Security management method and system based on computer information resources and storage medium

Abstract

The invention relates to the technical field of information resource security management, and particularly discloses a security management method and system based on computer information resources and a storage medium, and the method comprises the steps: obtaining user identification information of a user, extracting a reference evaluation information set, analyzing a user behavior abnormal evaluation value, and judging a user behavior tag. If the user behavior label is judged to be in a potential risk mode, communication end current limiting is carried out, abnormal secondary verification is started, a user behavior abnormal verification evaluation value is analyzed, user behavior label re-judgment is carried out, and user permission locking measures are determined. Potential risks can be perceived in time, the situation that potential safety hazards are gradually expanded under the condition that the potential safety hazards are not perceived is avoided, and the user permission locking accuracy is improved. For a potential risk mode, communication end current limiting is carried out and secondary verification is started, so that network activities of abnormal users are effectively limited, security risks are reduced, the risk degree of user behaviors is comprehensively and accurately judged, and the stability of the system and the security of information resources are guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of information resource security management, and in particular to a security management method, system and storage medium based on computer information resources. Background Art

[0002] In the digital age, computer information resources play a vital role in the daily operations of various organizations and individuals. However, with the rapid development of information technology and the widespread popularity of the Internet, if the security management of information resources is not good, it may lead to data leakage, information loss and other problems. Although there are some basic security protection measures, such as firewalls and encryption algorithms, the security management of information in actual use still faces many severe challenges. As the direct user of information resources, users' operating behaviors are complex, diverse and uncertain, which may have a significant impact on the security of information resources.

[0003] For example, the invention patent with announcement number CN111476560B announces a resource management method and a computer-readable storage medium, the method comprising: a first business server receives a merged document processing request sent by a first terminal, and determines a target terminal from at least one second terminal using the merged document data carried in the document processing request, and sends the merged document data to the target terminal; after receiving the merged document data, the target terminal performs signature processing on the merged document data, obtains a signature processing result and sends it to the first business server; after receiving the signature processing result, the first business server determines a first resource request corresponding to the signature processing result and sends it to the second business server; the second business server obtains transaction flow data according to the first resource request, performs resource processing according to the transaction flow data, and obtains a resource processing result.

[0004] For example, the invention patent with announcement number CN115034693B announces a bioinformatics data security management method, system and storage medium based on the Internet of Things. By collecting images of each plant specimen in the plant specimen museum to be managed, the collection record information and part preservation information of each plant specimen in the plant specimen museum to be managed are extracted, and the collection record information matching weight index and the part preservation information matching weight index of each plant specimen in the plant specimen museum to be managed are obtained by parsing. At the same time, combined with the preservation environment parameters of each plant specimen in the plant specimen museum to be managed, the information preservation security assessment coefficient of each plant specimen in the plant specimen museum to be managed is comprehensively analyzed, and corresponding processing is performed.

[0005] However, in the process of implementing the embodiments of the present application, the present application found that the above technology has at least the following technical problems: Current information resource security management methods focus on preventing external network attacks, such as using firewalls, intrusion detection systems and other means to resist external malicious intrusions. However, in the daily use of information resources, user operation behaviors and system operating environments also present diverse characteristics, which have a significant impact on the security status of information resources. Currently, only focusing on external attack prevention will make it difficult to fully understand potential internal security risks, resulting in loopholes in information security protection, reducing the reliability and effectiveness of information resource security management, and making it difficult to meet the actual needs of efficient and safe use of information resources in a complex and changeable network environment, which is not conducive to the all-round protection of information resources and the stable operation of information systems. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention provides a security management method, system and storage medium based on computer information resources, which can effectively solve the problems involved in the above-mentioned background technology.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: In a first aspect, the present invention provides a security management method based on computer information resources, comprising the following steps: S1, obtaining user identification information of a user, and extracting a benchmark evaluation information set from a user information database, wherein the benchmark evaluation information set includes a user reference behavior data set, a user abnormal behavior determination threshold, and a user regional historical risk parameter.

[0008] S2, within a preset monitoring period, collects user behavior data and PC resource fluctuation data, analyzes the user behavior anomaly assessment value, and determines the user behavior label in combination with the user abnormal behavior determination threshold, wherein the user behavior label includes a safe behavior pattern and a potential risk pattern.

[0009] S3: If the user behavior tag is determined to be a potential risk mode, the user communication terminal flow limiting ratio is determined based on the user behavior abnormal behavior evaluation value, the communication terminal flow limiting is performed, and abnormal secondary verification is started.

[0010] S4, collects user secondary verification behavior data, obtains user regional historical risk parameters, combines user behavior anomaly assessment values, analyzes user behavior anomaly verification assessment values, and re-determines user behavior labels to obtain user behavior verification labels.

[0011] S5, determine the user permission locking measures based on the user behavior verification tag.

[0012] The second aspect of the present invention provides a security management system based on computer information resources, comprising: The benchmark assessment information set extraction module is used to obtain the user identification information of the user and extract the benchmark assessment information set from the user information database. The benchmark assessment information set includes the user reference behavior data set, the user abnormal behavior judgment threshold and the user regional historical risk parameter.

[0013] The user behavior label determination module is used to collect user behavior data and PC resource fluctuation data within a preset monitoring period, analyze the user behavior anomaly assessment value, and determine the user behavior label in combination with the user abnormal behavior determination threshold. The user behavior label includes a safe behavior pattern and a potential risk pattern.

[0014] The user behavior restriction verification module is used to determine the user communication terminal flow limit ratio based on the user behavior abnormal behavior evaluation value if the user behavior label is judged as a potential risk mode, perform communication terminal flow limit and start abnormal secondary verification.

[0015] The user behavior label re-determination module is used to collect user secondary verification behavior data, obtain user area historical risk parameters, combine user behavior anomaly assessment values, analyze user behavior anomaly verification assessment values, and re-determine user behavior labels to obtain user behavior verification labels.

[0016] The user authority locking measure determination module is used to determine the user authority locking measure according to the user behavior verification tag.

[0017] A third aspect of the present invention provides a computer-readable storage medium for storing a program, which, when executed by a processor, implements a security management method based on computer information resources.

[0018] Compared with the prior art, the embodiments of the present invention have at least the following advantages or beneficial effects: (1) The present invention provides a security management method, system and storage medium based on computer information resources. By obtaining user identification information and extracting a benchmark assessment information set, the present invention provides a reference data basis for subsequent assessments. By analyzing the abnormal user behavior assessment value, the user behavior label is accurately determined, and potential risks can be detected in a timely manner to prevent security risks from gradually expanding without being detected, leading to serious consequences such as data leakage and system failure. For potential risk patterns, the communication terminal current limiting ratio is determined based on the abnormal assessment value and secondary verification is enabled to effectively limit the network activities of abnormal users and reduce security risks. By simultaneously passing the secondary verification, the risk level of user behavior can be comprehensively and accurately determined, ensuring the stability of the system and the security of information resources, and avoiding misjudgment.

[0019] (2) The present invention can analyze the abnormality of user operation behavior by determining user behavior tags, and improve the efficiency of risk identification by quickly judging user behavior. At the same time, it can perform secondary verification and analysis on potential risk users to improve resource utilization efficiency and provide data basis for subsequent analysis and processing.

[0020] (3) The present invention determines the current limiting ratio of the user communication terminal based on the user behavior abnormal behavior evaluation value, and performs communication terminal current limiting, which can effectively ensure the security, stability and reasonable allocation of resources of the network environment. The current limiting ratio is adjusted according to the abnormal behavior evaluation value, so as to achieve accurate restriction of the network activities of users with abnormal behavior. When the abnormal degree of user behavior is high, the current limiting ratio is increased to reduce its network traffic to avoid damage to system security and data integrity. When the abnormal degree is low, a relatively small current limiting ratio is adopted to minimize the impact on the normal operation of users while ensuring security. On the other hand, the allocation of network resources is optimized to avoid abnormal behavior users from excessively occupying bandwidth, thereby causing delays in network resources, improving the availability and reliability of the network system, and ensuring the security of information resources.

[0021] (4) The present invention can improve the accuracy of user behavior risk judgment by performing abnormal secondary verification, effectively protect the security of computer information resources, and start secondary verification when it is first determined to be a potential risk mode, thereby reducing unnecessary restrictions on normal users and avoiding misjudgment. At the same time, the abnormal verification correction coefficient is extracted and correction processing is performed according to the user behavior abnormality assessment value, thereby further improving the accuracy of the assessment and ensuring that the judgment of user behavior is more scientific and reasonable, providing data basis for the subsequent accurate permission locking measures, reducing security risks, and maintaining the stable operation of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The present invention is further described using the accompanying drawings, but the embodiments in the accompanying drawings do not constitute any limitation to the present invention. A person skilled in the art can obtain other drawings based on the following drawings without creative work.

[0023] Figure 1 The figure is a schematic flow chart of the method steps of the present invention.

[0024] Figure 2 It is a schematic diagram of system module connection of the present invention. DETAILED DESCRIPTION

[0025] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0026] Reference Figure 1 As shown, the first aspect of the present invention provides a security management method based on computer information resources, comprising the following steps: S1, obtaining user identification information of a user, and extracting a benchmark evaluation information set from a user information database, wherein the benchmark evaluation information set includes a user reference behavior data set, a user abnormal behavior determination threshold, and a user regional historical risk parameter.

[0027] It should be understood that the user identification information of a user includes a user ID and a user IP address.

[0028] It should be noted that the benchmark evaluation information set is obtained by extracting user identification information. The extraction method is as follows: extract the evaluation information set corresponding to each identification information in the user information database, and map the evaluation information set corresponding to the extracted user identification information, which is recorded as the benchmark evaluation information set.

[0029] It should also be noted that the user region refers to the region where the user's IP address is located, and the region division rules are pre-set in the database.

[0030] S2, within a preset monitoring period, collects user behavior data and PC resource fluctuation data, analyzes the user behavior anomaly assessment value, and determines the user behavior label in combination with the user abnormal behavior determination threshold, wherein the user behavior label includes a safe behavior pattern and a potential risk pattern.

[0031] In this embodiment, the user behavior abnormality evaluation value is analyzed, and the specific analysis process is as follows: Obtain a user reference behavior data set, including user reference behavior data and reference PC-side resource fluctuation data.

[0032] During a preset monitoring period, user behavior data is collected, and a user behavior risk value is obtained based on analysis and processing of the user behavior data and user reference behavior data. The user behavior risk value is used to characterize the risk level of the user's operation behavior.

[0033] The user behavior data includes the frequency of sending operation instructions, the total number of highly sensitive data accesses, the number of network connections established by tasks, and the number of process switches.

[0034] The user reference behavior data includes the reference sending frequency of operation instructions, the total number of reference accesses to highly sensitive data, the number of network connections established by reference tasks, and the number of reference process switches.

[0035] It should be noted that user behavior data can be collected from system program logs, among which the frequency of sending operation instructions refers to the frequency of users sending various types of operation instructions within the preset monitoring period; the total number of highly sensitive data accesses refers to the cumulative total number of times users access highly sensitive data within the preset monitoring period; the number of network connections established by tasks refers to the total number of network connection establishment operations initiated by users within the preset monitoring period; and the number of process switches refers to the cumulative number of times users switch between different tasks within the preset monitoring period.

[0036] It should be noted that the data sensitivity level is pre-set in the database. In this embodiment, highly sensitive data refers to data that requires access authentication. In a specific embodiment, highly sensitive data may include user key privacy data, corporate decision-making documents, etc.

[0037] In a specific embodiment, the user behavior risk value is obtained based on the analysis and processing of user behavior data, taking into account the mutual influence between these parameters. For example, when the frequency of sending operation instructions increases significantly, more process switches may be triggered, because the system needs to allocate resources to process these instructions. At the same time, if it involves operations on highly sensitive data, the total number of highly sensitive data accesses may also increase accordingly, and in order to obtain relevant data or execute instructions, the number of network connections established by tasks also tends to increase. If the total number of highly sensitive data accesses suddenly increases, it may be due to the concentrated triggering of certain specific operation instructions, which will cause the frequency of sending operation instructions to increase within the corresponding time period. At the same time, in order to ensure the efficiency of data transmission, the system may be prompted to perform more process switches and establish new network connections. When the number of network connections established by a task changes, for example, an increase in the number of connections, more operation instructions may be sent, which in turn affects the number of process switches. The total number of highly sensitive data accesses may also change due to different purposes of network connections.

[0038] In a specific embodiment, the user behavior risk value is obtained in the following way: ; in, is the user behavior risk value, The frequency of sending operation instructions. is the total number of highly sensitive data accesses, The number of network connections established for the task, is the number of process switches, Refer to the sending frequency for operation instructions. Refer to the total number of accesses for highly sensitive data. The number of network connections established for the reference task, is the number of reference process switches, Send frequency weights for operation instructions, is the total weight of highly sensitive data access, Establish a network connection weight for the task, The weight of the process switching times.

[0039] It is important to understand that the switch function is a built-in function in Python. .

[0040] It should be noted that the value ranges of the weight of the frequency of sending operation instructions, the total weight of highly sensitive data accesses, the number of network connections established by tasks and the number of process switching weights are all between 0 and 1. When used, they can be directly extracted from the database to obtain pre-set values. The extraction method is, for example: constructing a mapping set with the frequency of sending operation instructions, the total number of highly sensitive data accesses, the number of network connections established by tasks and the number of process switching weights corresponding to them. The use is to input the real-time obtained frequency of sending operation instructions, the total number of highly sensitive data accesses, the number of network connections established by tasks and the number of process switching weights into the mapping set one by one, so as to extract the corresponding weight of the frequency of sending operation instructions, the total number of highly sensitive data accesses, the number of network connections established by tasks and the number of process switching weights.

[0041] In a specific embodiment, by obtaining a user behavior risk value based on analysis and processing of user behavior data and user reference behavior data, the efficiency and accuracy of assessing the safety of user behavior can be improved, providing an accurate numerical basis for subsequent analysis of the degree of abnormality of user operations.

[0042] Collect PC-side resource fluctuation data, and obtain a PC-side resource fluctuation state value based on the PC-side resource fluctuation data and reference PC-side resource fluctuation data analysis and processing, wherein the PC-side resource fluctuation state value is used to characterize the fluctuation degree of PC-side resources.

[0043] The PC-side resource fluctuation data includes memory fragmentation rate, average hard disk seek time, average network connection response delay jitter and disk cache hit rate.

[0044] It is important to understand that the subject objects of resource fluctuation data and user behavior data are consistent, and the subordinate object on the PC side is also the user himself.

[0045] The reference PC-side resource fluctuation data includes a reference memory fragmentation rate, a reference hard disk average seek time, a reference network connection response average delay jitter, and a reference disk cache hit rate.

[0046] It should be noted that PC resource fluctuation data can be collected from system program logs, where the memory fragmentation rate refers to the proportion of discontinuous free memory blocks generated in the memory due to frequent allocation and release of programs during system operation within a preset monitoring period, which reflects the degree of fragmentation of the memory space. A higher memory fragmentation rate may affect system performance and data processing efficiency.

[0047] The average hard disk seek time refers to the average time required for the head to move from the starting position to the track where the target data is located when the hard disk reads or writes data within a preset monitoring period.

[0048] The average delay jitter of network connection response refers to the average value of the variation of the round-trip time delay of each data packet from the sender to the receiver in network communication within a preset monitoring period.

[0049] The disk cache hit rate refers to the ratio of the number of times data is successfully obtained from the cache to the total number of reads during a disk data read operation within a preset monitoring period.

[0050] In a specific embodiment, according to the PC-side resource fluctuation data, the PC-side resource fluctuation state value is obtained by analyzing and processing, taking into account the mutual influence between these parameters. For example, when the memory fragmentation rate increases, the system memory management efficiency decreases, which may cause the process to run slowly, thereby increasing the hard disk read and write requirements, so that the average hard disk seek time is extended. Due to the unsmooth exchange of memory and disk data, the disk cache hit rate will also be affected and reduced. At the same time, the decline in the overall performance of the system may cause the average delay jitter of the network connection response to increase. If the average hard disk seek time becomes longer, the data reading and writing speed slows down, which will increase the cache pressure of the data in the memory, causing the memory fragmentation rate to further increase, and will also increase the delay of network operations that rely on disk data, causing the average delay jitter of the network connection response to increase, and the disk cache hit rate is reduced due to the difficulty of data acquisition. When the average delay jitter of the network connection response increases, data transmission will be blocked, affecting the timeliness of data exchange between the memory and the disk, causing the memory fragmentation rate to increase and the disk cache hit rate to decrease, and the hard disk may be frequently read and written due to network transmission problems, extending the average hard disk seek time.

[0051] In a specific embodiment, the PC-side resource fluctuation state value is obtained in the following specific method: ; in, It is the resource fluctuation status value of the PC side. is the memory fragmentation rate, is the average hard disk seek time, is the average delay jitter of the network connection response. is the disk cache hit ratio, To refer to the memory fragmentation rate, To refer to the average hard disk seek time, To refer to the average delay jitter of network connection response, To refer to the disk cache hit rate, is the memory fragmentation rate weight, is the average seek time weight of the hard disk, is the average delay jitter weight of the network connection response, Disk cache hit rate weight.

[0052] It should be noted that the memory fragmentation rate weight, the hard disk average seek time weight, the network connection response average delay jitter weight and the disk cache hit rate weight are preset values ​​in the database and can be directly extracted when used. The specific extraction method is, for example, to construct a mapping set with the memory fragmentation rate weight, the hard disk average seek time weight, the network connection response average delay jitter weight and the disk cache hit rate weight. When used, the real-time memory fragmentation rate, hard disk average seek time, network connection response average delay jitter and disk cache hit rate are input into the mapping set one by one, so as to extract the corresponding memory fragmentation rate weight, hard disk average seek time weight, network connection response average delay jitter weight and disk cache hit rate weight. The value range of the extracted memory fragmentation rate weight, hard disk average seek time weight, network connection response average delay jitter weight and disk cache hit rate weight is 0-1.

[0053] In a specific embodiment, by obtaining a PC-side resource fluctuation status value based on PC-side resource fluctuation data and referring to the PC-side resource fluctuation data analysis and processing, it is possible to further determine whether the user operation behavior is abnormal, thereby providing an accurate numerical basis for subsequent analysis of the degree of abnormality of user operations.

[0054] According to the user behavior risk value and the PC-side resource fluctuation state value, a user behavior anomaly assessment value is obtained through comprehensive analysis and processing, and the user behavior anomaly assessment value is used to characterize the degree of abnormality of the user operation.

[0055] In a specific embodiment, the user behavior abnormality evaluation value is obtained in the following manner: ; in, is the user behavior abnormality evaluation value, is the user behavior risk value, It is the resource fluctuation status value of the PC side. is the risk value weight of user behavior, It is the weight of the resource fluctuation status value on the PC side.

[0056] In a specific embodiment, the user behavior anomaly assessment value is obtained by comprehensive analysis based on the user behavior risk value and the PC-side resource fluctuation state value, taking into account the mutual influence between them. For example, when the user behavior risk value increases, it means that the user's operating behavior risk increases, and more high-load, high-risk operations may be performed. For example, frequently sending a large number of operating instructions, frequently accessing highly sensitive data, etc., these operations will make the call and allocation of system resources more frequent, which will lead to changes in the PC-side resource fluctuation state value. A large number of instruction sending and data access may increase the memory fragmentation rate, affect the memory management efficiency, increase the hard disk read and write pressure, extend the hard disk average seek time, and the average delay jitter of the network connection response may also increase. The disk cache hit rate may decrease, thereby increasing the PC-side resource fluctuation state value, indicating that the degree of resource fluctuation has increased.

[0057] In this embodiment, the user behavior label is determined, and the specific analysis process is as follows: Get the threshold for determining abnormal user behavior.

[0058] The user behavior anomaly assessment value is subtracted from the user abnormal behavior determination threshold to obtain the user behavior anomaly assessment deviation value.

[0059] It should be noted that the difference processing refers to the user behavior abnormality assessment value minus the user abnormal behavior determination threshold, and the result of the difference processing may be greater than zero, less than zero, or equal to zero.

[0060] If the user behavior abnormality assessment deviation value is greater than or equal to zero, the user behavior label is determined to be a potential risk mode.

[0061] If the user behavior anomaly assessment deviation value is greater than or equal to zero, it means that after comprehensive analysis, the user's operating behavior is relatively abnormal and may pose a potential threat to the security of computer information resources. Therefore, the user behavior label needs to be judged as a potential risk mode so that corresponding restrictions and verification measures can be taken later to ensure information security.

[0062] If the user behavior anomaly assessment deviation value is less than zero, the user behavior label is determined to be a safe behavior mode.

[0063] If the user behavior abnormality assessment deviation value is less than zero, it means that after comprehensive analysis, the user's operating behavior is within the safe range and there is no obvious deviation from the normal mode. At this time, the user behavior label can be determined as a safe behavior mode, and the system can maintain regular monitoring of the user's operations and continue to maintain the normal flow and use of information resources.

[0064] S3: If the user behavior tag is determined to be a potential risk mode, the user communication terminal flow limiting ratio is determined based on the user behavior abnormal behavior evaluation value, the communication terminal flow limiting is performed, and abnormal secondary verification is started.

[0065] In this embodiment, the user communication terminal current limiting ratio is determined based on the user behavior abnormal behavior evaluation value, and the specific analysis process is as follows: The communication terminal current limiting ratio corresponding to each abnormal evaluation deviation value interval stored in the database is extracted, and the communication terminal current limiting ratio corresponding to the interval in which the user behavior abnormal evaluation deviation value is located is mapped and extracted, and recorded as the user communication terminal current limiting ratio.

[0066] It should be understood that the larger the user behavior anomaly assessment deviation value, the further the user behavior deviates from the normal standard and the higher the degree of anomaly. The corresponding communication terminal current limiting ratio should be larger. By extracting the user communication terminal current limiting ratio based on the user behavior anomaly assessment deviation value, the precise communication terminal current limiting ratio can be extracted in a targeted manner according to the degree of user behavior anomaly, thereby effectively limiting the network activity intensity of users with abnormal behavior and preventing the security risks that may be caused from further expansion. At the same time, network resources are reasonably allocated to avoid unnecessary interference with normal users' network use, thereby ensuring the stable and orderly operation of the entire network environment.

[0067] Get the total traffic of the current communication end.

[0068] It should be understood that the communication terminal can realize data exchange between the user device and other devices and servers in the network. In this embodiment, by limiting the current of the communication terminal, the data transmission volume and transmission speed between the user device and the external network can be effectively controlled, thereby limiting the network activity intensity of users with abnormal behavior.

[0069] The communication end current limit is performed based on the current total communication end traffic and the user communication end current limit ratio.

[0070] In a specific embodiment, assuming that the current total traffic of the communication terminal is 100Mbps, the abnormal user behavior evaluation deviation value obtained by analysis is 3, corresponding to the extracted user communication terminal flow limit ratio of 0.4. Then after calculation, the communication terminal traffic after flow limit is 100Mbps×(1-0.4)=60Mbps, that is, the communication terminal traffic of the user is limited so that it can only use a maximum bandwidth of 60Mbps, thereby reducing the risks that may be caused by abnormal behavior, ensuring the stability and security of the overall network environment, and also preventing the user from excessively occupying network resources in potential risk situations and affecting the use of other normal users.

[0071] S4, collects user secondary verification behavior data, obtains user regional historical risk parameters, combines user behavior anomaly assessment values, analyzes user behavior anomaly verification assessment values, and re-determines user behavior labels to obtain user behavior verification labels.

[0072] In this embodiment, the user behavior abnormality verification evaluation value is analyzed, and the user behavior label is re-determined to obtain the user behavior verification label. The specific analysis process is as follows: According to the user's secondary verification behavior data, the user's regional historical risk parameters and the user's behavior anomaly assessment value, the user's behavior anomaly verification assessment value is obtained through analysis and processing. The user's behavior anomaly verification assessment value is used to characterize the degree of abnormality of the user's operation during the secondary verification.

[0073] The user behavior verification tag includes a safe behavior pattern and an abnormal behavior pattern.

[0074] If the user behavior abnormality verification evaluation value is greater than or equal to the user abnormal behavior determination threshold, the determination result of the user behavior verification label is recorded as an abnormal behavior pattern.

[0075] If the user behavior abnormality verification evaluation value is less than the user abnormal behavior determination threshold, the determination result of the user behavior verification label is recorded as a safe behavior mode.

[0076] In this embodiment, the user behavior abnormality verification evaluation value is analyzed, and the specific analysis process is as follows: Collect user secondary verification behavior data, including the number of attempts to access unauthorized files, the proportion of sensitive operation instructions, the frequency of encryption operations, and the frequency of permission calls.

[0077] It should be noted that the user's secondary verification behavior data can be extracted from the system program log, among which the number of unauthorized file access attempts refers to the cumulative number of user attempts to operate files that they are not authorized to access within the preset monitoring period; the proportion of sensitive operation instructions refers to the proportion of all operation instructions issued by users within the preset monitoring period, which is defined as the proportion of the total number of operation instructions; the encryption operation frequency refers to the frequency of users initiating encryption-related operations within the preset monitoring period; the permission call frequency refers to the frequency of users calling various permissions within the preset monitoring period.

[0078] It should be understood that the nature of the instruction is determined according to the rules preset in the database. In a specific embodiment, sensitive instructions may be instructions that involve modifying the core configuration files of the system, such as changing the startup parameters of key system services, adjusting the underlying settings of network security policies, etc.; they may also be instructions for batch export or deletion of important user data, such as exporting detailed information of a large number of customers at one time or deleting key data of a specific business; they also include instructions related to the forced termination or startup of key system processes, such as forcibly shutting down the core processes responsible for data encryption or identity authentication, or starting background services with high permissions without authorization, etc. Due to the criticality and potential high risk of their operations, these instructions, once abnormally executed, may pose a serious threat to the integrity, confidentiality and availability of computer information resources. Therefore, they are defined as sensitive instructions in the security management process and are subject to key monitoring.

[0079] In a specific embodiment, the various types of permissions may include system management permissions, user account management permissions, data backup permissions, etc.

[0080] It should also be noted that there is mutual influence between the data of user secondary verification behavior. For example, when the number of attempts to access unauthorized files increases, it may mean that the user is trying to break through the permission restrictions to obtain information, which may prompt them to use more encryption operations to cover their tracks, resulting in an increase in the frequency of encryption operations, and more sensitive operation instructions may be involved in the attempt process, which increases the proportion of sensitive operation instructions. If the proportion of sensitive operation instructions increases, it indicates that the sensitivity of the user's operation has increased. It may be that some special tasks or abnormal behaviors exist, which may be accompanied by attempts to access certain key files, which increases the number of attempts to access unauthorized files. The increase in the frequency of encryption operations may be that the user has performed more sensitive operations or has illegal access behaviors, which will increase the proportion of sensitive operation instructions. It may also be that due to the complexity of encryption operations, permissions are frequently called, resulting in an increase in the frequency of permission calls. It may even involve the processing of some special files during the encryption process, causing changes in the number of attempts to access unauthorized files. The increase in the frequency of permission calls may be that frequent calls are made to obtain permissions to access special files, thereby increasing the number of attempts to access unauthorized files, or more sensitive operations are performed after the permission is upgraded, which increases the proportion of sensitive operation instructions. It may also increase the frequency of encryption operations when performing certain security-related operations.

[0081] Extract the user secondary verification behavior reference data stored in the database, including the reference number of unauthorized file access attempts, the reference proportion of sensitive operation instructions, the reference frequency of encryption operations, and the reference frequency of permission calls.

[0082] Obtain historical risk parameters for the user area, including the number of historical data access violations, the number of historical abnormal permission changes, the frequency of historical network attacks, and the percentage of historical program crashes in the user area.

[0083] It should be noted that the number of historical data access violations refers to the cumulative number of unauthorized data access operations, the number of historical abnormal permission changes refers to the total number of historical changes in user permissions that are not due to normal business process needs, the historical network attack frequency refers to the historical frequency of network attack behaviors, and the historical program crash rate refers to the proportion of program crashes in the total number of uses.

[0084] It should also be noted that the historical risk parameters of user areas have mutual influence on each other. For example, when the number of historical data access violations increases, this may mean that there is a loophole in user authority management, which in turn leads to an increase in the number of abnormal changes in historical authority. At the same time, users with illegal data access behaviors may also increase the frequency of implementing or suffering historical network attacks, because illegal behaviors may trigger abnormal reactions of the system security protection mechanism, and abnormal operations may destroy the stability of the program, resulting in an increase in the proportion of historical program crashes. If the number of abnormal changes in historical authority increases, it may cause users to obtain some authority beyond the normal range, which will give users more opportunities to perform illegal data access operations, thereby increasing the number of historical data access violations. Abnormal changes in authority may also break the security balance of the system and cause an increase in the frequency of historical network attacks. Incorrect operations or improper use of authority during the authority change process may interfere with program operation, increasing the proportion of historical program crashes. When the frequency of historical network attacks increases, it may cause the system security protection mechanism to respond frequently. In this process, the authority management system may be abnormal, resulting in an increase in the number of abnormal changes in historical authority.

[0085] Extract the user area reference historical risk parameters stored in the database, including the reference historical data access violation count, the reference historical permission abnormal change count, the reference historical network attack frequency, and the reference historical program crash count ratio.

[0086] The abnormal verification correction coefficient corresponding to each abnormal evaluation value interval stored in the database is extracted, and the abnormal verification correction coefficient corresponding to the user behavior abnormal evaluation value is mapped and extracted, which is recorded as the user behavior abnormal verification correction coefficient.

[0087] It should be understood that the larger the user behavior anomaly assessment value, the higher the degree of user behavior anomaly, and the corresponding extracted anomaly verification correction coefficient should be larger. By extracting the user behavior anomaly verification correction coefficient based on the user behavior anomaly assessment value, different correction processing can be performed on different degrees of anomaly, thereby improving the accuracy of the secondary verification.

[0088] Based on the user's secondary verification behavior data, the user's regional historical risk parameters and the user's abnormal behavior verification correction coefficient, the user's abnormal behavior verification evaluation value is obtained through analysis and processing.

[0089] In a specific embodiment, the user behavior abnormality verification evaluation value is obtained in the following specific method: ; ; ; in, Verify the evaluation value for abnormal user behavior, It is a factor representing the user's secondary verification behavior data. is the historical risk parameter characterization factor of the user area, The factor weights representing the user's secondary verification behavior data, is the weight of the factor representing the historical risk parameter of the user area, Verify the correction factor for abnormal user behavior, The number of attempts to access the file without permission. is the proportion of sensitive operation instructions, is the encryption operation frequency, is the frequency of permission calls, is the number of historical data access violations, The number of abnormal changes in historical permissions. is the historical network attack frequency, is the percentage of historical program crashes, The number of access attempts for unauthorized file references, This is the reference ratio of sensitive operation instructions. is the reference frequency for encryption operations, The reference frequency for permission calls, To refer to the number of historical data access violations, To refer to the number of abnormal changes in historical permissions, To refer to the historical frequency of cyber attacks, For reference, the percentage of historical program crashes. The weight of the number of attempts to access the unauthorized file. is the weight of the proportion of sensitive operation instructions, is the encryption operation frequency weight, is the frequency weight of permission calls, is the weight of the number of historical data access violations, is the weight of the number of abnormal changes in historical permissions, is the historical network attack frequency weight, is the weight of the historical program crash times, and e is a natural constant.

[0090] It should be noted that the weights of the characterization factors of the user's secondary verification behavior data, the weights of the characterization factors of the historical risk parameters of the user's area, the weights of the number of attempts to access files without permission, the weights of the proportion of sensitive operation instructions, the weights of the frequency of encryption operations, the weights of the frequency of permission calls, the weights of the number of historical data access violations, the weights of the number of historical abnormal permission changes, the weights of the frequency of historical network attacks, and the weights of the proportion of historical program crashes can all be extracted from the database to obtain a preset value, and the value range is between 0 and 1. The specific extraction method is as follows: the characterization factors of the user's secondary verification behavior data, the characterization factors of the historical risk parameters of the user's area, the number of attempts to access files without permission, the proportion of sensitive operation instructions, the frequency of encryption operations, the frequency of permission calls, the number of historical data access violations, the number of historical abnormal permission changes, the frequency of historical network attacks, and the weights of the proportion of historical program crashes are all extracted from the database to obtain a preset value, and the value range is between 0 and 1. The specific extraction method is as follows: the characterization factors of the user's secondary verification behavior data, the characterization factors of the historical risk parameters of the user's area, the number of attempts to access files without permission, the proportion of sensitive operation instructions, the frequency of encryption operations, the frequency of permission calls, the number of historical data access violations, the number of historical abnormal permission changes, the frequency of historical network attacks, and the weights of the proportion of historical program crashes A mapping set is constructed one by one with the corresponding weights respectively. When used, the real-time collected user secondary verification behavior data characterization factors, user area historical risk parameter characterization factors, the number of unauthorized file access attempts, the proportion of sensitive operation instructions, the encryption operation frequency, the permission call frequency, the number of historical data access violations, the number of historical abnormal permission changes, the historical network attack frequency and the historical program crash number proportion are input into the mapping set one by one, so as to extract the user secondary verification behavior data characterization factor weights, user area historical risk parameter characterization factor weights, the number of unauthorized file access attempts, the weight of sensitive operation instruction proportion, the encryption operation frequency weights, the permission call frequency weights, the historical data access violation number weights, the historical abnormal permission change number weights, the historical network attack frequency weights and the historical program crash number proportion weights.

[0091] S5, determine the user permission locking measures based on the user behavior verification tag.

[0092] In this embodiment, the user authority locking measures are determined according to the user behavior verification tag, and the specific analysis process is as follows: If the judgment result of the user behavior verification tag is an abnormal behavior pattern, the user permission locking measure will be recorded as the required user permission locking, the user permission will be locked synchronously and the corresponding prompt information will be uploaded to the management center.

[0093] If the judgment result of the user behavior verification label is an abnormal behavior pattern, it means that after the second verification, the user's operation behavior has obvious signs of risk, which is very likely to affect the system security, data integrity and other aspects. It is necessary to record the user permission locking measure as the required user permission locking, and simultaneously lock the user permission and upload the corresponding prompt information to the management center. Immediate locking of permissions can quickly curb the further spread of potential risks and avoid serious consequences such as data leakage, system paralysis or malicious tampering due to abnormal operations.

[0094] If the judgment result of the user behavior verification tag is a safe behavior mode, the user authority locking measure will be recorded as no user authority locking is required, and the corresponding prompt information will be uploaded to the management center simultaneously.

[0095] If the result of the user behavior verification label is a safe behavior mode, it means that after the second verification, the user operation conforms to the normal behavior mode preset by the system, and all operations are within a reasonable range. The user authority locking measure is recorded as no user authority locking is required. However, because the user behavior label has been judged as a potential risk, in order to ensure the safe and stable operation of the system, continuous attention must be paid to the user behavior.

[0096] The second aspect of the present invention provides a security management system based on computer information resources, comprising: The benchmark assessment information set extraction module is used to obtain the user identification information of the user and extract the benchmark assessment information set from the user information database. The benchmark assessment information set includes the user reference behavior data set, the user abnormal behavior judgment threshold and the user regional historical risk parameter.

[0097] The user behavior label determination module is used to collect user behavior data and PC resource fluctuation data within a preset monitoring period, analyze the user behavior anomaly assessment value, and determine the user behavior label in combination with the user abnormal behavior determination threshold. The user behavior label includes a safe behavior pattern and a potential risk pattern.

[0098] The user behavior restriction verification module is used to determine the user communication terminal flow limit ratio based on the user behavior abnormal behavior evaluation value if the user behavior label is judged as a potential risk mode, perform communication terminal flow limit and start abnormal secondary verification.

[0099] The user behavior label re-determination module is used to collect user secondary verification behavior data, obtain user area historical risk parameters, combine user behavior anomaly assessment values, analyze user behavior anomaly verification assessment values, and re-determine user behavior labels to obtain user behavior verification labels.

[0100] The user authority locking measure determination module is used to determine the user authority locking measure according to the user behavior verification tag.

[0101] A third aspect of the present invention provides a computer-readable storage medium for storing a program, which, when executed by a processor, implements a security management method based on computer information resources.

[0102] The above contents are merely examples and explanations of the structure of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the present invention, they should all fall within the protection scope of the present invention.

Claims

1. A security management method based on computer information resources, characterized in that: The following steps are involved: S1, obtaining user identification information of the user, and extracting a benchmark evaluation information set from a user information database, wherein the benchmark evaluation information set includes a user reference behavior data set, a user abnormal behavior determination threshold, and a user regional historical risk parameter; S2, within a preset monitoring period, collect user behavior data and PC resource fluctuation data, analyze the user behavior abnormality assessment value, and determine the user behavior label in combination with the user abnormal behavior determination threshold, wherein the user behavior label includes a safe behavior pattern and a potential risk pattern; S3: If the user behavior tag is determined to be a potential risk mode, the user communication terminal flow limit ratio is determined based on the user behavior abnormal behavior evaluation value, the communication terminal flow limit is performed, and abnormal secondary verification is started; S4, collect user secondary verification behavior data, obtain user regional historical risk parameters, combine user behavior anomaly assessment value, analyze user behavior anomaly verification assessment value, and re-determine user behavior labels to obtain user behavior verification labels; S5, determine the user permission locking measures based on the user behavior verification tag.

2. The computer information resource security management method according to claim 1 is characterized in that: The specific analysis process of analyzing the abnormal user behavior evaluation value is as follows: Obtain a user reference behavior data set, including user reference behavior data and reference PC-side resource fluctuation data; Collect user behavior data within a preset monitoring period, and obtain a user behavior risk value based on the analysis and processing of the user behavior data and user reference behavior data, wherein the user behavior risk value is used to characterize the risk level of the user's operation behavior; The user behavior data includes the frequency of sending operation instructions, the total number of highly sensitive data accesses, the number of network connections established by tasks, and the number of process switches; Collect PC-side resource fluctuation data, and obtain a PC-side resource fluctuation state value based on the PC-side resource fluctuation data and with reference to the PC-side resource fluctuation data for analysis and processing, wherein the PC-side resource fluctuation state value is used to characterize the fluctuation degree of the PC-side resources; The PC resource fluctuation data includes memory fragmentation rate, average hard disk seek time, average network connection response delay jitter and disk cache hit rate; According to the user behavior risk value and the PC-side resource fluctuation state value, a user behavior anomaly assessment value is obtained through comprehensive analysis and processing, and the user behavior anomaly assessment value is used to characterize the degree of abnormality of the user operation.

3. The computer information resource-based security management method according to claim 2, characterized in that: The specific analysis process of determining the user behavior label is as follows: Obtain the user abnormal behavior determination threshold; Performing difference processing on the user behavior abnormality assessment value and the user abnormal behavior determination threshold to obtain the user behavior abnormality assessment deviation value; If the user behavior abnormality assessment deviation value is greater than or equal to zero, the user behavior label is determined as a potential risk mode; If the user behavior anomaly assessment deviation value is less than zero, the user behavior label is determined to be a safe behavior mode.

4. The computer information resource-based security management method according to claim 1, characterized in that: The specific analysis process of determining the user communication terminal current limiting ratio based on the user behavior abnormal behavior evaluation value is as follows: Extract the communication terminal current limiting ratio corresponding to each abnormal evaluation deviation value interval stored in the database, and map and extract the communication terminal current limiting ratio corresponding to the interval where the user behavior abnormal evaluation deviation value is located, and record it as the user communication terminal current limiting ratio; Get the total traffic of the current communication end; The communication end current limit is performed based on the current total communication end traffic and the user communication end current limit ratio.

5. The computer information resource-based security management method according to claim 1, characterized in that: The analysis of the user behavior abnormality verification evaluation value and the re-determination of the user behavior label to obtain the user behavior verification label, the specific analysis process is as follows: Analyze and process the user's secondary verification behavior data, the user's regional historical risk parameters, and the user's abnormal behavior evaluation value to obtain a user's abnormal behavior verification evaluation value, which is used to characterize the degree of abnormal operation of the user during the secondary verification; The user behavior verification tag includes a safe behavior pattern and an abnormal behavior pattern; If the user behavior abnormality verification evaluation value is greater than or equal to the user abnormal behavior determination threshold, the determination result of the user behavior verification label is recorded as an abnormal behavior pattern; If the user behavior abnormality verification evaluation value is less than the user abnormal behavior determination threshold, the determination result of the user behavior verification label is recorded as a safe behavior mode.

6. The computer information resource-based security management method according to claim 5, characterized in that: The analysis of user behavior abnormality verification evaluation value, the specific analysis process is: Collect user secondary verification behavior data, including the number of attempts to access unauthorized files, the proportion of sensitive operation instructions, the frequency of encryption operations, and the frequency of permission calls; Obtain historical risk parameters for the user area, including the number of historical data access violations, the number of historical abnormal permission changes, the frequency of historical network attacks, and the percentage of historical program crashes in the user area; Extract the abnormal verification correction coefficient corresponding to each abnormal evaluation value interval stored in the database, and map and extract the abnormal verification correction coefficient corresponding to the abnormal evaluation value of the user behavior, which is recorded as the user behavior abnormal verification correction coefficient; Based on the user's secondary verification behavior data, the user's regional historical risk parameters and the user's abnormal behavior verification correction coefficient, the user's abnormal behavior verification evaluation value is obtained through analysis and processing.

7. The computer information resource-based security management method according to claim 1, characterized in that: The user rights locking measures are determined based on the user behavior verification tag. The specific analysis process is as follows: If the result of the user behavior verification tag is an abnormal behavior pattern, the user permission locking measure is recorded as the required user permission locking, the user permission is locked synchronously and the corresponding prompt information is uploaded to the management center; If the judgment result of the user behavior verification tag is a safe behavior mode, the user authority locking measure will be recorded as no user authority locking is required, and the corresponding prompt information will be uploaded to the management center simultaneously.

8. The computer information resource-based security management method according to claim 2, characterized in that: The user behavior abnormality evaluation value is specifically obtained in the following manner: ； in, is the user behavior abnormality evaluation value, is the user behavior risk value, It is the resource fluctuation status value of the PC side. is the risk value weight of user behavior, It is the weight of the resource fluctuation status value on the PC side.

9. A security management system based on computer information resources, characterized in that: include: A benchmark assessment information set extraction module is used to obtain the user identification information of the user and extract the benchmark assessment information set from the user information database, wherein the benchmark assessment information set includes the user reference behavior data set, the user abnormal behavior determination threshold and the user regional historical risk parameter; A user behavior label determination module is used to collect user behavior data and PC resource fluctuation data within a preset monitoring period, analyze the user behavior abnormality evaluation value, and determine the user behavior label in combination with the user abnormal behavior determination threshold, wherein the user behavior label includes a safe behavior pattern and a potential risk pattern; The user behavior restriction verification module is used to determine the user communication terminal flow restriction ratio based on the user behavior abnormal behavior evaluation value if the user behavior label is determined to be a potential risk mode, perform communication terminal flow restriction and start abnormal secondary verification; The user behavior label re-determination module is used to collect user secondary verification behavior data, obtain user regional historical risk parameters, combine user behavior anomaly assessment values, analyze user behavior anomaly verification assessment values, and re-determine user behavior labels to obtain user behavior verification labels; The user authority locking measure determination module is used to determine the user authority locking measure according to the user behavior verification tag.

10. A computer-readable storage medium for storing a program, characterized in that: When the program is executed by the processor, the security management method based on computer information resources as described in any one of claims 1 to 8 is implemented.

Images