WO2022151815A1 - 一种终端设备的安全状态判断方法及装置 - Google Patents

一种终端设备的安全状态判断方法及装置 Download PDF

Info

Publication number
WO2022151815A1
WO2022151815A1 PCT/CN2021/128867 CN2021128867W WO2022151815A1 WO 2022151815 A1 WO2022151815 A1 WO 2022151815A1 CN 2021128867 W CN2021128867 W CN 2021128867W WO 2022151815 A1 WO2022151815 A1 WO 2022151815A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
terminal device
training
model
target terminal
Prior art date
Application number
PCT/CN2021/128867
Other languages
English (en)
French (fr)
Inventor
于文海
祖立军
郭伟
乐旭
Original Assignee
***股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ***股份有限公司 filed Critical ***股份有限公司
Publication of WO2022151815A1 publication Critical patent/WO2022151815A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
    • Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Definitions

  • the present invention relates to the technical field of data security, and in particular, to a method and device for judging the security state of a terminal device.
  • Terminal devices involve many application scenarios. For example, the proportion of mobile payment in China is gradually increasing, and more and more terminal devices are participating in mobile payment.
  • the state data of the terminal device can reflect the current security state of the terminal device, so the security state of the terminal device can be determined by collecting the state data of the terminal device.
  • the known threats of the terminal equipment can be checked for security according to the corresponding security judgment model.
  • the security judgment model of file change can be used to judge whether the terminal equipment is safe.
  • the detection of unknown threats with uncertain attack methods is limited.
  • the unknown threat detection of terminal equipment is realized through big data statistical judgment.
  • the state data of terminal equipment is collected first, and then uniformly transmitted to the server. In this way, after the server collects a large amount of state data of terminal equipment, big data statistics can be formed, and then the security state can be judged.
  • the server obtains the status data of a large number of terminal devices it is difficult to ensure that the status data of these terminal devices are not abused. Therefore, how to judge the security state of the terminal device under the condition of ensuring the privacy and security of the state data of the terminal device becomes a difficult problem.
  • the present invention provides a method and device for judging the security state of a terminal device, which solves the problem of how to judge the security state of the terminal device in the prior art under the condition of ensuring the privacy and security of the state data of the terminal device.
  • the present invention provides a method for judging a security state of a terminal device, including:
  • the target terminal device obtains the pending state data of the unknown threat;
  • the target terminal device is any terminal device of a plurality of terminal devices;
  • the target terminal device inputs the to-be-determined status data into a first security status judgment model of an unknown threat, and obtains a first judgment result output by the first security status judgment model;
  • the first security state judgment model is obtained by performing machine learning training on multiple terminal devices and servers based on the labeled data of unknown threats of the multiple terminal devices; wherein, in any round of machine learning training, the multiple Any one of the terminal devices is used to send the local training parameters of this round of machine learning training to the server, and the server is used to fuse the local training parameters of the multiple terminal devices in this round of machine learning training to obtain Fusing the training parameters, and sending the fusion training parameters to the multiple terminal devices, so that the multiple terminal devices update or serve as model parameters of the first security state judgment model based on the fusion training parameters.
  • the first security state judgment model is obtained by performing machine learning training on multiple terminal devices and the server based on the labeled data of unknown threats of the multiple terminal devices, and in any round of machine learning training, any A terminal device only sends the local training parameters of this round of machine learning training to the server, and the server fuses the local training parameters of the multiple terminal devices in this round of machine learning training to obtain the fusion training parameters, so as to make The multiple terminal devices are updated based on the fusion training parameters. In this process, the state data of the multiple terminal devices does not need to be transmitted, so the privacy of the state data will not be leaked. The local training parameters of each terminal device are also considered, so the accuracy of the first security state judgment model is also guaranteed.
  • the target terminal device obtains the state data to be judged of the unknown threat, it inputs the state data to be judged to
  • the first security state judgment model for unknown threats can directly obtain the first judgment result output by the first security state judgment model, and there is no need to upload the state data to be judged to the server, so as to ensure the state data of the terminal device.
  • the judgment of the security status of the terminal device is realized.
  • the target terminal device obtains the labeled data of the unknown threat of the target terminal device in the following manner:
  • the target terminal device acquires the tagged data based on the untagged data.
  • the labeled data is obtained based on the unlabeled data, and then converted into unlabeled data, which retains the characteristics of the unlabeled data of the unknown threat.
  • the target terminal device obtains the labeled data based on the unlabeled data, including:
  • the target terminal device inputs the unlabeled data into at least one second security state judgment model of known threats, and obtains at least one second judgment result output by the at least one second security state judgment model;
  • the target terminal device determines a label value of the unlabeled data according to the at least one second judgment result, so as to convert the unlabeled data into the labeled data.
  • At least one second judgment result is obtained through the at least one second security state judgment model, so that the characteristics of the corresponding known threats can be found, and the labeled data can be obtained more accurately.
  • the target terminal device obtains the labeled data based on the unlabeled data, including:
  • the target terminal device obtains, based on the unlabeled data, according to a preset clustering algorithm, the first cluster clustering data and the second cluster clustering data of the unlabeled data; the data of the first cluster clustering data The amount is less than the data amount of the second cluster cluster data;
  • the target terminal device sets the label value of the first cluster of clustered data as the first label value, and sets the label value of the second cluster of clustered data as the second label value, so that the unlabeled data is set. Converted into the labelled data; the first label value characterizes the data as unsafe data, and the second label value characterizes the data as secure data.
  • the target terminal device obtains the first cluster clustering data and the second cluster clustering data of the unlabeled data according to the preset clustering algorithm based on the unlabeled data, so as to obtain the first cluster clustering data and the second cluster clustering data of the unlabeled data according to the preset clustering algorithm.
  • the amount of data adaptively distinguishes safe data from unsafe data, and labels them, providing a method for automatically setting labels.
  • the target terminal device obtains the first security state judgment model in the following manner:
  • the target terminal device obtains the second local training parameter of the security state training model based on the labeled data of the unknown threat and the first local training parameter of the security state training model;
  • the target terminal device sends the second local training parameter to the server
  • the target terminal device obtains the fusion training parameters from the server; the fusion training parameters are obtained by the server based on local training parameters sent by the multiple terminal devices;
  • the target terminal device re-uses the fusion training parameter as the first local training parameter, and returns the tagging of the target terminal device based on the unknown threat.
  • the target terminal device uses the fusion training parameter as the model parameter of the safety state training model, and uses the safety state training model at this time as the The first safety state judgment model is described.
  • the method further includes:
  • the target terminal device sends the first judgment result to the server.
  • the labeled data of the unknown threats of the multiple terminal devices all have the same data feature dimension.
  • the present invention provides a device for judging a security state of a terminal device, including:
  • the target terminal device is any terminal device of a plurality of terminal devices;
  • a processing module configured to input the state data to be judged into a first security state judgment model of an unknown threat, and obtain a first judgment result output by the first security state judgment model;
  • the first security state judgment model is obtained by performing machine learning training on multiple terminal devices and servers based on the labeled data of unknown threats of the multiple terminal devices; wherein, in any round of machine learning training, the multiple Any one of the terminal devices is used to send the local training parameters of this round of machine learning training to the server, and the server is used to fuse the local training parameters of the multiple terminal devices in this round of machine learning training to obtain Fusing the training parameters, and sending the fusion training parameters to the multiple terminal devices, so that the multiple terminal devices update or serve as model parameters of the first security state judgment model based on the fusion training parameters.
  • the obtaining module obtains the labeled data of the unknown threat of the target terminal device in the following manner:
  • the labeled data is obtained based on the unlabeled data.
  • the obtaining module is specifically used for:
  • a label value of the unlabeled data is determined, so as to convert the unlabeled data into the labeled data.
  • the obtaining module is specifically configured to: based on the unlabeled data and according to a preset clustering algorithm, obtain the first cluster clustering data and the second cluster clustering data of the unlabeled data; The data volume of one cluster of cluster data is less than the data volume of the second cluster of cluster data;
  • the first tag value indicates that the data is unsafe data
  • the second label value indicates that the data is safe data.
  • the obtaining module obtains the first security state judgment model in the following manner:
  • the second local training parameters of the security state training model are obtained; sending the parameters to the server; obtaining fusion training parameters from the server; the fusion training parameters are obtained by the server based on local training parameters sent by the multiple terminal devices;
  • the fusion training parameter is re-used as the first local training parameter, and the labeled data based on the unknown threat and the first data of the security state training model are returned.
  • a local training parameter the step of obtaining the second local training parameter of the security state training model
  • the fusion training parameter is used as the model parameter of the safety state training model, and the safety state training model at this time is used as the first safety state Judgment model.
  • the obtaining module is further configured to: send the first judgment result to the server.
  • the labeled data of the unknown threats of the multiple terminal devices all have the same data feature dimension.
  • the present invention provides a computer device, including a program or an instruction, which, when the program or instruction is executed, is used to execute the above-mentioned first aspect and each optional method of the first aspect.
  • the present invention provides a storage medium including a program or an instruction, which, when the program or instruction is executed, is used to execute the above-mentioned first aspect and each optional method of the first aspect.
  • FIG. 1 is a schematic flowchart of steps of a method for judging a security state of a terminal device according to an embodiment of the present invention
  • FIG. 2 is a schematic structural diagram of a terminal device in a method for judging a security state of a terminal device according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of acquiring the first security state judgment model in a security state judgment method for a terminal device provided by an embodiment of the present invention
  • FIG. 4 is a schematic diagram of the architecture of a cloud service in a method for judging a security state of a terminal device according to an embodiment of the present invention
  • FIG. 5 is a specific flowchart corresponding to a method for judging a security state of a terminal device according to an embodiment of the present invention
  • FIG. 6 is a schematic diagram of implementing federated learning in a terminal device in a method for judging a security state of a terminal device according to an embodiment of the present invention
  • FIG. 7 is a schematic diagram of the implementation of federated learning on the server side in a method for judging a security state of a terminal device according to an embodiment of the present invention
  • FIG. 8 is a schematic diagram of sequence steps corresponding to a method for judging a security state of a terminal device according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of an apparatus for judging a security state of a terminal device according to an embodiment of the present invention.
  • an embodiment of the present invention provides a method for judging a security state of a terminal device.
  • Step 101 The target terminal device acquires the status data of unknown threats to be determined.
  • the target terminal device is any terminal device of multiple terminal devices.
  • Step 102 The target terminal device inputs the to-be-determined status data into a first security status judgment model of an unknown threat, and obtains a first judgment result output by the first security status judgment model.
  • the status data to be determined may be CPU status data, process status data, and the like.
  • the first security state judgment model is obtained by performing machine learning training on multiple terminal devices and servers based on the labeled data of unknown threats of the multiple terminal devices; wherein, in any round of machine learning training, the multiple Any one of the terminal devices is used to send the local training parameters of this round of machine learning training to the server, and the server is used to fuse the local training parameters of the multiple terminal devices in this round of machine learning training to obtain Fusing the training parameters, and sending the fusion training parameters to the multiple terminal devices, so that the multiple terminal devices update or serve as model parameters of the first security state judgment model based on the fusion training parameters.
  • the labeled data of the unknown threats of the multiple terminal devices all have the same data feature dimension.
  • the above machine learning method is not limited, for example, horizontal federated learning can be used.
  • steps 101 to 102 in order to solve the problem of using private data, it is ensured that the private data of the terminal device will not be uploaded to the cloud during the training of the first security state judgment model, but only used in the terminal device. Therefore, from the technical framework, the methods of steps 101 to 102 ensure that private data will not be leaked and used maliciously.
  • the above-mentioned machine learning method not only solves the problem of privacy data uploading, but also provides an iterative method for the unknown threat model of the terminal device.
  • unknown threats are difficult to be captured due to the large dimensions of the collected data and the unknown purpose.
  • data of more dimensions can be collected.
  • the training of the model can be localized, so as to continuously train and iterate the security state judgment model on the terminal side.
  • the target terminal device obtains the tagged data of the unknown threat of the target terminal device in the following manner:
  • Step (1) The target terminal device acquires unlabeled data of unknown threats of the target terminal device.
  • Step (2) the target terminal device acquires the labeled data based on the unlabeled data.
  • tags can be added to the unlabeled data in different ways, so as to obtain the tagged data.
  • step (2) may specifically be:
  • the target terminal device inputs the unlabeled data into at least one second security state judgment model of known threats, and obtains at least one second judgment result output by the at least one second security state judgment model;
  • the target terminal device determines a label value of the unlabeled data according to the at least one second judgment result, so as to convert the unlabeled data into the labeled data.
  • the at least one second security state judgment model is three second security state judgment models, and the three second security state judgment models are respectively used for: The second security state judging model for threats on the B side, and the second security state judging model for detecting the threats on the C side.
  • step (2) may specifically be:
  • the target terminal device obtains, based on the unlabeled data, according to a preset clustering algorithm, the first cluster clustering data and the second cluster clustering data of the unlabeled data;
  • the label value of the clustered data is set as the first label value
  • the label value of the second clustered data is set as the second label value, thereby converting the unlabeled data into the labeled data.
  • the data volume of the first cluster of clustering data is smaller than the data volume of the second cluster of clustering data; the first label value indicates that the data is unsafe data, and the second label value indicates that the data is safe data.
  • the unlabeled data includes 1 million pieces of data, after clustering, a second cluster of clustered data, including 950,000 pieces of data, and a first cluster of clustered data, including 40,000 pieces of data, and 10,000 are isolated points; then based on a principle, more data is normal, and a small number of data is abnormal, the second cluster cluster data is judged to be safe data, the label value is set to the second label value, and the first If a cluster of cluster data is safe data, the label value is set as the first label value.
  • step 102 the following steps may also be performed:
  • the target terminal device sends the first judgment result to the server.
  • the target terminal device is an intelligent payment device, its structure is as shown in FIG. 2 .
  • Figure 2 is the system frame diagram of the terminal device.
  • the core functions of the terminal device system are mainly divided into four parts: data collection, model determination, model learning, and data upload. details as follows:
  • the data collection module is mainly responsible for collecting the data information of the terminal equipment. It contains known threat data and unknown threat data. Known threat data includes root detection, hook framework detection, simulator environment detection, etc. The unknown threat data is the data related to the system running. These data cannot clearly determine the malicious state of the system, but when the system is attacked, the data will change. Unknown threat data reflects the current security status of terminal equipment from the perspective of system status changes. Such as CPU status data, memory status data, process status data, etc.
  • Model judgment The model judgment module mainly uses the data collected by the data acquisition module to judge the safety state. It includes a known threat judgment model (ie, the second security judgment model) and an unknown threat judgment model (ie, the first security judgment model).
  • the unknown threat determination model is trained by machine learning, so it can also be cold-started, as shown in Figure 2 as an initial model, which is simulated by simulation data in a laboratory environment.
  • Figure 3 depicts the process of training an initial model in a laboratory environment.
  • training data needs to be simulated for actual security scenarios, including normal behavior data and abnormal behavior data.
  • the normal behavior data describes the state and data value under which the terminal device can be considered safe; on the contrary, the abnormal behavior data describes the terminal device data value under which the terminal is unsafe.
  • the algorithm engineer will create an algorithm model based on the understanding of the data, input the simulation data into the algorithm model, and then adjust the model according to the results, and finally obtain an initial unknown threat judgment model that matches the simulation data results.
  • This model is used for cold start of end devices.
  • Model learning Another core module in the terminal device is the model learning module. This module is responsible for the end-device part of federated learning. A very important part of federated learning is the iteration of the model. During the iteration, the model training of the terminal device provides model data for the back-end learning. However, if federated learning is used, the specific machine learning algorithm must be a supervised learning algorithm. Therefore, data and corresponding labels must be provided during model training.
  • the data module collects a large amount of data as data input of unknown threats.
  • These data can be divided into several dimensions, such as: environmental security data (WIFI address information, base station information, IP address information), hardware security data Data (debug port usage, CPU usage status, memory usage status, etc.), traffic security data (egress traffic data, import traffic data) and software security data (system process status, software business data, etc.).
  • environmental security data WIFI address information, base station information, IP address information
  • hardware security data Data debug port usage, CPU usage status, memory usage status, etc.
  • traffic security data egress traffic data, import traffic data
  • software security data system process status, software business data, etc.
  • One way of labeling is to label the output of the known threat module.
  • the output of the known threat is a score. This method is relatively simple and intuitive, and can directly train the unknown threat data.
  • Data upload The main function of the data upload module is to upload the unknown threat determination model trained by the terminal device to the cloud.
  • the terminal device also has some non-private or deprived data that needs the cloud to assist in the determination.
  • the data upload module is a communication module for data exchange between the terminal device and the cloud.
  • the target terminal device obtains the first security state judgment model in the following manner:
  • the fusion training parameters are obtained by the server based on local training parameters sent by the multiple terminal devices.
  • the state training model is used as the first safe state judgment model.
  • the above process is a training and learning process inside the terminal device.
  • the framework diagram of cloud services also has matching functional modules, taking federated learning as an example, as shown in Figure 4.
  • Figure 4 is a framework diagram of a cloud service. It includes several core functional modules: cloud threat determination module, federated learning module, data storage module, and external interface module.
  • Cloud threat determination module Since a large amount of data is determined and trained in terminal devices, there are still a small number of data terminal devices that cannot be fully determined by themselves, such as public network IP data. For some equipment, the movement of the equipment itself is a very serious security problem, such as intelligent automatic receiving cabinets. Therefore, the cloud needs to monitor whether the public network IP information of the terminal device has changed. As mentioned above, although a large amount of data is judged and trained on terminal devices through federated learning for privacy protection reasons in this solution, there is still a small amount of data that must be judged in the cloud. Therefore, from the perspective of the integrity of the solution, there must be a cloud threat determination module in the cloud, that is to say, the cloud threat determination module is used to determine the data other than the state data of the terminal device, such as the network data of the terminal device.
  • the main function of the federated learning module of the terminal device is to input the data of the terminal device, and the output is the judgment model for the terminal device data.
  • the federated learning module in the cloud is to train the model uploaded by the terminal device.
  • the input of this module is the model uploaded by the terminal device, and the output is a new model trained on these input models.
  • the federated learning module in the cloud controls the entire federated learning process.
  • the training of the federated learning model of the terminal device will not be carried out in real time. First, because the amount of real-time training data is small, it cannot have a good effect. Second, because the model training will consume more system resources. Therefore, it is generally selected late at night to train the data accumulated in one day.
  • the frequency of the federated learning process in steps 101 to 102 is once a day.
  • the terminal device needs to negotiate with the cloud to confirm whether the current terminal device joins the current round of federated learning process.
  • the cloud will filter according to certain conditions and select a sufficient number of terminal devices to participate in the federated learning process.
  • Data storage module The data, models, logs, and judgment results of the cloud will be stored in the database in a unified and structured manner. Of course, for the convenience of using the data, a copy of the hot data can be backed up to redis to facilitate access by other modules.
  • the data storage module provides relevant data to the external interface module for use.
  • External interface module The main function of this module is to provide business users. For example, the service user queries the security score of the terminal device and obtains the detailed information of each security dimension.
  • This module provides data to the outside world in two ways. One can be in the form of a page, which directly displays the status of all terminal devices through the page; Specific information about each security dimension.
  • the cloud also has some conventional functions, such as terminal device log monitoring, terminal device crash processing, etc.
  • the cloud judgment module, conventional service module, storage module and external interface module in the cloud can be replaced or deleted without affecting the core functions of the entire solution.
  • the core function of the cloud is federated learning, so the cloud frame diagram can only include the federated learning model in the most extreme cases.
  • FIG. 5 a specific process of a method for judging a security state of a terminal device provided by an embodiment of the present invention may be as shown in FIG. 5 .
  • Step 501 In the laboratory environment, the algorithm engineer constructs a model algorithm by understanding the model of the simulated unknown threat data, and trains the initial unknown threat judgment model through the simulated positive and negative samples. This model is used for the unknown threat judgment model of the terminal equipment. cold start.
  • Step 502 The initial unknown threat determination model generated in step 501 needs to be deployed in each terminal device before the terminal is actually used online, to ensure that the unknown threat determination model can take effect when the security situational awareness function is used.
  • Step 503 This step enters the loop processing of terminal security situational awareness.
  • the terminal data When the terminal device is actually running, the terminal data will be collected at regular intervals for threat determination. A portion of this data is used for known threat determination.
  • known threats refer to common attack methods such as rooted mobile phones and hook frameworks. Another part of the data will be determined for unknown threats.
  • the determination model of unknown threats here is the model generated by the laboratory in the first step.
  • Step 504 When the specified time arrives and the current terminal is selected by the cloud to be the terminal of this round of federated learning process, the data collected on that day is processed, and the training data set is collected using the judgment result of known threats as a label. The complete set of data is used as data. Input it into the learning framework of the terminal, train the local unknown threat model, and clear the data of the day after the training is completed. In addition, if the current terminal is not selected by the cloud to be the participating terminal in this round of federated learning process, the data stored on the day needs to be cleared immediately.
  • Step 505 After the training of each terminal participating in the federated learning is completed, each terminal uploads the locally trained model to the cloud, and the cloud needs to wait for the terminal's model to be uploaded. There may be cases where the terminal training fails, or the terminal network is disconnected and cannot be uploaded. If the number of terminal models obtained by the cloud does not meet a threshold condition, this round of federated learning fails. If the threshold conditions are met, the federated learning in the cloud is started, and the model uploaded by the terminal is trained by the federated learning module of the cloud server.
  • Step 506 The federated learning module in the cloud is usually trained in an independent hardware environment, because machine learning may require CPU acceleration. Therefore, the real federated learning training module and control logic in the cloud are often separated.
  • the control logic inputs the unknown threat model uploaded by the terminal into the federated learning training module, and outputs an optimized unknown threat judgment model after the learning is completed.
  • Step 507 After completing the federated learning process on the cloud, the cloud will deliver the optimized unknown threat determination model to all online terminal devices. After the terminal device obtains the updated unknown threat determination model delivered by the cloud, the new model Replace the original old model and complete the deployment and use of the new model.
  • Steps 503 to 507 will be executed cyclically every day until the model is stable.
  • the function of federated learning is implemented in the form of SDK, which communicates with the detection module through API.
  • the data generated by data collection and terminal threat determination will be stored in a data warehouse established by the terminal.
  • the federated learning SDK accesses the data warehouse through API.
  • the data in the terminal, and the state and process control module controls the training process of the terminal. After the terminal model training is completed, it needs to be uploaded to the cloud server through the communication module. However, before transmission, in order to ensure the security of the model data, it is also necessary to encrypt the model through the encryption and decryption module.
  • the federated learning server After receiving the model data uploaded by the terminal through the cloud communication module, the federated learning server first decrypts the model data through the encryption and decryption module. Before cloud aggregation, the model verification module needs to verify whether the terminal model data is correct. Finally, the model of the terminal device is aggregated and trained through the federated learning aggregation module to generate a new unknown threat judgment model.
  • the step flow of combining the terminal device with the server is shown in FIG. 8 .
  • Step 801 Determine whether the data in the data warehouse is updated, and confirm whether the current terminal device meets the conditions for starting federated learning.
  • Step 802 If the activation conditions are met, the terminal device registers with the server, and informs the server that the current terminal device can perform federated learning.
  • Step 803 When the cloud determines that the number of terminal devices joining the federated learning in this round meets the threshold requirement, the cloud (server side) will notify the terminal device to start the federated learning process of this round.
  • Step 804 When the terminal device receives the process instruction for starting federated learning from the cloud, the federated learning module of the terminal device will read the data in the data warehouse and perform training on the terminal device. After the training is completed, the terminal device uploads the unknown threat judgment model trained in this round to the cloud.
  • Step 805 After starting the federated learning process, the cloud will wait for the model upload of the terminal device. When all terminal devices have uploaded the terminal device model or the number of models uploaded by the terminal device meets the minimum requirements for model aggregation, the cloud will Start the process of model aggregation; otherwise, if the cloud wait times out and the number of models returned by the cloud from the terminal device is not enough to start model aggregation, this round of federated learning will be considered a failure.
  • Step 806 If the cloud model aggregation ends successfully, the cloud will deliver the aggregated model to all terminal devices, and notify all terminal devices to update and deploy the new unknown threat determination model. At this point, the round of federated learning process is over.
  • the present invention provides a device for judging the security state of a terminal device, including:
  • an acquisition module 901 configured to acquire status data to be determined of an unknown threat of a target terminal device;
  • the target terminal device is any terminal device of a plurality of terminal devices;
  • a processing module 902 configured to input the state data to be judged into a first security state judgment model of an unknown threat, and obtain a first judgment result output by the first security state judgment model;
  • the first security state judgment model is obtained by performing machine learning training on multiple terminal devices and servers based on the labeled data of unknown threats of the multiple terminal devices; wherein, in any round of machine learning training, the multiple Any one of the terminal devices is used to send the local training parameters of this round of machine learning training to the server, and the server is used to fuse the local training parameters of the multiple terminal devices in this round of machine learning training to obtain Fusing the training parameters, and sending the fusion training parameters to the multiple terminal devices, so that the multiple terminal devices update or serve as model parameters of the first security state judgment model based on the fusion training parameters.
  • the obtaining module 901 obtains the labeled data of the unknown threat of the target terminal device in the following manner:
  • the labeled data is obtained based on the unlabeled data.
  • the obtaining module 901 is specifically used for:
  • a label value of the unlabeled data is determined, so as to convert the unlabeled data into the labeled data.
  • the obtaining module 901 is specifically configured to: based on the unlabeled data and according to a preset clustering algorithm, obtain the first cluster clustering data and the second cluster clustering data of the unlabeled data; the The data volume of the first cluster cluster data is smaller than the data volume of the second cluster cluster data;
  • the first tag value indicates that the data is unsafe data
  • the second label value indicates that the data is safe data.
  • the obtaining module 901 obtains the first security state judgment model in the following manner:
  • the second local training parameters of the security state training model are obtained; sending parameters to the server; obtaining fusion training parameters from the server; the fusion training parameters are obtained by the server based on local training parameters sent by the multiple terminal devices;
  • the fusion training parameter is re-used as the first local training parameter, and the labeled data based on the unknown threat and the first data of the security state training model are returned.
  • a local training parameter the step of obtaining the second local training parameter of the security state training model
  • the fusion training parameter is used as the model parameter of the safety state training model, and the safety state training model at this time is used as the first safety state Judgment model.
  • the obtaining module 901 is further configured to: send the first judgment result to the server.
  • the labeled data of the unknown threats of the multiple terminal devices all have the same data feature dimension.
  • an embodiment of the present invention also provides a computer device, including a program or an instruction.
  • the program or instruction When the program or instruction is executed, the method for judging the security state of a terminal device provided by the embodiment of the present invention and any possible The selected method is executed.
  • an embodiment of the present invention also provides a computer-readable storage medium, including a program or an instruction, when the program or instruction is executed, such as the method for judging the security state of a terminal device provided by the embodiment of the present invention and the Any optional method is executed.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Health & Medical Sciences (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种终端设备的安全状态判断方法及装置，其中方法为：目标终端设备获取未知威胁的待判断状态数据(101)；所述目标终端设备将所述待判断状态数据输入至未知威胁的第一安全状态判断模型，获得所述第一安全状态判断模型输出的第一判断结果(102)；所述第一安全状态判断模型是多个终端设备及服务端基于所述多个终端设备未知威胁的标签化数据进行机器学习训练得到的。

Description

一种终端设备的安全状态判断方法及装置
相关申请的交叉引用
本申请要求在2021年01月15日提交中国专利局、申请号为202110053180.X、申请名称为“一种终端设备的安全状态判断方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及数据安全技术领域，尤其涉及一种终端设备的安全状态判断方法及装置。
背景技术
终端设备涉及许多应用场景。举例来说，***支付的比例逐渐增加，越来越多的终端设备参与到移动支付中。终端设备的状态数据能够反应出当前终端设备的安全状态，所以可通过采集终端设备的状态数据的方法来判定终端设备的安全状态。
目前的方案中，终端设备的已知威胁可以按照相应的安全判断模型检验是否安全，如针对篡改文件的攻击手段，可以通过文件变更的安全判断模型判断终端设备是否安全。然而，对于不确定的攻击手段的未知威胁检测较为局限。目前终端设备的未知威胁检测，是通过大数据统计判断来实现的。目前是先将终端设备的状态数据采集，然后统一传递给服务端，这样以来服务端采集大量的终端设备的状态数据后，才能形成大数据统计，进而进行安全状态判断。然而，服务端获取到大量终端设备的状态数据后，难以保证这些终端设备的状态数据不被滥用。因此，如何在保证终端设备的状态数据隐私安全的情况下，对终端设备的安全状态进行判断便成为了难题。
发明内容
本发明提供一种终端设备的安全状态判断方法及装置，解决了现有技术中如何在保证终端设备的状态数据隐私安全的情况下，对终端设备的安全状态进行判断的问题。
第一方面，本发明提供一种终端设备的安全状态判断方法，包括：
目标终端设备获取未知威胁的待判断状态数据；所述目标终端设备为多个终端设备的任一终端设备；
所述目标终端设备将所述待判断状态数据输入至未知威胁的第一安全状态判断模型， 获得所述第一安全状态判断模型输出的第一判断结果；
所述第一安全状态判断模型是多个终端设备及服务端基于所述多个终端设备未知威胁的标签化数据进行机器学习训练得到的；其中，在任一轮机器学习训练中，所述多个终端设备中任一终端设备用于将该轮机器学习训练的本地训练参数发送至服务端，所述服务端用于将该轮机器学习训练中所述多个终端设备的本地训练参数融合，获得融合训练参数，并将所述融合训练参数发送至所述多个终端设备，使得所述多个终端设备基于所述融合训练参数更新或作为所述第一安全状态判断模型的模型参数。
上述方式下，所述第一安全状态判断模型是多个终端设备及服务端基于所述多个终端设备未知威胁的标签化数据进行机器学习训练得到的，且在任一轮机器学习训练中，任一终端设备只将该轮机器学习训练的本地训练参数发送至服务端，并由服务端将该轮机器学习训练中所述多个终端设备的本地训练参数融合，获得融合训练参数，从而对使得所述多个终端设备基于所述融合训练参数更新，在该过程中并不需要传递所述多个终端设备的状态数据，所以也不会泄露状态数据的隐私，而每一轮的融合训练参数又都考虑了每个终端设备的本地训练参数，所以也保证第一安全状态判断模型的精确性，因此，目标终端设备获取未知威胁的待判断状态数据后，将所述待判断状态数据输入至未知威胁的第一安全状态判断模型，便可以直接获得所述第一安全状态判断模型输出的第一判断结果，也不需要将待判断状态数据上传至服务端，从而在保证终端设备的状态数据隐私安全的情况下，实现了对终端设备的安全状态的判断。
可选的，所述目标终端设备按照以下方式获得所述目标终端设备的未知威胁的标签化数据：
所述目标终端设备获取所述目标终端设备的未知威胁的无标签数据；
所述目标终端设备基于所述无标签数据获取所述标签化数据。
上述方法中，获取所述目标终端设备的未知威胁的无标签数据后，再基于所述无标签数据获取所述标签化数据，到转换为无标签数据，保留了未知威胁的无标签数据的特性。
可选的，所述目标终端设备基于所述无标签数据获取所述标签化数据，包括：
所述目标终端设备将所述无标签数据输入至已知威胁的至少一个第二安全状态判断模型，获得所述至少一个第二安全状态判断模型输出的至少一个第二判断结果；
所述目标终端设备根据所述至少一个第二判断结果，确定所述无标签数据的标签值，从而将所述无标签数据转换为所述标签化数据。
上述方法中，通过所述至少一个第二安全状态判断模型得到至少一个第二判断结果，从而可以发现相应已知威胁的特性，更准确地得到标签化数据。
可选的，所述目标终端设备基于所述无标签数据获取所述标签化数据，包括：
所述目标终端设备基于所述无标签数据，按照预设聚类算法，获得所述无标签数据的第一簇聚类数据和第二簇聚类数据；所述第一簇聚类数据的数据量小于所述第二簇聚类数据的数据量；
所述目标终端设备将所述第一簇聚类数据的标签值设置为第一标签值，将所述第二簇聚类数据的标签值设置为第二标签值，从而将所述无标签数据转换为所述标签化数据；所述第一标签值表征数据为不安全数据，所述第二标签值表征数据为安全数据。
上述方式下，所述目标终端设备基于所述无标签数据，按照预设聚类算法，获得所述无标签数据的第一簇聚类数据和第二簇聚类数据，从而根据簇聚类数据的数据量自适应地区分出安全数据和不安全数据，并打上标签，提供了一种自动化设置标签的方法。
可选的，所述目标终端设备按照以下方式获得所述第一安全状态判断模型：
在任一轮机器学习训练中，所述目标终端设备基于所述未知威胁的标签化数据和安全状态训练模型的第一本地训练参数，获得所述安全状态训练模型的第二本地训练参数；
所述目标终端设备将所述第二本地训练参数发送至所述服务端；
所述目标终端设备获得来自所述服务端的融合训练参数；所述融合训练参数是所述服务端基于所述多个终端设备发送的本地训练参数得到的；
若所述安全状态训练模型不满足预设收敛条件，则所述目标终端设备将所述融合训练参数重新作为所述第一本地训练参数，返回所述目标终端设备基于所述未知威胁的标签化数据和所述安全状态训练模型的第一本地训练参数，获得所述安全状态训练模型的第二本地训练参数的步骤；
若所述安全状态训练模型满足所述预设收敛条件，则所述目标终端设备将所述融合训练参数作为所述安全状态训练模型的模型参数，将此时的所述安全状态训练模型作为所述第一安全状态判断模型。
可选的，所述获得所述第一安全状态判断模型输出的第一判断结果之后，还包括：
所述目标终端设备将所述第一判断结果发送至所述服务端。
可选的，所述多个终端设备未知威胁的标签化数据均具有相同的数据特征维度。
第二方面，本发明提供一种终端设备的安全状态判断装置，包括：
获取模块，用于获取目标终端设备的未知威胁的待判断状态数据；所述目标终端设备为多个终端设备的任一终端设备；
处理模块，用于将所述待判断状态数据输入至未知威胁的第一安全状态判断模型，获得所述第一安全状态判断模型输出的第一判断结果；
所述第一安全状态判断模型是多个终端设备及服务端基于所述多个终端设备未知威胁的标签化数据进行机器学习训练得到的；其中，在任一轮机器学习训练中，所述多个终端设备中任一终端设备用于将该轮机器学习训练的本地训练参数发送至服务端，所述服务端用于将该轮机器学习训练中所述多个终端设备的本地训练参数融合，获得融合训练参数，并将所述融合训练参数发送至所述多个终端设备，使得所述多个终端设备基于所述融合训练参数更新或作为所述第一安全状态判断模型的模型参数。
可选的，所述获取模块按照以下方式获得所述目标终端设备的未知威胁的标签化数据：
获取所述目标终端设备的未知威胁的无标签数据；
基于所述无标签数据获取所述标签化数据。
可选的，所述获取模块具体用于：
将所述无标签数据输入至已知威胁的至少一个第二安全状态判断模型，获得所述至少一个第二安全状态判断模型输出的至少一个第二判断结果；
根据所述至少一个第二判断结果，确定所述无标签数据的标签值，从而将所述无标签数据转换为所述标签化数据。
可选的，所述获取模块具体用于：基于所述无标签数据，按照预设聚类算法，获得所述无标签数据的第一簇聚类数据和第二簇聚类数据；所述第一簇聚类数据的数据量小于所述第二簇聚类数据的数据量；
将所述第一簇聚类数据的标签值设置为第一标签值，将所述第二簇聚类数据的标签值设置为第二标签值，从而将所述无标签数据转换为所述标签化数据；所述第一标签值表征数据为不安全数据，所述第二标签值表征数据为安全数据。
可选的，所述获取模块按照以下方式获得所述第一安全状态判断模型：
在任一轮机器学习训练中，基于所述未知威胁的标签化数据和安全状态训练模型的第一本地训练参数，获得所述安全状态训练模型的第二本地训练参数；将所述第二本地训练参数发送至所述服务端；获得来自所述服务端的融合训练参数；所述融合训练参数是所述服务端基于所述多个终端设备发送的本地训练参数得到的；
若所述安全状态训练模型不满足预设收敛条件，则将所述融合训练参数重新作为所述第一本地训练参数，返回基于所述未知威胁的标签化数据和所述安全状态训练模型的第一本地训练参数，获得所述安全状态训练模型的第二本地训练参数的步骤；
若所述安全状态训练模型满足所述预设收敛条件，则将所述融合训练参数作为所述安全状态训练模型的模型参数，将此时的所述安全状态训练模型作为所述第一安全状态判断模型。
可选的，所述获取模块还用于：将所述第一判断结果发送至所述服务端。
可选的，所述多个终端设备未知威胁的标签化数据均具有相同的数据特征维度。
上述第二方面及第二方面各个可选装置的有益效果，可以参考上述第一方面及第一方面各个可选方法的有益效果，这里不再赘述。
第三方面，本发明提供一种计算机设备，包括程序或指令，当所述程序或指令被执行时，用以执行上述第一方面及第一方面各个可选的方法。
第四方面，本发明提供一种存储介质，包括程序或指令，当所述程序或指令被执行时，用以执行上述第一方面及第一方面各个可选的方法。
本发明的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种终端设备的安全状态判断方法的步骤流程示意图；
图2为本发明实施例提供的一种终端设备的安全状态判断方法中终端设备的架构示意图；
图3为本发明实施例提供的一种终端设备的安全状态判断方法中所述第一安全状态判断模型的获取示意图；
图4为本发明实施例提供的一种终端设备的安全状态判断方法中云端服务的架构示意图；
图5为本发明实施例提供的一种终端设备的安全状态判断方法对应的具体流程示意图；
图6为本发明实施例提供的一种终端设备的安全状态判断方法中在终端设备的联邦学习的实现示意图；
图7为本发明实施例提供的一种终端设备的安全状态判断方法中在服务器端的联邦学习的实现示意图；
图8为本发明实施例提供的一种终端设备的安全状态判断方法对应的时序步骤示意图；
图9为本发明实施例提供的一种终端设备的安全状态判断装置的结构示意图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
如图1所示，本发明实施例提供一种终端设备的安全状态判断方法。
步骤101：目标终端设备获取未知威胁的待判断状态数据。
所述目标终端设备为多个终端设备的任一终端设备。
步骤102：所述目标终端设备将所述待判断状态数据输入至未知威胁的第一安全状态判断模型，获得所述第一安全状态判断模型输出的第一判断结果。
步骤101～步骤102中，举例来说，待判断状态数据可以为CPU状态数据、进程状态数据等。
所述第一安全状态判断模型是多个终端设备及服务端基于所述多个终端设备未知威胁的标签化数据进行机器学习训练得到的；其中，在任一轮机器学习训练中，所述多个终端设备中任一终端设备用于将该轮机器学习训练的本地训练参数发送至服务端，所述服务端用于将该轮机器学习训练中所述多个终端设备的本地训练参数融合，获得融合训练参数，并将所述融合训练参数发送至所述多个终端设备，使得所述多个终端设备基于所述融合训练参数更新或作为所述第一安全状态判断模型的模型参数。
需要说明的是，特殊地，所述多个终端设备未知威胁的标签化数据均具有相同的数据特征维度。另外，上述机器学习方法不做限定，如可以采用横向联邦学习。
显然，步骤101～步骤102的方法中，为解决隐私数据的使用问题，保证在所述第一安全状态判断模型的训练时，终端设备的隐私数据不会上传云端，仅仅是在终端设备使用。因此，步骤101～步骤102的方法从技术框架上，便保证了隐私数据不会外泄和恶意使用。
另外上述机器学习方法，在解决隐私数据上传问题的同时，也提供了一种终端设备的未知威胁模型迭代的方法，通常而言未知威胁由于采集数据维度较多，并且目的未知难以被捕捉到。那么步骤101～步骤102的方法下，在解决隐私问题的情况下，可以采集更多维度的数据。并且，通过已知威胁的安全状态判断模型的结果对数据进行标签化，可以将模型的训练本地化，从而不断的训练和迭代终端侧的安全状态判断模型。
需要说明的是，传统方案中，未知威胁检测需要大量的辅助数据，因为既然是未知威胁，就需要更多维度的数据去辅助发现和检测。但是随着隐私保护的逐渐重视，大量隐私数据上传云端的进行使用的方式会越来越难以被接受，所以步骤101～步骤102的方法中， 通过上述机器学习方法的引入来解决在终端训练安全状态判断模型的问题，再辅助已知威胁的安全状态判断模型的数据标签化方法，可以使得终端设备安全状态的判断更加的完整。
一种可选实施方式中，所述目标终端设备按照以下方式获得所述目标终端设备的未知威胁的标签化数据：
步骤(1)：所述目标终端设备获取所述目标终端设备的未知威胁的无标签数据。
步骤(2)：所述目标终端设备基于所述无标签数据获取所述标签化数据。
需要说明的是，步骤(2)中可以采用不同方式对所述无标签数据添加标签，从而获取所述标签化数据。
一种可选实施方式中，步骤(2)具体可以为：
所述目标终端设备将所述无标签数据输入至已知威胁的至少一个第二安全状态判断模型，获得所述至少一个第二安全状态判断模型输出的至少一个第二判断结果；
所述目标终端设备根据所述至少一个第二判断结果，确定所述无标签数据的标签值，从而将所述无标签数据转换为所述标签化数据。
举例来说，所述至少一个第二安全状态判断模型为3个第二安全状态判断模型，这3个第二安全状态判断模型分别用于：检测A方面威胁的第二安全状态判断模型，检测B方面威胁的第二安全状态判断模型，检测C方面威胁的第二安全状态判断模型。
那么对于未知威胁的待判断状态数据，也可能存在A方面威胁、B方面威胁以及C方面威胁，所以通过全面的检测，可以定位出未知威胁是否存在相应方面的威胁。
另一种可选实施方式中，步骤(2)具体可以为：
所述目标终端设备基于所述无标签数据，按照预设聚类算法，获得所述无标签数据的第一簇聚类数据和第二簇聚类数据；所述目标终端设备将所述第一簇聚类数据的标签值设置为第一标签值，将所述第二簇聚类数据的标签值设置为第二标签值，从而将所述无标签数据转换为所述标签化数据。
所述第一簇聚类数据的数据量小于所述第二簇聚类数据的数据量；所述第一标签值表征数据为不安全数据，所述第二标签值表征数据为安全数据。
举例来说，所述无标签数据包括100万条数据，在聚类后，得到第二簇聚类数据，包括95万条数据，以及第一簇聚类数据，包括4万条数据，还有1万条为孤立的点；那么基于一个原则，较多的数据正常，少数的数据异常，便判断第二簇聚类数据为安全的数据，则标签值设置为第二标签值，以及判断第一簇聚类数据为安全的数据，则标签值设置为第一标签值。
需要说明的是，在步骤102之后，还可以执行如下步骤：
所述目标终端设备将所述第一判断结果发送至所述服务端。
需要说明的是，目标终端设备为智能支付设备时，其结构如图2所示。
图2为终端设备的***框架图，在终端设备的***上核心功能主要分为数据采集，模型判定，模型学习，数据上传这四个部分。具体如下：
数据采集：数据采集模块主要负责采集终端设备的数据信息。其中包含已知威胁数据和未知威胁数据。已知威胁数据中包括如root检测，hook框架检测，模拟器环境检测等。未知威胁数据为***运行时相关数据，这些数据不能明确判定***的恶意状态，但是当***遭受攻击时，这些数据会产生变化。未知威胁数据更多是从***状态变化的角度反映当前终端设备的安全状态。如CPU状态数据，内存状态数据，进程状态数据等。
模型判定：模型判定模块主要是利用数据采集模块采集的数据进行安全状态的判定。其中包括已知威胁判定模型(即第二安全判断模型)和未知威胁判定模型(即第一安全判断模型)。而未知威胁判定模型是通过机器学习训练出来的，那么还可以冷启动，如图2示出的一个初始模型，这个初始模型是在实验室环境中通过模拟数据模拟出来的。
需要说明的是，以联邦学习为例，上述冷启动的方式如图3所示。
图3描述的是实验室环境训练初始模型的过程。首先，需要针对实际的安全场景模拟出训练数据，其中包含正常的行为数据和异常行为数据。正常行为数据描述的是在什么状态和数据数值下可以认为终端设备是安全的；相反异常行为数据描述的就是在什么样的终端设备数据数值下终端是不安全的。
进一步地，算法工程师会基于对数据的理解创建一个算法模型，将模拟数据输入到算法模型中，再根据结果调校模型，最终会得到一个符合模拟数据结果的初始未知威胁判定模型。这个模型用于终端设备的冷启动。
模型学习：终端设备中另外一个核心的模块是模型学习模块。这个模块负责联邦学习的终端设备部分。联邦学习很重要的一个环节是模型的迭代，迭代的环节当中终端设备的模型训练为后端的学习提供了模型数据。但若采用联邦学习，具体的机器学习算法必须是有监督的学习算法。所以在模型训练时必须提供数据和对应的标签。
在本发明实施例的方案中，数据模块采集大量数据作为未知威胁的数据输入，这些数据可以分为几个维度，如：环境安全数据(WIFI地址信息，基站信息，IP地址信息)，硬件安全数据(调试端口使用情况，CPU使用状态，内存使用状态等)，流量安全数据(出口流量数据，进口流量数据)和软件安全数据(***进程状态，软件业务数据等)。
而标签化的一种方式是通过已知威胁模块的输出进行标签化，已知威胁的输出是一个分值，这种方式相对简单直观，可以直接对未知威胁数据进行训练。
另外还有一种标签化方式需要对未知威胁的持续发现和运营，相对复杂。首先需要对终端设备未知威胁数据先进行无监督聚类，进而可以区分出数据反映出的问题，再通过安全运营对这些问题划分等级或者人工打分。完成等级划分和人工打分之后，再提供给终端设备进行推理和标签化。以上过程因为使用到终端设备隐私数据，所以可以先在实验室环境完成。
上述两种未知威胁的标签化方式，一种属于短期见效，一种需要长期运营不断优化。可以根据实际情况互相结合使用。
数据上传：数据上传模块最主要的作用在于将终端设备训练的未知威胁判定模型上传到云端，另外终端设备也有部分非隐私或者去隐私的数据需要云端帮忙辅助判定。简单来说数据上传模块是终端设备和云端数据交换的通信模块。
一种可选实施方式中，所述目标终端设备按照以下方式获得所述第一安全状态判断模型：
在任一轮机器学习训练中，执行以下步骤：
步骤(a)：所述目标终端设备基于所述未知威胁的标签化数据和安全状态训练模型的第一本地训练参数，获得所述安全状态训练模型的第二本地训练参数。
步骤(b)：所述目标终端设备将所述第二本地训练参数发送至所述服务端。
步骤(c)：所述目标终端设备获得来自所述服务端的融合训练参数。
所述融合训练参数是所述服务端基于所述多个终端设备发送的本地训练参数得到的。
步骤(d)：若所述安全状态训练模型不满足预设收敛条件，则所述目标终端设备将所述融合训练参数重新作为所述第一本地训练参数，返回步骤(a)。
步骤(e)：若所述安全状态训练模型满足所述预设收敛条件，则所述目标终端设备将所述融合训练参数作为所述安全状态训练模型的模型参数，将此时的所述安全状态训练模型作为所述第一安全状态判断模型。
上述过程为终端设备内部的训练学习过程。
另一方面，云端服务的框架图也有配合的功能模块，以联邦学习为例，具体如图4所示。
图4是云端服务的框架图。包含几个核心功能模块：云端威胁判定模块，联邦学习模块，数据存储模块，对外接口模块。
云端威胁判定模块：由于大量的数据是在终端设备进行判定和训练的，但是依然有少部分的数据终端设备自身是无法完全判定的，比如公网IP数据。对于部分设备，设备的移动本身就是一个非常严重的安全问题，如智能自动收货柜。所以需要云端监控终端 设备的公网IP信息是否有变动。如上所述，虽然本方案中出于隐私保护的原因，大量的数据通过联邦学习在终端设备进行判定和训练，但是依然会有少量数据必须在云端进行判定。所以从方案的完整性角度考虑，在云端必须要有一个云端威胁判定模块，也就是说云端威胁判定模块用于判断终端设备的状态数据之外的数据，如终端设备的网络数据。
联邦学习模块：终端设备的联邦学习模块主要功能是输入终端设备的数据，输出是对于终端设备数据的判定模型。而云端的联邦学习模块就是对于终端设备上传的模型进行训练。这个模块的输入是终端设备上传的模型，输出是对这些输入模型训练后的新模型。云端的联邦学习模块控制着整个联邦学习的流程。终端设备联邦学习模型的训练并不会实时的进行，一是因为实时训练数据量小，不能有很好的效果，二是因为模型训练会消耗较多的***资源。所以一般是选择深夜时间，将一天积累的数据集中训练。所以步骤101～步骤102中联邦学习流程的频率是一天一次。并且在每次联邦学习流程开始前，终端设备需要和云端进行协商确认当前终端设备是否加入本轮的联邦学习流程。云端会根据一定的条件进行筛选，选择足够数量的终端设备参与联邦学习流程。
数据存储模块：终端设备的数据，模型，日志，云端的判定结果都会统一结构化存储到数据库中，当然为了使用数据的方便，可以将热数据备份一份到redis中方便其他模块的存取。数据存储模块提供相关数据给到对外接口模块使用。
对外接口模块：这个模块的主要作用主要是提供给业务使用方。如业务使用方查询终端设备的安全分值，并获取各个安全维度的详细信息。这个模块通过两种方式对外提供数据，一种可以是页面的形式，直接通过页面展示所有终端设备的状态；另一种是API调用的方式，通过API查询的方式获取终端设备的安全分值甚至具体的各个安全维度的信息。
另外云端还有一些常规功能，如终端设备日志监控，终端设备崩溃处理等。
需要说明的是，云端的云端判定模块，常规服务模块，存储模块和对外接口模块可以替换或者删除，不影响整个方案的核心功能。云端最核心的功能在于联邦学习，所以云端框架图最极端情况下可以只包括联邦学习模型。
更具体地，本发明实施例提供的一种终端设备的安全状态判断方法具体过程可以如图5所示。
步骤501：在实验室环境中，算法工程师通过模拟的未知威胁数据理解模型构造出模型算法，并通过模拟的正负样本训练出初始的未知威胁判定模型，这个模型用于终端设备未知威胁判定模型的冷启动。
步骤502：在步骤501中生成的未知威胁判定初始模型，需要在终端实际上线使用前部署到每一台终端设备中，保证在安全态势感知功能使用时，未知威胁判定模型可以生效。
步骤503：该步骤进入终端安全态势感知的循环处理。在终端设备实际运行时，隔一个固定时间就会采集终端数据进行威胁判定。其中一部分数据用于已知威胁判定。其中已知威胁是指如root手机，hook框架等常见的攻击手段。另外一部分数据会进行未知威胁判定，这里未知威胁的判定模型最开始就是第一步中实验室生成的模型。
步骤504：当到指定时间，并且当前终端被云端选择成为本轮联邦学习流程的终端后，则将当天采集的数据进行处理，训练的数据集是将已知威胁的判定结果作为标签，采集的数据全集作为数据。输入到终端的学习框架中，进行本地未知威胁模型的训练，训练完成后将当天数据进行清除。另外如果当前终端并没有被云端选择成为本轮联邦学习流程的参与终端，则需要立刻将当天存储的数据进行清除处理。
步骤505：当各个参与联邦学习的终端训练完成后，各个终端将本地训练的模型上传云端，云端则需要等待终端的模型上传。其中会出现终端训练失败，或者终端网络断开无法上传的情况。云端获得的终端模型数量如果不满足一个阈值条件，则本轮的联邦学习失败。如果满足阈值条件则启动云端的联邦学习，由云端服务器的联邦学习模块对终端上传的模型进行训练。
步骤506：云端的联邦学习模块往往是在一个独立的硬件环境中进行训练，因为机器学习可能需要CPU的加速。所以云端中真实的联邦学习训练模块和控制逻辑往往是分离的，控制逻辑将终端上传的未知威胁模型输入到联邦学习训练模块中，学习完成后输出一个优化后的未知威胁判定模型。
步骤507：完成云端的联邦学习过程后，云端会将优化后的未知威胁判定模型下发给所有在线的终端设备，终端设备获取到云端下发的更新后的未知威胁判定模型后，将新模型替换原本的旧模型，完成新模型的部署使用。
新模型部署完成后，联邦学习模块会进入周期迭代的流程，每天都会将步骤503～步骤507循环执行，一直迭代到模型稳定为止。
进一步地，在终端设备的联邦学习的实现示意图，如图6所示。
在手机端，联邦学习的功能以SDK形态实现，和检测模块通过API进行通信，数据采集和终端威胁判定生成的数据会保存在终端建立的一个数据仓库中，联邦学习SDK通过API取用数据仓库中的数据，并有状态与流程控制模块控制终端的训练流程。终端模型训练完成后需要通过通信模块上传到云端服务器，不过在传输前，为保证模型数据的安全性，也需要通过加解密模块进行模型加密。
进一步地，在服务器端的联邦学习的实现示意图，如图7所示。
联邦学习的服务端通过云端的通信模块接收到终端上传的模型数据后，首先通过加解 密模块解密模型数据，在进行云端聚合之前，需要通过模型验证模块验证终端模型数据是否正确。最后通过联邦学习聚合模块将终端设备的模型进行聚合训练，生成新的未知威胁判定模型。
所以综合上述过程，终端设备与服务器端联合的步骤流程如图8所示。
步骤801：判断数据仓库中的数据是否有更新，并且确认当前终端设备是否满足启动联邦学习的条件。
步骤802：如果满足启动条件，则终端设备向服务端进行注册，告诉服务端当前终端设备可以进行联邦学习。
步骤803：当云端判断本轮加入联邦学习的终端设备数量满足阈值要求的情况下，云端(服务器端)会通知终端设备启动本轮的联邦学习流程。
步骤804：当终端设备接收到云端启动联邦学习的流程指令时，终端设备的联邦学习模块会读取数据仓库中的数据，并在终端设备进行训练。训练完成后终端设备将本轮训练出的未知威胁判定模型上传到云端。
步骤805：云端在启动联邦学习流程后就会等待终端设备的模型上传，当所有终端设备都已经上传终端设备模型或者超时的情况下终端设备上传的模型数量满足模型聚合的最低要求，则云端会开启模型聚合的过程；否则如果云端等待超时，并且云端收到终端设备回传的模型数量不足以开启模型聚合，则会认为本轮联邦学习失败。
步骤806：如果云端模型聚合顺利结束，则云端会将聚合后的模型下发给所有终端设备，并通知所有终端设备更新和部署新的未知威胁判定模型。至此一轮联邦学习流程结束。
如图9所示，本发明提供一种终端设备的安全状态判断装置，包括：
获取模块901，用于获取目标终端设备的未知威胁的待判断状态数据；所述目标终端设备为多个终端设备的任一终端设备；
处理模块902，用于将所述待判断状态数据输入至未知威胁的第一安全状态判断模型，获得所述第一安全状态判断模型输出的第一判断结果；
所述第一安全状态判断模型是多个终端设备及服务端基于所述多个终端设备未知威胁的标签化数据进行机器学习训练得到的；其中，在任一轮机器学习训练中，所述多个终端设备中任一终端设备用于将该轮机器学习训练的本地训练参数发送至服务端，所述服务端用于将该轮机器学习训练中所述多个终端设备的本地训练参数融合，获得融合训练参数，并将所述融合训练参数发送至所述多个终端设备，使得所述多个终端设备基于所述融合训练参数更新或作为所述第一安全状态判断模型的模型参数。
可选的，所述获取模块901按照以下方式获得所述目标终端设备的未知威胁的标签化 数据：
获取所述目标终端设备的未知威胁的无标签数据；
基于所述无标签数据获取所述标签化数据。
可选的，所述获取模块901具体用于：
将所述无标签数据输入至已知威胁的至少一个第二安全状态判断模型，获得所述至少一个第二安全状态判断模型输出的至少一个第二判断结果；
根据所述至少一个第二判断结果，确定所述无标签数据的标签值，从而将所述无标签数据转换为所述标签化数据。
可选的，所述获取模块901具体用于：基于所述无标签数据，按照预设聚类算法，获得所述无标签数据的第一簇聚类数据和第二簇聚类数据；所述第一簇聚类数据的数据量小于所述第二簇聚类数据的数据量；
将所述第一簇聚类数据的标签值设置为第一标签值，将所述第二簇聚类数据的标签值设置为第二标签值，从而将所述无标签数据转换为所述标签化数据；所述第一标签值表征数据为不安全数据，所述第二标签值表征数据为安全数据。
可选的，所述获取模块901按照以下方式获得所述第一安全状态判断模型：
在任一轮机器学习训练中，基于所述未知威胁的标签化数据和安全状态训练模型的第一本地训练参数，获得所述安全状态训练模型的第二本地训练参数；将所述第二本地训练参数发送至所述服务端；获得来自所述服务端的融合训练参数；所述融合训练参数是所述服务端基于所述多个终端设备发送的本地训练参数得到的；
若所述安全状态训练模型不满足预设收敛条件，则将所述融合训练参数重新作为所述第一本地训练参数，返回基于所述未知威胁的标签化数据和所述安全状态训练模型的第一本地训练参数，获得所述安全状态训练模型的第二本地训练参数的步骤；
若所述安全状态训练模型满足所述预设收敛条件，则将所述融合训练参数作为所述安全状态训练模型的模型参数，将此时的所述安全状态训练模型作为所述第一安全状态判断模型。
可选的，所述获取模块901还用于：将所述第一判断结果发送至所述服务端。
可选的，所述多个终端设备未知威胁的标签化数据均具有相同的数据特征维度。
基于同一发明构思，本发明实施例还提供了一种计算机设备，包括程序或指令，当所述程序或指令被执行时，如本发明实施例提供的终端设备的安全状态判断方法及任一可选方法被执行。
基于同一发明构思，本发明实施例还提供了一种计算机可读存储介质，包括程序或指 令，当所述程序或指令被执行时，如本发明实施例提供的终端设备的安全状态判断方法及任一可选方法被执行。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (10)

  1. 一种终端设备的安全状态判断方法，其特征在于，包括：
    目标终端设备获取未知威胁的待判断状态数据；所述目标终端设备为多个终端设备的任一终端设备；
    所述目标终端设备将所述待判断状态数据输入至未知威胁的第一安全状态判断模型，获得所述第一安全状态判断模型输出的第一判断结果；
    所述第一安全状态判断模型是多个终端设备及服务端基于所述多个终端设备未知威胁的标签化数据进行机器学习训练得到的；其中，在任一轮机器学习训练中，所述多个终端设备中任一终端设备用于将该轮机器学习训练的本地训练参数发送至服务端，所述服务端用于将该轮机器学习训练中所述多个终端设备的本地训练参数融合，获得融合训练参数，并将所述融合训练参数发送至所述多个终端设备，使得所述多个终端设备基于所述融合训练参数更新或作为所述第一安全状态判断模型的模型参数。
  2. 如权利要求1所述的方法，其特征在于，所述目标终端设备按照以下方式获得所述目标终端设备的未知威胁的标签化数据：
    所述目标终端设备获取所述目标终端设备的未知威胁的无标签数据；
    所述目标终端设备基于所述无标签数据获取所述标签化数据。
  3. 如权利要求2所述的方法，其特征在于，所述目标终端设备基于所述无标签数据获取所述标签化数据，包括：
    所述目标终端设备将所述无标签数据输入至已知威胁的至少一个第二安全状态判断模型，获得所述至少一个第二安全状态判断模型输出的至少一个第二判断结果；
    所述目标终端设备根据所述至少一个第二判断结果，确定所述无标签数据的标签值，从而将所述无标签数据转换为所述标签化数据。
  4. 如权利要求2所述的方法，其特征在于，所述目标终端设备基于所述无标签数据获取所述标签化数据，包括：
    所述目标终端设备基于所述无标签数据，按照预设聚类算法，获得所述无标签数据的第一簇聚类数据和第二簇聚类数据；所述第一簇聚类数据的数据量小于所述第二簇聚类数据的数据量；
    所述目标终端设备将所述第一簇聚类数据的标签值设置为第一标签值，将所述第二簇聚类数据的标签值设置为第二标签值，从而将所述无标签数据转换为所述标签化数据；所述第一标签值表征数据为不安全数据，所述第二标签值表征数据为安全数据。
  5. 如权利要求1所述的方法，其特征在于，所述目标终端设备按照以下方式获得所述第一安全状态判断模型：
    在任一轮机器学习训练中，所述目标终端设备基于所述未知威胁的标签化数据和安全状态训练模型的第一本地训练参数，获得所述安全状态训练模型的第二本地训练参数；
    所述目标终端设备将所述第二本地训练参数发送至所述服务端；
    所述目标终端设备获得来自所述服务端的融合训练参数；所述融合训练参数是所述服务端基于所述多个终端设备发送的本地训练参数得到的；
    若所述安全状态训练模型不满足预设收敛条件，则所述目标终端设备将所述融合训练参数重新作为所述第一本地训练参数，返回所述目标终端设备基于所述未知威胁的标签化数据和所述安全状态训练模型的第一本地训练参数，获得所述安全状态训练模型的第二本地训练参数的步骤；
    若所述安全状态训练模型满足所述预设收敛条件，则所述目标终端设备将所述融合训练参数作为所述安全状态训练模型的模型参数，将此时的所述安全状态训练模型作为所述第一安全状态判断模型。
  6. 如权利要求1至5任一项所述的方法，其特征在于，所述获得所述第一安全状态判断模型输出的第一判断结果之后，还包括：
    所述目标终端设备将所述第一判断结果发送至所述服务端。
  7. 如权利要求1至5任一项所述的方法，其特征在于，所述多个终端设备未知威胁的标签化数据均具有相同的数据特征维度。
  8. 一种终端设备的安全状态判断装置，其特征在于，包括：
    获取模块，用于获取目标终端设备的未知威胁的待判断状态数据；所述目标终端设备为多个终端设备的任一终端设备；
    处理模块，用于将所述待判断状态数据输入至未知威胁的第一安全状态判断模型，获得所述第一安全状态判断模型输出的第一判断结果；
    所述第一安全状态判断模型是多个终端设备及服务端基于所述多个终端设备未知威胁的标签化数据进行机器学习训练得到的；其中，在任一轮机器学习训练中，所述多个终端设备中任一终端设备用于将该轮机器学习训练的本地训练参数发送至服务端，所述服务端用于将该轮机器学习训练中所述多个终端设备的本地训练参数融合，获得融合训练参数，并将所述融合训练参数发送至所述多个终端设备，使得所述多个终端设备基于所述融合训练参数更新或作为所述第一安全状态判断模型的模型参数。
  9. 一种计算机设备，其特征在于，包括程序或指令，当所述程序或指令被执行时， 如权利要求1至7中任意一项所述的方法被执行。
  10. 一种计算机可读存储介质，其特征在于，包括程序或指令，当所述程序或指令被执行时，如权利要求1至7中任意一项所述的方法被执行。
PCT/CN2021/128867 2021-01-15 2021-11-05 一种终端设备的安全状态判断方法及装置 WO2022151815A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110053180.XA CN112800428B (zh) 2021-01-15 2021-01-15 一种终端设备的安全状态判断方法及装置
CN202110053180.X 2021-01-15

Publications (1)

Publication Number Publication Date
WO2022151815A1 true WO2022151815A1 (zh) 2022-07-21

Family

ID=75809522

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/128867 WO2022151815A1 (zh) 2021-01-15 2021-11-05 一种终端设备的安全状态判断方法及装置

Country Status (2)

Country Link
CN (1) CN112800428B (zh)
WO (1) WO2022151815A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115329985A (zh) * 2022-09-07 2022-11-11 北京邮电大学 无人集群智能模型训练方法、装置和电子设备
CN117811845A (zh) * 2024-02-29 2024-04-02 浪潮电子信息产业股份有限公司 威胁检测及模型训练方法、装置、***、电子设备、介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112800428B (zh) * 2021-01-15 2023-08-01 ***股份有限公司 一种终端设备的安全状态判断方法及装置
CN114064359B (zh) * 2021-11-12 2023-03-31 广州泳泳信息科技有限公司 一种跨平台多机房分布式数据库备份***

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110113348A (zh) * 2019-05-14 2019-08-09 四川长虹电器股份有限公司 一种基于机器学习进行物联网威胁检测的方法
US20200125739A1 (en) * 2018-10-19 2020-04-23 International Business Machines Corporation Distributed learning preserving model security
CN111310938A (zh) * 2020-02-10 2020-06-19 深圳前海微众银行股份有限公司 基于半监督的横向联邦学习优化方法、设备及存储介质
CN112070180A (zh) * 2020-09-30 2020-12-11 南方电网科学研究院有限责任公司 基于信息物理双侧数据的电网设备状态判断方法及装置
CN112800428A (zh) * 2021-01-15 2021-05-14 ***股份有限公司 一种终端设备的安全状态判断方法及装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3970074A1 (en) * 2019-05-16 2022-03-23 FRAUNHOFER-GESELLSCHAFT zur Förderung der angewandten Forschung e.V. Concepts for federated learning, client classification and training data similarity measurement
CN112217626B (zh) * 2020-08-24 2022-11-18 中国人民解放军战略支援部队信息工程大学 基于情报共享的网络威胁协同防御***及方法
CN112203282B (zh) * 2020-08-28 2022-02-18 中国科学院信息工程研究所 一种基于联邦迁移学习的5g物联网入侵检测方法及***

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200125739A1 (en) * 2018-10-19 2020-04-23 International Business Machines Corporation Distributed learning preserving model security
CN110113348A (zh) * 2019-05-14 2019-08-09 四川长虹电器股份有限公司 一种基于机器学习进行物联网威胁检测的方法
CN111310938A (zh) * 2020-02-10 2020-06-19 深圳前海微众银行股份有限公司 基于半监督的横向联邦学习优化方法、设备及存储介质
CN112070180A (zh) * 2020-09-30 2020-12-11 南方电网科学研究院有限责任公司 基于信息物理双侧数据的电网设备状态判断方法及装置
CN112800428A (zh) * 2021-01-15 2021-05-14 ***股份有限公司 一种终端设备的安全状态判断方法及装置

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115329985A (zh) * 2022-09-07 2022-11-11 北京邮电大学 无人集群智能模型训练方法、装置和电子设备
CN115329985B (zh) * 2022-09-07 2023-10-27 北京邮电大学 无人集群智能模型训练方法、装置和电子设备
CN117811845A (zh) * 2024-02-29 2024-04-02 浪潮电子信息产业股份有限公司 威胁检测及模型训练方法、装置、***、电子设备、介质
CN117811845B (zh) * 2024-02-29 2024-05-24 浪潮电子信息产业股份有限公司 威胁检测及模型训练方法、装置、***、电子设备、介质

Also Published As

Publication number Publication date
CN112800428B (zh) 2023-08-01
CN112800428A (zh) 2021-05-14

Similar Documents

Publication Publication Date Title
WO2022151815A1 (zh) 一种终端设备的安全状态判断方法及装置
CN110351257B (zh) 一种分布式物联网安全接入***
US20200272531A1 (en) Automatic correlation of dynamic system events within computing devices
CN106227780B (zh) 一种海量网页的自动化截图取证方法和***
CN106713332A (zh) 网络数据的处理方法、装置和***
US20200145485A1 (en) System and method for secure deployment and information mobility
CN112988485A (zh) 电力物联网设备模拟测试方法及装置
US10986020B2 (en) Reconstructing message flows based on hash values
CN112291264B (zh) 一种安全控制的方法、装置、服务器和存储介质
CN114513404A (zh) 时间敏感网络的配置方法、装置及计算机可读存储介质
CN110995489B (zh) 大数据平台服务器管理方法、装置、服务器及存储介质
CN112822208A (zh) 一种基于区块链的物联网设备识别方法及***
US20230353648A1 (en) Data tracking for data owners
CN113783862B (zh) 一种边云协同过程中进行数据校验的方法及装置
CN115473692A (zh) 业务请求处理方法、装置、设备及介质
CN114756301A (zh) 日志处理方法、装置和***
CN111343193B (zh) 云网络端口安全防护方法、装置、电子设备及存储介质
CN113992419A (zh) 一种用户异常行为检测和处理***及其方法
CN114070775A (zh) 面向5g智能网联***的区块链网络切片安全智能优化方法
CN116915870B (zh) 任务创建请求处理方法、装置、电子设备和可读介质
US20230370959A1 (en) Systems and methods for retrieving ran information
US11736336B2 (en) Real-time monitoring of machine learning models in service orchestration plane
US11835989B1 (en) FPGA search in a cloud compute node
CN115333885B (zh) 一种基于联邦学习的智能家居隐私保护方法及装置
CN116225571A (zh) 数据采集***、存储***以及交换方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21919006

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21919006

Country of ref document: EP

Kind code of ref document: A1