1{
2	"modelcfg": [{
3		"modelId": "3001000000",
4		"path": "/system/lib64/libsg_system_risk_detection.z.so",
5		"format": "so",
6		"start-mode": 2,
7		"preload": [""],
8		"eventList": ["1011009000",
9		"1011009001",
10		"1011009100",
11		"1011009101",
12		"1011009102",
13		"1011009103",
14		"1011009104"],
15		"permissions": "ohos.permission.securityguard.REQUEST_SECURITY_MODEL_RESULT",
16		"db_table": "risk_event",
17		"running_cntl": 0,
18		"caller": ["security_guard"],
19		"type": "build-in",
20		"buildInDetectionCfg": {
21			"rules": [{
22				"eventId": 1011009000,
23				"fields": [{
24					"fieldName": "cred",
25					"fieldType": "int32",
26					"value": "1"
27				},
28				{
29					"fieldName": "status",
30					"fieldType": "int32",
31					"value": "0"
32				}],
33				"fieldsRelation": "AND"
34			},
35			{
36				"eventId": 1011009001,
37				"fields": [{
38					"fieldName": "cred",
39					"fieldType": "int32",
40					"value": "1"
41				},
42				{
43					"fieldName": "status",
44					"fieldType": "int32",
45					"value": "0"
46				}],
47				"fieldsRelation": "AND"
48			},
49			{
50				"eventId": 1011009100,
51				"fields": [{
52					"fieldName": "cred",
53					"fieldType": "int32",
54					"value": "1"
55				},
56				{
57					"fieldName": "status",
58					"fieldType": "int32",
59					"value": "0"
60				}],
61				"fieldsRelation": "AND"
62			},
63			{
64				"eventId": 1011009101,
65				"fields": [{
66					"fieldName": "cred",
67					"fieldType": "int32",
68					"value": "1"
69				},
70				{
71					"fieldName": "status",
72					"fieldType": "int32",
73					"value": "0"
74				}],
75				"fieldsRelation": "AND"
76			},
77			{
78				"eventId": 1011009102,
79				"fields": [{
80					"fieldName": "cred",
81					"fieldType": "int32",
82					"value": "1"
83				},
84				{
85					"fieldName": "status",
86					"fieldType": "int32",
87					"value": "0"
88				}],
89				"fieldsRelation": "AND"
90			},
91			{
92				"eventId": 1011009103,
93				"fields": [{
94					"fieldName": "cred",
95					"fieldType": "int32",
96					"value": "1"
97				},
98				{
99					"fieldName": "status",
100					"fieldType": "int32",
101					"value": "0"
102				}],
103				"fieldsRelation": "AND"
104			},
105			{
106				"eventId": 1011009104,
107				"fields": [{
108					"fieldName": "cred",
109					"fieldType": "int32",
110					"value": "1"
111				},
112				{
113					"fieldName": "status",
114					"fieldType": "int32",
115					"value": "0"
116				}],
117				"fieldsRelation": "AND"
118			}],
119			"rulesRelation": "OR",
120			"trueResult": "risk",
121			"falseResult": "safe"
122		}
123	},
124	{
125		"modelId": "3001000001",
126		"path": "/system/lib64/libsg_system_risk_detection.z.so",
127		"format": "so",
128		"start-mode": 2,
129		"preload": [""],
130		"eventList": ["1011009002",
131		"1011009003",
132		"1011009004"],
133		"permissions": "ohos.permission.securityguard.REQUEST_SECURITY_MODEL_RESULT",
134		"db_table": "risk_event",
135		"running_cntl": 0,
136		"caller": ["security_guard"],
137		"type": "build-in",
138		"buildInDetectionCfg": {
139			"rules": [{
140				"eventId": 1011009002,
141				"fields": [{
142					"fieldName": "cred",
143					"fieldType": "int32",
144					"value": "1"
145				},
146				{
147					"fieldName": "status",
148					"fieldType": "int32",
149					"value": "0"
150				}],
151				"fieldsRelation": "AND"
152			},
153			{
154				"eventId": 1011009003,
155				"fields": [{
156					"fieldName": "cred",
157					"fieldType": "int32",
158					"value": "1"
159				},
160				{
161					"fieldName": "status",
162					"fieldType": "int32",
163					"value": "0"
164				}],
165				"fieldsRelation": "AND"
166			},
167			{
168				"eventId": 1011009004,
169				"fields": [{
170					"fieldName": "cred",
171					"fieldType": "int32",
172					"value": "1"
173				},
174				{
175					"fieldName": "status",
176					"fieldType": "int32",
177					"value": "0"
178				}],
179				"fieldsRelation": "AND"
180			}],
181			"rulesRelation": "OR",
182			"trueResult": "risk",
183			"falseResult": "safe"
184		}
185	},
186	{
187		"modelId": "3001000002",
188		"path": "/system/lib64/libsg_system_risk_detection.z.so",
189		"format": "so",
190		"start-mode": 2,
191		"preload": [""],
192		"eventList": ["1011009005"],
193		"permissions": "ohos.permission.securityguard.REQUEST_SECURITY_MODEL_RESULT",
194		"db_table": "risk_event",
195		"running_cntl": 0,
196		"caller": ["security_guard"],
197		"type": "build-in",
198		"buildInDetectionCfg": {
199			"rules": [{
200				"eventId": 1011009005,
201				"fields": [{
202					"fieldName": "cred",
203					"fieldType": "int32",
204					"value": "1"
205				},
206				{
207					"fieldName": "status",
208					"fieldType": "int32",
209					"value": "0"
210				}],
211				"fieldsRelation": "AND"
212			}],
213			"rulesRelation": "OR",
214			"trueResult": "risk",
215			"falseResult": "safe"
216		}
217	},
218	{
219		"modelId": "3001000003",
220		"path": "/system/lib64/libaudit_model.z.so",
221		"format": "so",
222		"start-mode": 1,
223		"preload": [""],
224		"eventList": ["1011015000",
225		"1011015001",
226		"1011015002",
227		"1011015003",
228		"1011015004",
229		"1011015005",
230		"1011015006",
231		"1011015007",
232		"1011015008",
233		"1011015009",
234		"1011015010",
235		"1011015011",
236		"1011015012",
237		"1011015013",
238		"1011015014",
239		"1011015015",
240		"1011015016"],
241		"permissions": "ohos.permission.securityguard.REQUEST_SECURITY_MODEL_RESULT",
242		"db_table": "audit_event",
243		"running_cntl": 0,
244		"caller": ["security_guard"]
245	},
246	{
247		"modelId": "3001000004",
248		"path": "/system/lib64/libsg_threat_detection.z.so",
249		"format": "so",
250		"start-mode": 1,
251		"preload": [""],
252		"eventList": ["1011009200",
253		"1011009201",
254		"1011009202",
255		"1011009203"],
256		"permissions": "ohos.permission.securityguard.REQUEST_SECURITY_MODEL_RESULT",
257		"db_table": "risk_event",
258		"running_cntl": 0,
259		"caller": ["security_guard"]
260	},
261	{
262		"modelId": "3001000005",
263		"path": "/system/lib64/libsg_oem_mode_detection.z.so",
264		"format": "so",
265		"start-mode": 2,
266		"preload": [""],
267		"eventList": [],
268		"permissions": "ohos.permission.securityguard.REQUEST_SECURITY_MODEL_RESULT",
269		"db_table": "",
270		"running_cntl": 0,
271		"caller": ["security_guard"]
272	},
273	{
274		"modelId": "3001000006",
275		"path": "/system/lib64/libsg_app_risk_detection.z.so",
276		"format": "so",
277		"start-mode": 2,
278		"preload": [""],
279		"eventList": [""],
280		"permissions": "ohos.permission.securityguard.REQUEST_SECURITY_MODEL_RESULT",
281		"db_table": "risk_event",
282		"running_cntl": 0,
283		"caller": ["security_guard"],
284		"type": "app",
285		"appDetectionCfg" : {
286			"detectionCategory": "signature"
287  		}
288	},
289	{
290		"modelId": "3001000007",
291		"path": "/system/lib64/libsg_app_risk_detection.z.so",
292		"format": "so",
293		"start-mode": 2,
294		"preload": [""],
295		"eventList": ["1037000001"],
296		"permissions": "ohos.permission.securityguard.REQUEST_SECURITY_MODEL_RESULT",
297		"db_table": "risk_event",
298		"running_cntl": 0,
299		"caller": ["security_guard"],
300		"type": "app",
301		"appDetectionCfg" : {
302			"detectionCategory": "url"
303		}
304	},
305	{
306		"modelId": "3001000008",
307		"path": "/system/lib64/libsg_time_event_related_analysis.z.so",
308		"format": "so",
309		"start-mode": 1,
310		"preload": [""],
311		"eventList": ["1037000001"],
312		"permissions": "ohos.permission.securityguard.REQUEST_SECURITY_MODEL_RESULT",
313		"db_table": "risk_event",
314		"running_cntl": 0,
315		"caller": ["security_guard"]
316	}]
317}
318