Electromagnetic compatibility protection test and evaluation system for computer equipment

Abstract

The present invention discloses an electromagnetic compatibility protection test and evaluation system for computer equipment. The system collects data on the computer equipment to obtain historical fault data in the historical network of each interactive computing node, analyzes the historical fault information to obtain the historical fault feature source of each interactive computing node; obtains the target network parameters according to the historical fault feature source of each interactive computing node, and obtains the threat value of the historical fault data according to the target network parameters; and analyzes the threat value of the historical fault data to obtain the security evaluation result of the computer equipment.

Description

Technical Field

[0001] The invention relates to the field of computer security, and in particular to an electromagnetic compatibility protection test and evaluation system for computer equipment. Background Art

[0002] Computers, security machines, industrial computers (hereinafter collectively referred to as computer equipment) and other electronic information products, many of whose information processing and exchange devices generate video and data information when processing data and exchanging information, which will be radiated by electromagnetic conduction. However, this electromagnetic radiation leaks out in the form of a certain amount of energy. With the emergence of detection equipment, it is possible to judge certain information transmission through radiation capabilities and electromagnetic signals; for example, electromagnetic radiation usually leaks out with lower energy. Although it cannot directly leak information, it can still be captured by professional electromagnetic detection equipment. If it is maliciously analyzed, it is possible to restore some sensitive information. Another example: when the hard disk reads and writes a large amount of data quickly, it will emit strong electromagnetic radiation. Data analysis requires a large amount of data on the hard disk, which will cause the electromagnetic radiation energy of the hard disk to increase. Graphics cards will also generate strong electromagnetic radiation when undertaking complex graphics rendering tasks. By analyzing these electromagnetic radiation energies, it can be judged that certain computer devices may be performing important computing tasks;

[0003] Therefore, in order to prevent computers and other electronic information equipment from leaking information through power supply lines and space electromagnetic radiation during operation, many methods have been proposed on the market to evaluate the security of the above-mentioned computer equipment. When conducting equipment security tests, the test method is relatively traditional and single, which is just a simple radiation intensity test (commonly known as electromagnetic compatibility safety test, which is used to determine whether the computer equipment is safe). Therefore, this evaluation test method cannot effectively and accurately guarantee the comprehensive safety evaluation of computer equipment; the reason is that when an abnormal network attack occurs, there are often not only changes in electromagnetic radiation energy, but also changes in other network indicators. Therefore, how to accurately and comprehensively evaluate the security of computer equipment is an important testing step. Summary of the invention

[0004] The purpose of the present invention is to provide an electromagnetic compatibility protection test and evaluation system for computer equipment, which solves the above technical problems pointed out in the prior art.

[0005] The present invention provides an electromagnetic compatibility protection test and evaluation system for computer equipment, comprising the following operating steps: an analysis module, a calculation module, and an evaluation module;

[0006] The analysis module is used to collect data from computer equipment to obtain historical fault data in the historical network of each interactive computing node, and analyze the historical fault information to obtain the historical fault feature source of each interactive computing node;

[0007] The calculation module is used to obtain target network parameters according to the historical fault feature sources of each interactive computing node, and obtain the threat value of the historical fault data according to the target network parameters;

[0008] The evaluation module is used to analyze the threat value of the historical fault data to obtain a security evaluation result of the computer device.

[0009] Preferably, the calculation module includes an initial event determination module, a strong association processing module, an assignment calculation module, a weight calculation module and a summation processing module:

[0010] The initial event determination module is used to preliminarily determine the current specific security event;

[0011] The strong association processing module is used to calculate and determine the strong association sub-parameter combination of the current specific security event using an association rule mining algorithm combined with the Pearson coefficient or using the Pearson coefficient independently;

[0012] The value assignment calculation module is used to assign a value to each sub-parameter in the target network parameter according to the historical fault data caused by the current specific security event, so as to obtain a parameter assignment corresponding to each sub-parameter;

[0013] The weight calculation module is used to assign a corresponding weight to each sub-parameter in the target network parameter according to the expert evaluation, and obtain a first weight K corresponding to each sub-parameter. i ;

[0014] The summation processing module is used to assign a first weight K corresponding to each sub-parameter in the target network parameter. i Multiply them to obtain the sub-threat value of each sub-parameter; sum the sub-threat values ​​of all the sub-parameters to obtain the threat value; the target network parameters include network performance and radiation information, network vulnerability type, and access control information.

[0015] Preferably, the calculation module includes an initial event determination module, a strong association processing module, an assignment calculation module, a weight calculation module and a summation processing module:

[0016] The initial event determination module is used to preliminarily determine the current specific security event;

[0017] The strong association processing module is used to calculate and determine the strong association sub-parameter combination of the current specific security event using an association rule mining algorithm combined with the Pearson coefficient or using the Pearson coefficient independently;

[0018] The value assignment calculation module is used to assign a value to each sub-parameter in the target network parameter according to the historical fault data caused by the current specific security event, so as to obtain a parameter assignment corresponding to each sub-parameter;

[0019] The weight calculation module is used to assign a corresponding weight to each sub-parameter in the target network parameter according to the expert evaluation, and obtain a first weight K corresponding to each sub-parameter. i ;

[0020] The summation processing module is used to assign a first weight K corresponding to each sub-parameter in the target network parameter. i Multiply them to obtain the sub-threat value of each sub-parameter; sum the sub-threat values ​​of all the sub-parameters to obtain the threat value; the target network parameters include network performance and radiation information, network vulnerability type, and access control information.

[0021] Preferably, the evaluation module includes a rating module, a safety evaluation matrix calculation module and an output module, and the specific operation steps are as follows:

[0022] The rating module is used to obtain the threat level corresponding to the historical fault data according to the threat value of the historical fault data; the threat level includes low fault threat level, medium fault threat level, and high fault threat level;

[0023] The security assessment matrix calculation module is used to construct a security assessment matrix S through the threat level and the threat value;

[0024] The safety assessment matrix S is:

[0025]

[0026] In the formula, the matrix S n (V) represents the threat value of the Vth historical fault data of the nth fault threat level;

[0027] The output module is used to obtain a safety assessment result by evaluating the safety assessment matrix.

[0028] Preferably, the output module includes an expert scoring module and a final evaluation processing module;

[0029] The expert scoring module is used to evaluate the safety assessment matrix through expert evaluation to obtain a safety assessment score;

[0030] The final assessment processing module is used to preset a final security assessment level, which includes a low security assessment level, a medium security assessment level, and a high security assessment level; and to preset a security assessment threshold, through which the security assessment score of the computer device is used to determine the current final security assessment level; the security assessment threshold includes a first security assessment score threshold z and a second security assessment score threshold c; the first security assessment score threshold z is greater than the second security assessment score threshold c.

[0031] Preferably, the final evaluation processing module specifically includes a primary judgment execution module and a secondary judgment module:

[0032] The primary judgment execution module is used to determine whether the security assessment score is greater than a preset first security assessment score threshold z; if so, the computer device is determined to have a high security assessment level; if not, the secondary judgment module is used to further determine whether the security assessment score is less than a second security assessment score threshold c; if so, the computer device is determined to have a low security assessment level; if not, the computer device is determined to have an intermediate security assessment level.

[0033] Preferably, the expert scoring module includes a second weight calculation module and an evaluation score output module:

[0034] The second weight calculation module is used to assign a weight to each sub-parameter value of the target network parameter using expert evaluation as the second weight B i ;

[0035] A second weight calculation module, used to obtain a safety assessment score by analyzing and calculating the first weight and the second weight;

[0036] Preferably, the second weight calculation module is specifically configured to calculate the weight K by i With the second weight B i Calculate the weight Y of the safety assessment index of each matrix element of the safety assessment matrix i ; The weight Y of the security assessment index of each matrix element i Normalization is performed to obtain the normalized safety assessment index weight Ri; according to the safety assessment index weight R of the ith matrix element of the normalized safety assessment matrix i Get the security assessment score of the network security system.

[0037] Preferably, the weight calculation formula of the safety assessment index is:

[0038] Y i =LB i +(1-L)K i ;

[0039] Where Y i It is represented as the weight of the safety assessment index of the i-th matrix element of the safety assessment matrix; L is the combination coefficient; K i is the first weight; B i is the second weight;

[0040] The calculation formula of the normalized safety assessment index weight Ri is:

[0041]

[0042] The calculation formula of the safety assessment score is:

[0043]

[0044] In the formula, λ o is the security assessment score of the network security system; R i is the weight of the safety assessment index of the i-th matrix element of the normalized safety assessment matrix; S ni is the fault threat level in the threat level of the i-th matrix element in the n-th row of the safety assessment matrix.

[0045] Preferably, the strong association processing module specifically includes a first strong association processing module and a sub-parameter combination processing module corresponding to the first screening or a second strong association processing module and a sub-parameter combination processing module corresponding to the second screening;

[0046] The first strong correlation processing module is used to initialize the random screening of sub-parameter combinations to be calculated; collect data of all selected sub-parameters to be calculated corresponding to the specific security event E; calculate the Pearson correlation coefficient between the current sub-parameter and the current specific security event E: for each sub-parameter X i , calculate the Pearson correlation coefficient between it and the current specific security event E

[0047]

[0048] Among them, X i,j is the sub-parameter X i The jth observation value of j is the jth observation value of the current specific security event E, and They are sub-parameters X i and the mean of current specific security events E;

[0049] The first screening corresponding sub-parameter combination processing module is used to select the sub-parameter with a higher absolute value of the Pearson correlation coefficient with the current specific security event, and only the sub-parameter type that is considered to belong to the same target network parameter is greater than N, and the sub-parameter with an absolute value of the Pearson correlation coefficient greater than or equal to the standard threshold is determined to be strongly associated; screening and selecting a combination of multiple randomly initialized sub-parameters to form a candidate set; continuously iterating the selection randomly, and then calculating multiple candidate sets; each candidate set represents a sub-parameter combination to be analyzed and calculated later;

[0050] or

[0051] The second strong correlation processing module is used to initialize the random screening of sub-parameter combinations to be calculated; collect the data of all selected sub-parameters to be calculated corresponding to the specific security event E; calculate the Pearson correlation coefficient between the current sub-parameter and the current specific security event E: for each sub-parameter X i , calculate the Pearson correlation coefficient between it and the current specific security event E

[0052]

[0053] Among them, X i,j is the sub-parameter X i The jth observation value of j is the jth observation value of the current specific security event E, and They are sub-parameters X i and the mean of current specific security events E;

[0054] The second screening corresponding sub-parameter combination processing module is used to select the sub-parameter with a higher absolute value of the Pearson correlation coefficient with the current specific security event, and only the sub-parameter type number of the sub-parameters belonging to the same target network parameter is greater than N, and the sub-parameter with an absolute value of the Pearson correlation coefficient greater than or equal to the standard threshold is determined to be strongly associated; screening and selecting a combination of multiple randomly initialized sub-parameters to form a candidate set; continuously randomly iterating the selection, and then calculating multiple candidate sets; each candidate set represents a sub-parameter combination to be analyzed and calculated later; taking it as the first sub-parameter combination; constructing the sub-parameter X based on the Apriori algorithm i The association rules of specific security events output frequent item sets in the form of X i →E, where X iis a sub-parameter, E is a specific security event; the frequent item set frequently includes a sub-parameter combination obtained by the Apriori algorithm, which is used as the second sub-parameter combination; the similarity of the sub-parameter types of the first sub-parameter combination and the second sub-parameter combination is calculated, and the sub-parameter combination with a similarity higher than the basic threshold is determined to obtain a set of final output sub-parameter combinations.

[0055] Preferably, the interactive computing node includes any one of a wireless router, a wireless routing switch, and a 5G communication module that establishes a communication connection with a computer device.

[0056] Compared with the prior art, the embodiments of the present invention have at least the following technical advantages:

[0057] From the analysis of the electromagnetic compatibility protection test and evaluation method for computer equipment provided by the present invention, it can be known that in specific applications, by installing interactive computing nodes, scanning the interactive computing nodes to obtain historical fault data in the historical network, the data of network attack events on computer equipment can be understood through the historical fault data, and the historical fault feature source is obtained by analyzing the historical fault data. The target network parameters are obtained through the historical fault feature source, the threat level that the historical fault data may cause to the computer equipment is evaluated, and the threat value is calculated through expert evaluation, which helps to ensure the data security of the computer equipment.

[0058] Specifically, the study first found the shortcomings of the existing multi-dimensional analysis method, that is, it may not be able to go deep into the network service. The study also studied why the existing methods cannot reach the kernel level of analysis. Possible reasons include insufficient depth of data collection, insufficient complexity of the analysis model, and lack of in-depth understanding of kernel behavior.

[0059] In order to solve this problem, it is necessary to improve the data collection mechanism to ensure that the target network parameters of deeper historical fault data can be collected, including the behavior log of the operating system kernel, system call records (access control information), network performance and radiation information (specific sub-parameters include network bandwidth, network packet loss rate, electromagnetic power density, specific absorption rate and electromagnetic compatibility information), etc.

[0060] This embodiment also screens the corresponding sub-parameter combination by discovering the connection between the specific security event and the different dimensional data of the kernel triggered by the event, and then performs subsequent calculations based on the screened sub-parameter group to discover the potential security threats of specific security events affected by multiple key kernel sub-parameters. This embodiment is designed by combining the first weight corresponding to the sub-parameter and the second weight of the sub-parameter assignment. This method not only considers the importance of different target network parameters (first weight), but also considers the impact of the specific assignment of these parameters on security (second weight). Through expert evaluation, each sub-parameter assignment in the target network parameter is assigned a weight to obtain the second weight; the first weight reflects the expert's evaluation of the parameter itself, and the second weight reflects the evaluation of the parameter assignment; this dual weight mechanism enhances the comprehensiveness and pertinence of the security assessment. At the same time, in the specific implementation, by setting different second weight coefficients for different assignments of each parameter, the security threats corresponding to different parameter assignments can be more finely evaluated, thereby realizing the refined management of network security threats and the refined calculation of risk assessment.

[0061] Ultimately, by normalizing the weights of the security assessment indicators and calculating the overall security assessment score of the computer equipment, the security assessment matrix can be used to more accurately describe the relationship between each security indicator and threat level, ultimately providing a powerful analysis for network security monitoring and defense. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 The overall flow chart of the electromagnetic compatibility protection test and evaluation method for computer equipment;

[0063] Figure 2 Flowchart for evaluating safety results of the electromagnetic compatibility protection test evaluation method for computer equipment;

[0064] Figure 3 Flowchart for calculating the evaluation score for the electromagnetic compatibility protection test evaluation method for computer equipment;

[0065] Figure 4 System architecture diagram for electromagnetic compatibility protection test evaluation of computer equipment;

[0066] Figure 5 A schematic diagram of the structure of the storage medium.

[0067] Reference numerals: analysis module 10 ; calculation module 20 ; evaluation module 30 ; processor 1110 ; communication interface 1120 ; memory 1130 ; computer storage medium 1140 . DETAILED DESCRIPTION

[0068] The present invention is further described in detail below through specific embodiments in conjunction with the accompanying drawings.

[0069] like Figure 1 As shown, the present invention provides an electromagnetic compatibility protection test and evaluation method for computer equipment, and the specific operation steps are as follows:

[0070] S10: collecting data from computer devices to obtain historical fault data in the historical network of each interactive computing node, and analyzing the historical fault information to obtain historical fault feature sources of each interactive computing node;

[0071] It should be noted that an interactive computing node is installed on the computer device (the above-mentioned interactive computing node is also called an interactive computing node, which is a device that provides an entry point to the core network of an enterprise or service provider. For example, wireless routers, wireless routing switches, 5G communication modules, etc., and the computer device can be scanned to obtain an interactive computing node that wirelessly communicates with the computer device), and the computer device is scanned through the interactive computing node to obtain each interactive computing node of the computer device; research has found that the source of attacks on many computer devices is received from the connected interactive computing nodes, and they are attacked by various complex interactive computing nodes on the network. In this process, the radiation signal changes, radiation signal anomalies, communication signal changes, etc. between them will be affected, thereby assisting other network vulnerabilities and access control information to effectively and comprehensively improve the accuracy of computer device security assessment.

[0072] The historical fault data of each interactive computing node in the historical network is obtained through each interactive computing node; the interactive computing node refers to the business platform built on the edge side of the network close to the user;

[0073] The historical fault data refers to the data of network attack events on computer equipment, and data such as the number of network attacks, the time of attacks and the frequency of attacks; the historical fault feature sources of each interactive computing node are analyzed by the historical fault data, and the distribution of the number of network attacks, the distribution of attack time and the change of attack frequency of the historical fault data of each interactive computing node are analyzed to obtain the historical fault feature sources;

[0074] The historical fault feature source refers to the interactive computing nodes that are frequently attacked among the interactive computing nodes and the fault reasons of the attacks on the interactive computing nodes. The fault reasons are obtained by analyzing the interactive computing nodes that are frequently attacked and the high-incidence periods of attacks through historical fault data. In addition, the analyzed fault reasons can also be used to know whether the network performance configuration of the computer equipment is secure and whether there are network vulnerabilities in the access control (after research, it is found that the performance of the network can be clearly understood through the configuration of the computer equipment, and whether it can play a safe protection role). The root cause of the fault event is tracked, such as the specific location of the vulnerability of the computer equipment and the specific reason for the vulnerability (that is, the location of the network attack and the reason why the network attack occurs. The location of the network attack is used to judge whether the attack point has an important factor of the computer equipment (that is, whether the location of the attack point is important, so as to evaluate whether the network security protection is safe); analyzing the cause of the attack can know why the network security equipment is attacked, thereby analyzing the cause of the vulnerability, and better evaluating the security protection to see whether the protection of the attacked point is in place);

[0075] S20: acquiring target network parameters according to the historical fault feature sources of each of the interactive computing nodes, and obtaining threat values ​​of historical fault data according to the target network parameters;

[0076] The target network parameters include network performance and radiation information, network vulnerabilities, and access control (network performance and radiation information, network vulnerability types, and access control information);

[0077] Specifically, in step S20, the threat value of the historical fault data is obtained according to the target network parameter, and the specific operation steps are as follows:

[0078] Preliminarily determine the current specific security incident;

[0079] Use the association rule mining algorithm in combination with the Pearson coefficient or use the Pearson coefficient independently to calculate and determine the sub-parameter combination that is strongly associated with the current specific security event (i.e. determine the target sub-parameter);

[0080] Assign a value to each sub-parameter in the target network parameter (i.e., the sub-parameter here is actually a strongly associated target sub-parameter of the above step) according to the historical fault data caused by the current specific security event, and obtain a parameter assignment corresponding to each sub-parameter (i.e., the target sub-parameter) (i.e., the parameter assignment is based on experience);

[0081] According to the expert evaluation, each sub-parameter in the target network parameter is assigned a corresponding weight, and the first weight K corresponding to each sub-parameter is obtained. i ;

[0082] By assigning each sub-parameter in the target network parameter a value corresponding to the first weight K corresponding to each sub-parameter i Multiply them to obtain the sub-threat value of each sub-parameter; sum the sub-threat values ​​of all the sub-parameters to obtain the threat value (i.e., obtain the threat value of the historical fault data). The above-mentioned expert evaluation method of assigning the first weight to the parameter is a prior art, and this application will not repeat it;

[0083] It should be noted that a numerical value is assigned to each parameter in the target network parameter according to the historical fault data; and a corresponding first weight is assigned to each parameter in the target network parameter according to the expert evaluation; the threat value corresponding to each sub-parameter is obtained by multiplying the value assigned to each parameter in the target network parameter with the first weight of each parameter in the target network parameter corresponding to it; the threat value of the target network parameter is obtained by adding each sub-parameter; the total threat value is calculated by each key parameter of the target network parameter to reflect the threat level of the historical fault data, and also prepare for the subsequent calculation of the safety assessment score to obtain the safety assessment result;

[0084] Obtain target network parameters based on historical fault feature sources of each interactive computing node. Target network parameters refer to key parameters related to network performance, network vulnerabilities, and access control.

[0085] Use target network parameters to evaluate the degree of threat that historical fault data may cause to computer equipment; indicate the potential impact of historical fault data on the security of computer equipment through threat values; obtain security assessment results of computer equipment based on the threat values ​​of historical fault data;

[0086] By analyzing historical fault feature sources to obtain target network parameters, these parameters are then used to assess the threat level of historical fault data to computer equipment, and finally to assess whether it is safe based on the threat value, which helps ensure the data security of computer equipment;

[0087] S30: Analyze the threat value of the historical fault data to obtain a security assessment result of the computer device;

[0088] It should be noted that the network security level of the computer equipment is set according to the threat value of the historical fault data, and the final security assessment result is obtained by evaluating the security level;

[0089] The above-mentioned embodiment of the present application obtains historical fault data in the historical network by installing an interactive computing node to scan the edge node, and understands the data of network attack events on computer equipment through the historical fault data, and obtains the historical fault feature source by analyzing the historical fault data, and finds the source information of the computer equipment through the historical fault feature source, so as to better protect the source information; obtains the target network parameters through the historical fault feature source, evaluates the threat level that the historical fault data may cause to the computer equipment, and calculates the threat value through expert evaluation, which helps to ensure the data security of the computer equipment.

[0090] First, the study found the shortcomings of the existing multi-dimensional analysis method, that is, it may not be able to go deep into the network service. The study studied why the existing methods cannot reach the kernel level of analysis. Possible reasons include insufficient depth of data collection, insufficient complexity of the analysis model, and lack of in-depth understanding of kernel behavior.

[0091] In order to solve this problem, it is necessary to improve the data collection mechanism to ensure that the target network parameters of deeper historical fault data can be collected, including operating system kernel behavior logs, system call records (access control information), network performance and radiation information, etc.

[0092] This embodiment also finds the connection between a specific security event and the different dimensional data of the kernel triggered by the event (such as the strong correlation between the change of strong radiation energy and the transmission rate and access rights, etc.), screens the corresponding sub-parameter combination, and then performs subsequent calculations based on the screened sub-parameter group to find the potential security threats of specific security events affected by multiple key kernel sub-parameters. In practice, electromagnetic leakage may also occur when transmitting large amounts of data. For example, network cards will generate certain electromagnetic radiation when transmitting video and network data, especially when transmitting large amounts of data, they will obviously generate stimulating electromagnetic radiation signals.

[0093] This embodiment is designed by combining the first weight corresponding to the sub-parameter and the second weight of the sub-parameter assignment. This method not only considers the importance of different target network parameters (first weight), but also considers the impact of the specific assignment of these parameters on security (second weight). The second weight is obtained by assigning weights to each sub-parameter assignment within the target network parameter through expert evaluation; the first weight reflects the expert's evaluation of the parameter itself, and the second weight reflects the evaluation of the parameter assignment; this dual weight mechanism enhances the comprehensiveness and pertinence of the security assessment. At the same time, in the specific implementation, by setting different second weight coefficients for different assignments of each parameter, the security threats corresponding to different parameter assignments can be more finely evaluated, thereby realizing the refined management of network security threats and the refined calculation of risk assessment.

[0094] Ultimately, by normalizing the weights of the security assessment indicators and calculating the overall security assessment score of the computer equipment, the security assessment matrix can be used to more accurately describe the relationship between each security indicator and threat level, ultimately providing a powerful analysis for network security monitoring and defense.

[0095] like Figure 2 As shown, in step S30, the security assessment result of the computer device is obtained by analyzing the threat value of the historical fault data. The specific operation steps are as follows:

[0096] S31: classifying the historical fault data according to the threat value of the historical fault data and a preset class classification threshold to obtain a fault threat level corresponding to the historical fault data; the threat level includes a low fault threat level, a medium fault threat level, and a high fault threat level;

[0097] S32: Establishing a safety assessment matrix S through the fault threat level and the threat value;

[0098] A security assessment matrix S is established by assigning a value to each sub-parameter in the target network parameter (the target network parameter should be a data, such as a value or data of each target network parameter in the historical fault data) through the fault threat level in the threat level (i.e., low fault threat, medium fault threat, and high fault threat);

[0099] The safety assessment matrix S is:

[0100]

[0101] Each row of the security assessment matrix represents a fault threat level in a different threat level; each column of the security assessment matrix represents each sub-parameter assignment in the target network parameter (the target network parameter should be a data, such as the value or data of each target network parameter in the historical fault data); each matrix element of the security assessment matrix represents that under the fault threat level in different threat levels, each sub-parameter assignment in the target network parameter represents a different possible dangerous state value; wherein, n represents the fault threat level in different threat levels; V represents each sub-parameter assignment in the target network parameter; S in the matrix n (V) represents the threat value of the Vth historical fault data of the nth fault threat level;

[0102] It should be noted that a security assessment matrix is ​​established based on the fault threat level in each threat level and each key parameter value in the target network parameter, and different dangerous state values ​​appear when each key parameter value in the target network parameter represents different fault threat levels;

[0103] The above security assessment indicators are similar to the above threat levels in that the security assessment indicators are used to determine the risk level of each sub-parameter within the target network parameters, while the above threat levels more directly indicate the threat level generated by historical fault data; both can indirectly indicate the security status generated when computer equipment was attacked in the past;

[0104] For example, the target network parameter sub-parameters mainly involve three aspects, namely network performance and radiation information, network vulnerability type and access control information; however, the sub-parameters are further divided into multiple aspects of descriptive and limiting features, specifically:

[0105] The network performance and radiation information includes sub-parameters such as network bandwidth, network packet loss rate, electromagnetic power density, specific absorption rate and electromagnetic compatibility information; Network bandwidth: refers to the transmission capacity of the network, which affects the speed and quality of data transmission. Wireless networks also have the concept of bandwidth, which is a very important technical indicator. The bandwidth of a wireless router refers to its maximum data transmission rate, usually measured in Mbps (megabits per second). Network packet loss rate: refers to the proportion of data packets lost during data transmission to the total number of data packets. Too high a packet loss rate will affect the reliability of data transmission.

[0106] Electromagnetic power density: The unit is watts per square meter, which represents the radiation power per unit area. Specific absorption rate (SAR value): refers to the electromagnetic radiation energy absorbed by a unit mass of a substance per unit time. SAR values ​​are commonly used internationally to measure the thermal effect of terminal radiation. Electromagnetic compatibility information: The compatibility of the network card in the electromagnetic environment ensures that it will not interfere with other devices and will not be interfered with by other electromagnetic sources. This embodiment divides the compatibility of the network card in the electromagnetic environment into three levels, namely, broad compatibility, medium compatibility and ordinary compatibility. Obviously, if the extracted information finds that the higher the compatibility level, the higher the value of the electromagnetic compatibility information, the better the anti-interference performance and the higher the security.

[0107] Wide compatibility: This network card can work normally in most complex electromagnetic environments and has strong anti-interference ability. This network card performs best in electromagnetic compatibility. Moderate compatibility: This network card can work normally in general electromagnetic environments and has strong anti-interference ability. This network card has good electromagnetic compatibility, but still has certain limitations.

[0108] The higher the electromagnetic compatibility, the higher the network transmission security. This is because: highly compatible network cards can resist the influence of external electromagnetic interference sources and ensure the integrity and reliability of data transmission. Strong anti-interference ability means that problems such as data loss or errors are not likely to occur.

[0109] Network vulnerability type, including sub-parameters such as system vulnerability (specifically, command injection vulnerability (e.g., the frequency of successful command injection vulnerability injections per unit time) or process design vulnerability (the frequency of process design vulnerability injections per unit time), buffer overflow vulnerability (the number of crashes caused by buffer overflow, the frequency of overflow vulnerability discovery));

[0110] "Command injection vulnerability" refers to the fact that attackers can inject malicious system commands into applications to gain control of the system. "Process design vulnerability" refers to the security vulnerability caused by timing problems when multiple processes access shared resources at the same time. Application vulnerability: refers to the security vulnerability existing in the application software itself, such as SQL injection, cross-site scripting, etc. Protocol vulnerability: refers to the security problem existing in the network communication protocol itself, such as SSL / TLS vulnerability, etc. Configuration vulnerability: refers to the security risk caused by improper configuration of the system or application, such as insecure password settings, etc.

[0111] The access control information includes sub-parameters which are various reference parameters, such as specific access rights information, access list information, access object authentication information, etc.;

[0112] The user access level (or simply permission) or user access priority; User access level (Permission Management): assign different permissions and permission levels to different users or systems. These permissions determine what operations they can perform on resources, such as reading, writing, executing, etc.; Access control list: refers to the management of access permission lists for system resources. Access control lists (ACLs) are used to define which users or systems can access specific network resources. Access object authentication information refers to the authentication complexity of user access login verification in the system, such as the processing of multi-factor authentication methods. It is generally believed that the more authentication methods there are, the higher the authentication value.

[0113] The analysis shows that although there is a large correlation between the characteristic factors of the above three aspects of information, this embodiment believes that the fine-grained analysis is not accurate enough. Therefore, it is necessary to determine the type of the current specific security event based on the preliminary judgment of the current specific security event. Some specific security events are single SQL attacks, while some are security event types formed by a combination of multiple attack forms; therefore, the strongly correlated sub-parameters between them (i.e., between specific sub-parameters such as network performance and radiation information and other access control information) must be different. For this reason, it is necessary to first conduct mining analysis based on the current specific security event to determine the strongly correlated sub-parameter combination, and then perform subsequent calculations.

[0114] When some network attacks occur, there are often attacks at the network protocol level. At this time, changes will occur in network performance, and some sub-parameters in the radiation information will also change significantly. At the same time, the sub-parameters of the access control information may also change in a linked manner. In this process, the strongly correlated sub-parameters between them are analyzed, which is crucial for the subsequent security assessment of computer equipment.

[0115] For example, the target network parameter sub-parameters mainly involve three aspects, namely network performance and radiation information, network vulnerability type and access control information; however, the sub-parameters are further divided into multiple aspects of descriptive and limiting features, specifically: network performance and radiation information includes sub-parameters such as network bandwidth, network packet loss rate, electromagnetic power density, specific absorption rate and electromagnetic compatibility information; network vulnerability type includes sub-parameters such as system vulnerability (specifically, it can be a command injection vulnerability or a process design vulnerability; access control information includes sub-parameters such as access permission information, access list information, access object authentication information, etc.;

[0116] How to filter sub-parameters to determine the strong correlation between a specific security event and multiple filtered sub-parameters, and use the Pearson coefficient to determine the explanation.

[0117] First, determine the type of a specific security event; then determine some sub-parameter variables of that type of specific security event:

[0118] For example, first determine a specific security event E, define the initialization of a random selection of a combination of random sub-parameters of the specific security event E, and then filter out strongly correlated sub-parameter combinations:

[0119] Step 101: Initialize random screening of sub-parameter combinations to be calculated. Specifically, for network performance and radiation information, select specific absorption rate T, electromagnetic power density G, electromagnetic compatibility information J, network packet loss rate D, and network bandwidth B; for system vulnerability V ("frequency of occurrence of process design vulnerabilities per unit time", "number of crashes caused by buffer overflow", "frequency of discovery of overflow vulnerabilities" in process design vulnerabilities); for access permission information, select permission information A permissions and access object authentication information, i.e. A authentication degree;

[0120] Step 102: Implement data processing of collected sub-parameters, that is, collect data of specific security event E and data of all the above sub-parameters.

[0121] Step 103: Calculate the Pearson correlation coefficient between the current sub-parameter and the current specific security event E: For each sub-parameter X i , calculate the Pearson correlation coefficient r between it and the current specific security event E XiE :

[0122]

[0123] Among them, X i,j is the sub-parameter X i The jth observation value of j is the jth observation value of the current specific security event E (or the current target security event), and They are sub-parameters X i and the mean of the current specific security events E.

[0124] Step 104: Filter the corresponding sub-parameter combination: select the sub-parameter with a higher absolute value of the Pearson correlation coefficient with the current specific security event E. Generally, only when the number of types of sub-parameters belonging to the same target network parameter partition type is greater than N (N=2), and the absolute value of the sub-parameter and the Pearson correlation coefficient is greater than or equal to the standard threshold (e.g., 0.6) is considered to be strongly correlated; for example, assuming that the calculated absolute values ​​of "the frequency of occurrence of process design vulnerabilities per unit time", "the number of crashes caused by buffer overflows", and "the frequency of discovery of overflow vulnerabilities" in the partition type of the same target network parameter are all greater than the standard threshold, then the three belong to the same target network parameter partition type, so the three can be used as strongly correlated sub-parameters; on the contrary, if, assuming that the calculated absolute values ​​of "the frequency of occurrence of process design vulnerabilities per unit time", "the number of crashes caused by buffer overflows", and "the frequency of discovery of overflow vulnerabilities" in the partition type of the same target network parameter are only one "the number of crashes caused by buffer overflows" is greater than 0.7, and the other two are less than 0.7, then the entire sub-parameter of "the number of crashes caused by buffer overflows" is discarded together, and no sub-parameter combination calculation is performed.

[0125] The above analysis method is to screen the sub-parameters of the same target network parameter and the sub-parameter combinations that meet the conditions of the Pearson correlation coefficient. If the number of sub-parameters of the same target network parameter is greater than N, it means that the same target network parameter is more important. For example, if 10 of the same target network parameters are greater than 0.7, it means that the type of the same target network parameter is very important, so the one that selects N should be discarded.

[0126] Step 105: Screen and select a combination of multiple randomly initialized sub-parameters to form a candidate set; continuously perform random iterative selection, and then calculate multiple candidate sets; each candidate set represents a sub-parameter combination to be subsequently analyzed and calculated;

[0127] However, in order to further strengthen the screening of sub-parameter combinations, the following solution can also be adopted, that is, an association rule mining algorithm, such as the Apriori algorithm, can be used to discover strongly associated sub-parameter combinations. Then, step 106 is executed, that is, step 106: construct sub-parameter X based on the Apriori algorithm. i The association rules of specific security events output frequent item sets in the form of X i →E, where X i is a sub-parameter, E is a specific security event; the frequent item set includes the sub-parameter combination obtained by the Apriori algorithm, which is used as the second sub-parameter combination; the similarity of the sub-parameter type of the first sub-parameter combination and the second sub-parameter combination is calculated, and the sub-parameter combination with a similarity higher than the basic threshold is determined, thereby obtaining a set of final output sub-parameter combinations. That is, the similarity of the sub-parameter combination of step 106 and step 105 is determined, and the sub-parameter combination with a relatively high similarity is determined, thereby obtaining a set of sub-parameter combinations whose final output is an enhanced set, and performing subsequent calculation processing of sub-parameter combinations.

[0128] Alternatively, the following parallel scheme is adopted, that is, the Pearson coefficient is used alone to calculate and determine the strongly correlated sub-parameter combination of the current specific security event; that is, step 101-step 105 and then end directly.

[0129] Step 101: Initialize random selection of sub-parameter combinations to be calculated;

[0130] Step 102: Collect data of all sub-parameters to be calculated corresponding to the specific security event E;

[0131] Step 103: Calculate the Pearson correlation coefficient between the current sub-parameter and the current specific security event E: For each sub-parameter X i , calculate the Pearson correlation coefficient r between it and the current specific security event E XiE :

[0132]

[0133] Among them, X i,j is the sub-parameter X i The jth observation value of j is the jth observation value of the current specific security event E, and They are sub-parameters X i and the mean of current specific security events E;

[0134] Step 104: Filter the corresponding sub-parameter combination: select the sub-parameter with a higher absolute value of the Pearson correlation coefficient with the current specific security event, and only the sub-parameters of the same target network parameter whose number of types is greater than N and whose absolute value of the Pearson correlation coefficient is greater than or equal to the standard threshold are considered to be strongly correlated;

[0135] Step 105: Screen and select a combination of multiple randomly initialized sub-parameters to form a candidate set; continuously perform random iterative selection, and then calculate multiple candidate sets; each candidate set represents a sub-parameter combination to be subsequently analyzed and calculated; and use it as the first sub-parameter combination;

[0136] It ends immediately.

[0137] S33: Evaluate the safety assessment matrix by expert evaluation to obtain a safety assessment score;

[0138] It should be noted that the security assessment matrix is ​​evaluated by network security experts to obtain a security assessment score, the security of the security assessment matrix is ​​determined, and the security assessment result is obtained by evaluating the security assessment matrix;

[0139] S34: Preset a final safety assessment level, wherein the preset final safety assessment level includes a low safety assessment level, a medium safety assessment level, and a high safety assessment level;

[0140] and presetting a security assessment threshold, and determining the current final security assessment level of the security assessment score of the computer device by using the security assessment threshold;

[0141] Finally, an assessment security result of the computer device is obtained according to the current final security assessment level.

[0142] It should be noted that after the computer device obtains a security assessment score, a final security assessment level is preset, and the security assessment score of the computer device is checked in which preset final security assessment level (i.e., low security assessment level, medium security assessment level, and high security assessment level), and finally it is determined whether the assessment security result of the computer device is safe (i.e., through the low security assessment level, medium security assessment level, or high security assessment level, it is determined whether the computer device is at low risk, medium risk, or high risk, thereby obtaining the security assessment result of the computer device);

[0143] Specifically determined as follows: presetting a security assessment threshold, wherein the security assessment threshold includes a first security assessment score threshold z and a second security assessment score threshold c;

[0144] The first safety assessment score threshold z is greater than the second safety assessment score threshold c;

[0145] Determine whether the safety assessment score is greater than a preset first safety assessment score threshold z;

[0146] If the security assessment score is greater than a preset first security assessment score threshold z, the computer device has a high security assessment level (i.e., the security assessment score is greater than 7);

[0147] If the security assessment score is less than or equal to a preset first security assessment score threshold z, further determining whether the security assessment score is less than a second security assessment score threshold c;

[0148] If the security assessment score is less than the preset second security assessment score threshold c, the computer device has a low security assessment level (that is, the security assessment score is less than 3);

[0149] If the security assessment score is greater than or equal to the preset second security assessment score threshold c, it is determined that the security assessment score is less than the preset first security assessment score threshold z and greater than the preset second security assessment score threshold c, and the computer device is at an intermediate security assessment level (i.e., 3 < security assessment score < 7);

[0150] The final security assessment level is determined by the size of the security assessment score, so that it can be accurately determined whether the computer equipment is at high risk, low risk, or medium risk;

[0151] The threat value of the embodiment of the present application divides the historical fault data into threat levels, and establishes a security assessment matrix S through the threat level and the target network parameter. The security assessment matrix S indicates that each matrix element represents a fault threat level in different threat levels, and each sub-parameter value in the target network parameter represents a different dangerous state value that may be encountered;

[0152] The security assessment matrix is ​​evaluated by experts to obtain a security assessment score, and the security of the security assessment matrix is ​​determined; finally, the final security assessment level is preset to determine the current final security assessment level, thereby obtaining the security assessment result of the computer equipment;

[0153] Specifically, Figure 3 As shown, in step S33, the safety assessment matrix is ​​evaluated by expert evaluation to obtain a safety assessment score. The specific operation steps are as follows:

[0154] S331: Assign a weight to each sub-parameter value of the target network parameter using expert evaluation as a second weight B i ;

[0155] It should be noted that the second weight is obtained by assigning weights to different target network parameters of the security assessment matrix based on the experience of different experts;

[0156] The second weight is obtained by assigning a weight to each sub-parameter value within the target network parameter through expert evaluation; the first weight reflects the expert's evaluation of the parameter itself, and the second weight reflects the evaluation of the parameter value;

[0157] The first weight is used to measure the relative importance of each sub-parameter within different target network parameters to security, and the second weight is used to measure the relative importance of each sub-parameter assignment within different target network parameters to security;

[0158] First, assign a value to each sub-parameter within the target network parameter; then experts evaluate the security risk level corresponding to each sub-parameter value and give a score of 1-10; the higher the score, the greater the security threat corresponding to each sub-parameter value (e.g., network performance can be high / medium / low, network vulnerability can be serious / medium / minor, etc.);

[0159] For different values ​​of the same parameter, the scores given by experts will be different, and these scores constitute the second weight coefficient of the parameter;

[0160] Take network performance as an example:

[0161] When the network performance is assigned a high value, the expert evaluation score is 3 points;

[0162] When the network performance is assigned a medium value, the expert evaluation score is 6 points;

[0163] When the network performance is assigned a low value, the expert evaluation score is 9 points;

[0164] The three scores constitute the second weight coefficient for network performance assignment;

[0165] Similarly, other parameters such as network vulnerabilities and access control also have their respective second weight coefficients based on expert evaluation;

[0166] Formulate a safety assessment score for the weight of the safety assessment indicator of each matrix element within the safety assessment matrix according to the second weight and the first weight;

[0167] S332: Calculate the weight of the safety assessment index of each matrix element of the safety assessment matrix by using the first weight and the second weight. The calculation formula is:

[0168] Y i =LB i +(1-L)K i ;

[0169] Where Yi It is represented as the weight of the safety assessment index of the i-th matrix element of the safety assessment matrix; L is the combination coefficient; K i is the first weight; B i is the second weight;

[0170] Through the above formula, the weight of the weighted security assessment index of each matrix element can be obtained, and it reflects the importance of different target network parameters according to the experience of different experts;

[0171] First, a first weight is assigned to each sub-parameter itself (the sum of the first weights of all parameters in the current evaluation process is 1), and then a second weight is assigned to the value of each sub-parameter (the sum of the second weights assigned to all parameters in each evaluation event is 1);

[0172] The first weight and the second weight are combined to obtain the weight of the security assessment index of each matrix element, which can more accurately reflect the security situation of the computer device; after the weight of the security assessment index of each matrix element is normalized, the evaluation security assessment score of the computer device is obtained, and the security level of the computer device is divided according to the final overall evaluation security assessment score of the computer device;

[0173] From the above, it can be seen that the first weight is the importance of the parameter itself and the second weight is the security of the parameter assignment, which can enhance the comprehensiveness and pertinence of the security assessment; and by filling the security assessment matrix with the weights of the security assessment indicators, the relationship between each security indicator and the threat level can be more accurately described.

[0174] S333: The weight Y of the security assessment index of each matrix element is i Normalize and get the normalized safety assessment index weight Ri, the calculation formula is:

[0175]

[0176] According to the weight R of the safety assessment index of the i-th matrix element of the normalized safety assessment matrix i Get the security assessment score of the network security system:

[0177]

[0178] In the formula, λ o is the security assessment score of the network security system; R i is the weight of the safety assessment index of the i-th matrix element of the normalized safety assessment matrix; S ni is the fault threat level in the threat level of the ith matrix element in the nth row of the safety assessment matrix;

[0179] It can be seen from the above formula that after the weight of the safety assessment index of each matrix element is normalized, the normalized weight of the safety assessment index of each matrix element and the fault threat level in the threat level of each matrix element are used to obtain the final safety assessment score;

[0180] It should be noted that the safety assessment matrix covers different types of safety indicators and fault threat levels, reflecting multiple dimensions of safety; however, the weight of each safety indicator is reflected through the matrix element Ri, which can accurately reflect the relative importance of each safety indicator;

[0181] The matrix element Ri and the corresponding fault threat level S ni By multiplying them together, we can quantify the impact of each threat level on the security of computer equipment; by calculating the two, we can get the overall security assessment score that comprehensively considers various security indicators and threat factors;

[0182] Through the above embodiment, expert evaluation is used to assign a weight to each sub-parameter value of the target network parameter as the second weight B i , the second weight is used to measure the relative importance of each sub-parameter assignment within different target network parameters to security; and the weight of the security assessment index of each matrix element of the security assessment matrix is ​​further calculated through the second weight, which can more accurately reflect the security situation of the computer equipment; and the weight of the security assessment index of each matrix element is normalized to obtain the security assessment score of the network security system;

[0183] like Figure 4 As shown, the present invention also provides an electromagnetic compatibility protection test and evaluation system for computer equipment, comprising: an analysis module 10, a calculation module 20, and an evaluation module 30;

[0184] The analysis module 10 is used to collect data from the computer equipment to obtain historical fault data in the historical network of each interactive computing node, and analyze the historical fault information to obtain the historical fault feature source of each interactive computing node;

[0185] A calculation module 20, configured to obtain target network parameters according to the historical fault feature sources of each interactive calculation node, and obtain a threat value of the historical fault data according to the target network parameters;

[0186] The evaluation module 30 is used to analyze the threat value of the historical fault data to obtain a security evaluation result of the computer device.

[0187] Preferably, the calculation module 20 includes an initial event determination module, a strong association processing module, a value assignment calculation module, a weight calculation module and a summation processing module:

[0188] The initial event determination module is used to preliminarily determine the current specific security event;

[0189] The strong association processing module is used to calculate and determine the strong association sub-parameter combination of the current specific security event using an association rule mining algorithm combined with the Pearson coefficient or using the Pearson coefficient independently;

[0190] The value assignment calculation module is used to assign a value to each sub-parameter in the target network parameter according to the historical fault data caused by the current specific security event, so as to obtain a parameter assignment corresponding to each sub-parameter;

[0191] The weight calculation module is used to assign a corresponding weight to each sub-parameter in the target network parameter according to the expert evaluation, and obtain a first weight K corresponding to each sub-parameter. i ;

[0192] The summation processing module is used to assign a first weight K corresponding to each sub-parameter in the target network parameter. i Multiply them to obtain the sub-threat value of each sub-parameter; sum the sub-threat values ​​of all the sub-parameters to obtain the threat value; the target network parameters include network performance and radiation information, network vulnerability type, and access control information.

[0193] Preferably, the evaluation module 30 includes a rating module, a safety evaluation matrix calculation module and an output module, and the specific operation steps are as follows:

[0194] The rating module is used to obtain the threat level corresponding to the historical fault data according to the threat value of the historical fault data; the threat level includes low fault threat level, medium fault threat level, and high fault threat level;

[0195] The security assessment matrix calculation module is used to construct a security assessment matrix S through the threat level and the threat value;

[0196] The safety assessment matrix S is:

[0197]

[0198] In the formula, the matrix S n (V) represents the threat value of the Vth historical fault data of the nth fault threat level;

[0199] The output module is used to obtain a safety assessment result by evaluating the safety assessment matrix.

[0200] Preferably, the output module includes an expert scoring module and a final evaluation processing module;

[0201] The expert scoring module is used to evaluate the safety assessment matrix through expert evaluation to obtain a safety assessment score;

[0202] The final assessment processing module is used to preset a final security assessment level, which includes a low security assessment level, a medium security assessment level, and a high security assessment level; and to preset a security assessment threshold, through which the security assessment score of the computer device is used to determine the current final security assessment level; the security assessment threshold includes a first security assessment score threshold z and a second security assessment score threshold c; the first security assessment score threshold z is greater than the second security assessment score threshold c.

[0203] Preferably, the final evaluation processing module specifically includes a primary judgment execution module and a secondary judgment module:

[0204] The primary judgment execution module is used to determine whether the security assessment score is greater than a preset first security assessment score threshold z; if so, the computer device is determined to have a high security assessment level; if not, the secondary judgment module is used to further determine whether the security assessment score is less than a second security assessment score threshold c; if so, the computer device is determined to have a low security assessment level; if not, the computer device is determined to have an intermediate security assessment level.

[0205] Preferably, the expert scoring module includes a second weight calculation module and an evaluation score output module:

[0206] The second weight calculation module is used to assign a weight to each sub-parameter value of the target network parameter using expert evaluation as the second weight B i ;

[0207] A second weight calculation module, used to obtain a safety assessment score by analyzing and calculating the first weight and the second weight;

[0208] Preferably, the second weight calculation module is specifically configured to calculate the weight K by i With the second weight B i Calculate the weight Y of the safety assessment index of each matrix element of the safety assessment matrix i ; The weight Y of the security assessment index of each matrix element i Normalization is performed to obtain the normalized safety assessment index weight Ri; according to the safety assessment index weight R of the ith matrix element of the normalized safety assessment matrix i Get the security assessment score of the network security system.

[0209] Preferably, the weight calculation formula of the safety assessment index is:

[0210] Y i =LB i +(1-L)K i ;

[0211] Where Y i It is represented as the weight of the safety assessment index of the i-th matrix element of the safety assessment matrix; L is the combination coefficient; K i is the first weight; B i is the second weight;

[0212] The calculation formula of the normalized safety assessment index weight Ri is:

[0213]

[0214] The calculation formula of the safety assessment score is:

[0215]

[0216] In the formula, λ o is the security assessment score of the network security system; R i is the weight of the safety assessment index of the i-th matrix element of the normalized safety assessment matrix; S ni is the fault threat level in the threat level of the i-th matrix element in the n-th row of the safety assessment matrix.

[0217] Preferably, the strong association processing module specifically includes a first strong association processing module and a sub-parameter combination processing module corresponding to the first screening or a second strong association processing module and a sub-parameter combination processing module corresponding to the second screening;

[0218] The first strong correlation processing module is used to initialize the random screening of sub-parameter combinations to be calculated; collect data of all selected sub-parameters to be calculated corresponding to the specific security event E; calculate the Pearson correlation coefficient between the current sub-parameter and the current specific security event E: for each sub-parameter X i , calculate the Pearson correlation coefficient between it and the current specific security event E

[0219]

[0220] Among them, X i,j is the sub-parameter X i The jth observation value of j is the jth observation value of the current specific security event E, and They are sub-parameters X i and the mean of current specific security events E;

[0221] The first screening corresponding sub-parameter combination processing module is used to select the sub-parameter with a higher absolute value of the Pearson correlation coefficient with the current specific security event, and only the sub-parameter type that is considered to belong to the same target network parameter is greater than N, and the sub-parameter with an absolute value of the Pearson correlation coefficient greater than or equal to the standard threshold is determined to be strongly associated; screening and selecting a combination of multiple randomly initialized sub-parameters to form a candidate set; continuously iterating the selection randomly, and then calculating multiple candidate sets; each candidate set represents a sub-parameter combination to be analyzed and calculated later;

[0222] Or the second strong correlation processing module is used to initialize the random screening of the sub-parameter combination to be calculated; collect the data of all the selected sub-parameters to be calculated corresponding to the specific security event E; calculate the Pearson correlation coefficient between the current sub-parameter and the current specific security event E: for each sub-parameter X i , calculate the Pearson correlation coefficient between it and the current specific security event E

[0223]

[0224] Among them, X i,j is the sub-parameter X i The jth observation value of j is the jth observation value of the current specific security event E, and They are sub-parameters X i and the mean of current specific security events E;

[0225] The second screening corresponding sub-parameter combination processing module is used to select the sub-parameter with a higher absolute value of the Pearson correlation coefficient with the current specific security event, and only the sub-parameter type number of the sub-parameters belonging to the same target network parameter is greater than N, and the sub-parameter with an absolute value of the Pearson correlation coefficient greater than or equal to the standard threshold is determined to be strongly associated; screening and selecting a combination of multiple randomly initialized sub-parameters to form a candidate set; continuously randomly iterating the selection, and then calculating multiple candidate sets; each candidate set represents a sub-parameter combination to be analyzed and calculated later; taking it as the first sub-parameter combination; constructing the sub-parameter X based on the Apriori algorithm i The association rules of specific security events output frequent item sets in the form of X i →E, where X iis a sub-parameter, E is a specific security event; the frequent item set frequently includes a sub-parameter combination obtained by the Apriori algorithm, which is used as the second sub-parameter combination; the similarity of the sub-parameter types of the first sub-parameter combination and the second sub-parameter combination is calculated, and the sub-parameter combination with a similarity higher than the basic threshold is determined to obtain a set of final output sub-parameter combinations.

[0226] like Figure 5 As shown, this embodiment three is based on the electromagnetic compatibility protection test and evaluation method for computer equipment provided in embodiment one of the invention, and also provides a computer storage medium 1140 (referred to as storage medium), which includes: a memory 1130, used to store computer programs; a communication interface 1120, used to connect the memory 1130 with the processor 1110; the processor 1110, used to execute the computer program, and implement the electromagnetic compatibility protection test and evaluation method for computer equipment disclosed in the embodiment as a combination of any of the above-mentioned implementation methods.

[0227] In summary, the electromagnetic compatibility protection test and evaluation method for computer equipment proposed in the example of the present invention obtains historical fault data in the historical network by installing an interactive computing node to scan the edge node, and obtains data of network attack events on the computer equipment through the historical fault data, and obtains historical fault feature sources by analyzing the historical fault data, and finds the source information of the attack on the computer equipment through the historical fault feature sources, so as to provide better security protection; obtains target network parameters through the historical fault feature sources, evaluates the threat level that the historical fault data may cause to the computer equipment, and calculates the threat value through expert evaluation, which helps to ensure the data security of the computer equipment;

[0228] Further, the historical fault data is divided into threat levels according to the threat value, and a safety assessment matrix X is established according to the threat level and the target network parameter. The safety assessment matrix X indicates that each matrix element represents a fault threat level in different threat levels, and each sub-parameter value in the target network parameter represents a different possible dangerous state value;

[0229] The security assessment matrix is ​​evaluated by expert evaluation to obtain a security assessment score, and the security of the security assessment matrix is ​​determined; finally, the final security assessment level is preset to determine the current final security assessment level, thereby obtaining the evaluation security result of the computer device; further, the expert evaluation is used to assign a weight to each sub-parameter value of the target network parameter, as the second weight B iThe second weight is to measure the relative importance of each sub-parameter assignment within different target network parameters to security; and the weight of the security assessment index of each matrix element of the security assessment matrix is ​​further calculated through the second weight, which can more accurately reflect the security situation of the computer device; and the weight of the security assessment index of each matrix element is normalized to obtain the security assessment score of the network security system, thereby finally outputting an accurate and comprehensive security assessment process for the computer device.

[0230] Finally, it should be noted that a person skilled in the art may modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An electromagnetic compatibility protection test and evaluation system for computer equipment, characterized in that: The following operation steps are included: analysis module, calculation module, and evaluation module; The analysis module is used to collect data from computer equipment to obtain historical fault data in the historical network of each interactive computing node, and analyze the historical fault data to obtain the historical fault feature source of each interactive computing node; The calculation module is used to obtain target network parameters according to the historical fault feature sources of each interactive computing node, and obtain the threat value of the historical fault data according to the target network parameters; The evaluation module is used to analyze the threat value of the historical fault data to obtain a security evaluation result of the computer device; The calculation module includes an initial event determination module, a strong association processing module, an assignment calculation module, a weight calculation module and a summation processing module: The initial event determination module is used to preliminarily determine the current specific security event E; The strong association processing module is used to calculate and determine the strongly associated sub-parameter combination of the current specific security event E using an association rule mining algorithm in combination with the Pearson coefficient or using the Pearson coefficient independently; The value assignment calculation module is used to assign a value to each sub-parameter in the target network parameter according to the historical fault data caused by the current specific security event E, and obtain a parameter assignment corresponding to each sub-parameter; The weight calculation module is used to assign a corresponding weight to each sub-parameter in the target network parameter according to the expert evaluation, and obtain a first weight corresponding to each sub-parameter ; The summation processing module is used to assign a first weight corresponding to each sub-parameter in the target network parameter Multiplying them to obtain a sub-threat value of each sub-parameter; summing up the sub-threat values ​​of all the sub-parameters to obtain a threat value; the target network parameters include network performance and radiation information, network vulnerability type, and access control information; The strong association processing module specifically includes a first strong association processing module and a sub-parameter combination processing module corresponding to the first screening or a second strong association processing module and a sub-parameter combination processing module corresponding to the second screening; The first strong correlation processing module is used to initialize the random selection of sub-parameter combinations to be calculated; Collect the data of all selected sub-parameters to be calculated corresponding to the current specific security event E; calculate the Pearson correlation coefficient between the current sub-parameter and the current specific security event E: for each sub-parameter , calculate the Pearson correlation coefficient between it and the current specific security event E : ;in, It is a sub-parameter No. Observations, Is the current specific security event E Observations, and The sub-parameters are and the mean of current specific security events E; The first screening corresponding sub-parameter combination processing module is used to select the sub-parameter with a higher absolute value of the Pearson correlation coefficient with the current specific security event E, and only the sub-parameter type number of the sub-parameters belonging to the same target network parameter is greater than N, and the sub-parameter with an absolute value of the Pearson correlation coefficient greater than or equal to the standard threshold is determined to be strongly associated; screening and selecting a combination of multiple randomly initialized sub-parameters to form a candidate set; continuously iterating the selection randomly, and then calculating multiple candidate sets; each candidate set represents a sub-parameter combination to be analyzed and calculated later; or The second strong correlation processing module is used to initialize the random selection of sub-parameter combinations to be calculated; collect the data of all selected sub-parameters to be calculated corresponding to the current specific security event E; calculate the Pearson correlation coefficient between the current sub-parameter and the current specific security event E: for each sub-parameter , calculate the Pearson correlation coefficient between it and the current specific security event E : ;in, It is a sub-parameter No. Observations, Is the current specific security event E Observations, and The sub-parameters are and the mean of current specific security events E; The second screening corresponding sub-parameter combination processing module is used to select the sub-parameter with a higher absolute value of the Pearson correlation coefficient with the current specific security event E, and only the sub-parameter type number of the sub-parameters belonging to the same target network parameter is greater than N, and the sub-parameter with an absolute value of the Pearson correlation coefficient greater than or equal to the standard threshold is judged to be strongly associated; screening and selecting a combination of multiple randomly initialized sub-parameters to form a candidate set; continuously iterating the selection randomly, and then calculating multiple candidate sets; each candidate set represents a sub-parameter combination to be analyzed and calculated later; taking it as the first sub-parameter combination; constructing a sub-parameter based on the Apriori algorithm The association rule output of a specific security event E is a frequent item set in the form of ,in is a sub-parameter, and E is a current specific security event; the frequent item set includes a sub-parameter combination obtained by the Apriori algorithm, which is used as a second sub-parameter combination; the similarity of the sub-parameter types of the first sub-parameter combination and the second sub-parameter combination is calculated, and the sub-parameter combination with a similarity higher than a basic threshold is determined to obtain a set of final output sub-parameter combinations.

2. The electromagnetic compatibility protection test and evaluation system for computer equipment according to claim 1, characterized in that: The evaluation module includes a rating module, a safety evaluation matrix calculation module and an output module. The specific operation steps are as follows: The rating module is used to obtain the threat level corresponding to the historical fault data according to the threat value of the historical fault data; the threat level includes low fault threat level, medium fault threat level, and high fault threat level; The security assessment matrix calculation module is used to construct a security assessment matrix S through the threat level and the threat value; The safety assessment matrix S is: ; In the formula, the matrix The threat value of the Vth historical fault data representing the threat level of the nth fault; The output module is used to obtain a safety assessment result by evaluating the safety assessment matrix.

3. The electromagnetic compatibility protection test and evaluation system for computer equipment according to claim 2, characterized in that: The output module includes an expert scoring module and a final evaluation processing module; The expert scoring module is used to evaluate the safety assessment matrix through expert evaluation to obtain a safety assessment score; The final assessment processing module is used to preset a final security assessment level, which includes a low security assessment level, a medium security assessment level, and a high security assessment level; and to preset a security assessment threshold, through which the security assessment score of the computer device is used to determine the current final security assessment level; the security assessment threshold includes a first security assessment score threshold z and a second security assessment score threshold c; the first security assessment score threshold z is greater than the second security assessment score threshold c.

4. The electromagnetic compatibility protection test and evaluation system for computer equipment according to claim 3, characterized in that: The final evaluation processing module specifically includes a primary judgment execution module and a secondary judgment module: The primary judgment execution module is used to judge whether the security assessment score is greater than a preset first security assessment score threshold z; if so, the computer device is determined to have a high security assessment level; if not, the secondary judgment module is used to judge whether the security assessment score is less than a second security assessment score threshold c; if so, the computer device is determined to have a low security assessment level; if not, the computer device is determined to have an intermediate security assessment level.

5. The electromagnetic compatibility protection test and evaluation system for computer equipment according to claim 4, characterized in that: The expert scoring module includes a second weight calculation module and an evaluation score output module: The second weight calculation module is used to assign a weight to each sub-parameter value of the target network parameter using expert evaluation as a second weight ; The second weight calculation module is used to obtain a safety assessment score by analyzing and calculating the first weight and the second weight.

6. The electromagnetic compatibility protection test and evaluation system for computer equipment according to claim 5, characterized in that: The second weight calculation module is specifically configured to calculate the weight of With the second weight Calculate the weight of the safety assessment index of each matrix element of the safety assessment matrix ; The weight of the security assessment index of each matrix element Normalize and get the weight of the normalized security assessment index ; The weight of the safety assessment index of the i-th matrix element of the normalized safety assessment matrix Get the security assessment score of the network security system.

7. The electromagnetic compatibility protection test and evaluation system for computer equipment according to claim 6, characterized in that: The weight calculation formula of the safety assessment index is: ; In the formula, It is represented as the weight of the safety assessment index of the i-th matrix element of the safety assessment matrix; L is the combination coefficient; is the first weight; is the second weight; The weight of the normalized security assessment indicator The calculation formula is: ; The calculation formula of the safety assessment score is: ; In the formula, Provide security assessment scores for network security systems; is the weight of the safety assessment index of the i-th matrix element of the normalized safety assessment matrix; is the fault threat level in the threat level of the i-th matrix element in the n-th row of the safety assessment matrix.

8. The electromagnetic compatibility protection test and evaluation system for computer equipment according to claim 7, characterized in that: The interactive computing node includes any one of a wireless router, a wireless routing switch, and a 5G communication module that establishes a communication connection with a computer device.

Images