data sample according to dynamic behaviour data sample is used for, builds Vertical dynamic unsafe acts evaluation rule and static unsafe acts evaluation rule.