Information security management method based on data processing

Abstract

The invention discloses an information security management method based on data processing, and particularly relates to the field of information security management, comprising multi-source heterogeneous data acquisition, multi-dimensional feature index calculation, comprehensive threat detection calculation and adaptive threat decision. According to the method, the covert communication channel is accurately identified by constructing the encrypted traffic multi-mode detection model and combining protocol fingerprint entropy and traffic self-similarity analysis; an improved entropy weight fusion algorithm is adopted, collaborative analysis of system process abnormity, network behavior offset and hardware degradation is achieved, and a cross-dimension attack chain is reconstructed; a storage medium physical feature-cryptographic module runtime joint monitoring mechanism is created for the first time, hardware layer physical attacks and cryptographic side channel vulnerabilities are synchronously defended through temperature-delay correlation evaluation and key derivation density analysis, a complete attack surface from a physical layer to an application layer is covered, and the security is improved. And the detection precision and the response real-time performance of the complex threats are obviously improved.

Description

Technical Field

[0001] The present invention relates to the technical field of information security management. More specifically, the present invention relates to an information security management method based on data processing. Background Art

[0002] With the acceleration of digital transformation, the attack surface of information systems has gradually expanded. Traditional single-dimensional security monitoring solutions are difficult to cope with advanced threats such as kernel-level Rootkits, encrypted covert channels, and hardware side-channel attacks. There is an urgent need for an active defense method that integrates multi-dimensional feature analysis of software and hardware.

[0003] The prior art usually adopts a hierarchical monitoring mechanism: capturing process behaviors through Hook functions at the system layer, relying on DPI technology to analyze traffic characteristics at the network layer, evaluating the hardware status based on SMART parameters at the storage layer, and verifying the algorithm compliance in the cryptographic module. For example, traditional solutions detect malicious processes through signature matching, identify DDoS attacks based on traffic threshold statistics, prevent tampering using firmware signature verification, and verify the security of the cryptographic module through random number tests.

[0004] However, in actual use, there are still some drawbacks. For example, in the aspect of encrypted traffic analysis, it overly relies on deep packet inspection technology and cannot effectively analyze the metadata features and time series patterns of TLS / SSL encrypted payloads, resulting in difficulty in identifying HTTPS covert channels and DNS tunnels. At the same time, multi-dimensional data such as system process monitoring, network behavior analysis, and hardware status detection are isolated from each other, lacking a cross-layer feature fusion mechanism and unable to construct a complete view of the attack chain. In terms of hardware security, existing methods only focus on logical errors in storage media, ignoring the physical correlation between temperature fluctuations and access latency, and it is difficult to warn of media aging or freezing attacks. In addition, the security verification of the cryptographic module is limited to algorithm compliance checks, and runtime metrics such as key derivation frequency and random number frequency domain features are not monitored, resulting in vulnerabilities in side-channel attack protection. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art, the present invention provides an information security management method based on data processing. Through the following solutions, it solves the problems raised in the above background art, including the blind area in encrypted traffic analysis, the inability to analyze TLS / SSL metadata and time series patterns, the difficulty in detecting covert channels, the isolated processing of multi-dimensional threat data, the lack of a cross-layer association mechanism leading to missed detection of advanced persistent threats, the hardware security monitoring only focusing on logical errors, ignoring the temperature-latency physical correlation, the inability to warn of freezing attacks or media aging, the cryptographic module verification being limited to algorithm compliance, and the lack of monitoring of key derivation frequency and random number frequency domain features, resulting in side-channel vulnerabilities.

[0006] To achieve the above object, the present invention provides the following technical solutions: An information security management method based on data processing, including: S1: Multi-source heterogeneous data collection: Build a distributed probe network in the target system kernel layer, network protocol stack, storage controller, and cryptographic module to collect raw data, including system layer probes, network layer probes, storage layer probes, and cryptographic layer probes; S2: Multi-dimensional feature index calculation: Perform second-order calculations on the raw data collected in S1, and extract security features through mathematical modeling, including system process abnormal entropy value groups, network traffic covert channel detection groups, storage medium health monitoring groups, and cryptographic module operation feature groups; S3: Comprehensive threat detection calculation: Fuse the security features extracted in S2 through a non-linear formula to generate a quantitative threat value, including a kernel behavior entropy weight fusion model, an encrypted channel multi-modal detection model, a hardware health decay prediction model, and a cryptographic side-channel countermeasure evaluation model; S4: Adaptive threat decision-making: Adopt a dynamic threat grading mechanism to divide threat levels, perform adaptive threshold calculations, and finally perform threat determination and level matching according to the response policy library to achieve decision control.

[0007] Technical effects and advantages of the present invention: 1. Deep analysis and multi-modal detection of encrypted traffic: By constructing a protocol fingerprint entropy value model and a traffic self-similarity analysis framework, innovatively combining the certificate chain features in the TLS handshake stage, the session key negotiation mode, and the traffic Hurst exponent, breaking through the dependence of traditional deep packet detection technology on the content of encrypted payloads, effectively identifying covert channels based on certificate rotation and DNS tunnel attacks disguised by protocol compliance, and realizing metadata-level perception of threats at the encryption layer.

[0008] 2. Cross-dimensional attack chain reconstruction and dynamic perception: Adopt an improved entropy weight TOPSIS algorithm to establish a dynamic association model among system processes, network traffic, and storage media. Through the non-linear fusion of heterogeneous data such as kernel behavior deviation, traffic time series chaos characteristics, and bad block growth acceleration, construct a multi-hop attack path inference engine, significantly improving the detection ability of complex threats such as fileless attacks and supply chain contamination, and realizing cross-layer traceability from single-point anomalies to attack intentions.

[0009] 3. Joint modeling of hardware-level security postures: A joint monitoring mechanism for the physical characteristics of storage media - the behavior of cryptographic modules during operation. Real-time evaluate the health status of the media through the temperature-delay correlation coefficient, combined with the monitoring of the call density of the key derivation function and the frequency domain feature analysis of random numbers, forming a complete protection chain from the physical layer to the application layer, which can synchronously defend data extraction attacks based on media freezing and side-channel attacks relying on power consumption fluctuations, and realize the deep coordination of hardware security and cryptographic security. Description of the Drawings

[0010] Figure 1 This is the overall structural schematic diagram of the present invention.

[0011] Figure 2 This is the decision control structural schematic diagram of the present invention. Specific implementation manners

[0012] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0013] Refer to Figure 1 An information security management method based on data processing shown below, including: S1: Multi-source heterogeneous data collection: Build a distributed probe network in the target system kernel layer, network protocol stack, storage controller, and cryptographic module to collect raw data, including system layer probes, network layer probes, storage layer probes, and cryptographic layer probes.

[0014] The system layer probe deploys a BPF program in the kernel state through eBPF Runtime to capture process creation events, driver loading logs, and system call address offsets. The process creation event tracepoint is task_newtask, and the driver loading log tracepoint is module_load. A process hash reference library is generated using the BLAKE3 algorithm through a whitelist hash library, and the process memory image hash is calculated in real time. The network layer probe collects and shunts 10Gbps encrypted traffic and handshake phase metadata through DPDK bypass, and extracts the packet length distribution and traffic self-similarity through payload feature extraction. The storage layer probe obtains the bad block growth rate through NVMeAdmin instruction extension and reads the media temperature sensor, and measures the read / write latency jitter and firmware verification events through physical layer monitoring. The cryptographic layer probe intercepts through HSM instructions, deploys a hardware sniffer on the cryptographic module bus and records key derivation function calls, and samples the random number buffer through entropy source monitoring and calculates the real-time entropy value.

[0015] The S1 integrates software probes and hardware probes at the same time. The software probes achieve dynamic programmability, and the hardware probes ensure timing accuracy.

[0016] S2: Multi-dimensional feature index calculation: Perform second-order calculation on the raw data collected in S1, and extract security features through mathematical modeling, including system process abnormal entropy value groups, network traffic covert channel detection groups, storage medium health monitoring groups, and cryptographic module operation feature groups.

[0017] The abnormal entropy value group of the system process includes the process hash check deviation, the subprocess generation dispersion coefficient, the system call offset entropy value, and the driver loading frequency volatility. The network traffic covert channel detection group includes the protocol type distribution entropy, the payload length mutation index, the traffic time series self-similarity, and the TLS handshake metadata deviation. The storage medium health monitoring group includes the bad block growth acceleration, the firmware check period outlier, the temperature-write / read latency correlation coefficient, and the sector access frequency dispersion. The operation characteristic group of the cryptographic module includes the key derivation function call density, the skewness-kurtosis product of random numbers, the decryption failure time clustering degree, and the algorithm switching frequency domain feature.

[0018] The process hash check deviation is obtained by performing an exclusive OR operation on the hash value of each process and the reference hash in the whitelist, calculating the average value of the difference rate, and performing a non-linear amplification calculation. Specifically, it is expressed as: D p represents the process hash check deviation, N represents the total number of processes in the whitelist, H c (i) represents the binary hash value of the current process i, H w (i) represents the reference hash of process i in the whitelist, L represents the hash length, α represents the non-linear amplification coefficient. The subprocess generation dispersion coefficient is obtained by counting the number of subprocesses within multiple time windows and calculating the ratio of the standard deviation to the mean. Specifically, it is expressed as: C s represents the subprocess generation dispersion coefficient, x t represents the number of subprocesses in the t-th time window, T represents the total number of monitoring time windows, μ x represents the mean value of the number of subprocesses, ε represents the smoothing factor. The system call offset entropy value is obtained by counting the occurrence frequencies of different system call addresses, calculating the Shannon entropy, and combining with the variation degree of the offset. Specifically, it is expressed as: E sc represents the system call offset entropy value, p k represents the occurrence frequency of the k-th type of system call address, σΔ represents the standard deviation of the call address offset, μΔ represents the mean value of the offset, b represents the entropy calculation base, γ represents the offset correction factor. The driver loading frequency volatility is obtained by monitoring the number of driver loadings in each period and calculating the ratio of the maximum-minimum difference to the mean. Specifically, it is expressed as: F d represents the driver loading frequency volatility, f m represents the number of driver loadings in the m-th monitoring period, M represents the total number of monitoring periods, τ represents the period length correction coefficient.

[0019] The process hash check deviation is used to detect whether a process has been tampered with, identify malicious processes with inconsistent hashes, and solve the whitelist bypass problem. The discrete coefficient generated by child processes is used to discover abnormal process creation behaviors. The entropy value of system call offsets is used to identify system call injection or hook attacks and solve kernel-level Rootkit detection. The volatility of driver loading frequency is used to detect abnormal driver loading.

[0020] The system process anomaly entropy value group is used to detect advanced persistent threats and kernel-level Rootkits. Traditional solutions monitor the CPU / memory separately. This group quantifies system anomalies through the entropy value of process behaviors, and for the first time combines the driver loading frequency and system call offsets for analysis, which can identify hash tampering, code injection, and hidden driver loading behaviors, and solves the problem that existing technologies cannot detect whitelist bypass, fileless attacks, and kernel-mode malicious modules in an associated manner.

[0021] The protocol type distribution entropy is obtained by statistically calculating the occurrence frequency of protocols on non-standard ports and calculating the entropy value, and is specifically expressed as: E p represents the protocol type distribution entropy, n j represents the number of occurrences of the non-standard port protocol type j, N 1 represents the total number of connections, P std represents the set of standard protocol ports, represents the indicator function, β represents the abnormal protocol penalty factor, J represents the number of non-standard protocol types. The payload length mutation index is obtained by calculating the kurtosis of the payload length and adjusting it in combination with the Sigmoid function, and is specifically expressed as: Ib represents the payload length mutation index, l w represents the mean payload length of the w-th time window, W represents the total number of time windows, λ represents the kurtosis amplification coefficient, κ represents the steepness of the Sigmoid curve, L 0 represents the reference payload length. The self-similarity of the traffic time series is calculated by calculating the Hurst index through the rescaled range analysis, and is specifically expressed as: H represents the self-similarity of the traffic time series, R represents the rescaled range, S represents the standard deviation, T represents the observation time scale, δ represents the time fractal correction coefficient, η represents the Hurst index adjustment amount. The TLS handshake metadata deviation is obtained by comparing the differences between TLS fields and standard values and calculating the weighted Euclidean distance, and is specifically expressed as: D t represents the TLS handshake metadata deviation, v c (obs) represents the observed value of the c-th TLS field, v c (ref) represents the standard reference value, d cIndicates the field importance level, φ indicates the exponential decay factor, v c (max) Indicates the maximum observed value of the TLS field, v c (min) Indicates the minimum observed value of the TLS field, C indicates the number of key fields in the LS protocol.

[0022] The protocol type distribution entropy is used to identify protocol obfuscation of unconventional ports, detect encrypted tunnels, and solve the problem of covert channels. The payload length mutation exponent is used to discover abnormal fluctuations in the payload length, identify data leakage or covert communication, and solve the problem of insufficient traffic pattern analysis. The traffic time series self-similarity is used to detect traffic patterns with long-term dependencies, identify DDoS or scanning attacks, and solve the problem of time series neglect in traditional methods. The TLS handshake metadata deviation is used to discover TLS handshake anomalies, such as forged certificates or expired protocols, and solve the man-in-the-middle attack problem in encrypted traffic.

[0023] The network traffic covert channel detection group is used to identify encrypted tunnels and covert communication channels, break through traditional detection based on traffic size, apply the Hurst exponent to encrypted traffic analysis for the first time, and combine TLS metadata anomaly detection to discover DNS tunnels and HTTPS covert channels, solving the problem that existing solutions lack joint analysis of time series features and protocol metadata in encrypted traffic.

[0024] The bad block growth acceleration measures the bad block growth trend through the second derivative, and is calculated by combining the aging coefficient and nonlinear decay. Specifically, it is expressed as: A b Indicates the bad block growth acceleration, B t Indicates the total number of bad blocks at time t, Δt indicates the monitoring interval, ρ indicates the media aging coefficient, ω indicates the nonlinear decay factor, and the firmware verification period outlier is obtained by calculating the Z-Score of the current failure times. Specifically, it is expressed as: Z f Indicates the firmware verification period outlier, F indicates the number of verification failures in the current period, μ F Indicates the mean value of the failure times in the historical period, σ F Indicates the standard deviation, θ indicates the dynamic sensitivity coefficient, ζ indicates the nonlinear suppression factor, and the temperature-write / read delay correlation coefficient is calculated by combining the Pearson correlation coefficient with the temperature change gradient. Specifically, it is expressed as: R tl Indicates the temperature-write / read delay correlation coefficient, T n Indicates the nth temperature sampling value, L nIt represents the corresponding delay value, ΔT represents the temperature change gradient, ξ represents the environmental compensation coefficient, ν represents the temperature sensitivity parameter. The sector access frequency dispersion is measured by the Gini coefficient to measure the uneven access distribution, and is calculated by adding a compensation term, specifically expressed as: G s represents the sector access frequency dispersion, K represents the total number of groups of sector access frequencies, k represents the serial number of the current calculated section, f r represents the frequency of the r-th section arranged in ascending order of access frequency, ι represents the radix correction exponent, and π represents the Lorenz curve compensation term.

[0025] The bad block growth acceleration is used to predict storage medium failures, early warning of the risk of data loss, and solving the problem of lagged detection of hardware failures. The firmware verification cycle outliers are used to detect firmware tampering, prevent malicious firmware loading, and solve the firmware-level attack problem. The temperature-write / read delay correlation coefficient is used to discover temperature-related physical attacks, such as freezing attacks, and solve the physical side-channel problem of the storage medium. The sector access frequency dispersion is used to identify abnormal access patterns, detect data theft or damage, and solve the problem of insufficient storage access pattern analysis.

[0026] The storage medium health monitoring group is used to prevent hardware-level data leakage and physical attacks, and for the first time establishes a mathematical model of the physical characteristics and security status of the storage medium. It predicts the data risk induced by hardware failures through the bad block growth acceleration, and solves the problems of the existing technology that ignores the impact of temperature on storage security and cannot detect physical side-channel attacks against the storage controller.

[0027] The key derivation function call density is obtained by calculating the change rate of the key derivation times and suppressing periodic fluctuations, specifically expressed as: ,ρ k represents the key derivation function call density, K t represents the key derivation times at time t, Δ represents the differential time window, ε 1 represents the periodic fluctuation suppression factor, ω 1 represents the system load associated frequency. The random number skewness-kurtosis product is obtained by calculating the product of the skewness and kurtosis of random numbers and adjusting the influence of the sample size, specifically expressed as: ,P r represents the random number skewness-kurtosis product, r s represents the s-th random number sample, S represents the total number of samples, ψ represents the statistical coupling coefficient, χ represents the sample size correction factor. The decryption failure time clustering degree is obtained by calculating the ratio of the DBSCAN clustering core points to the time interval and smoothing, specifically expressed as: ,C d represents the decryption failure time clustering degree, Ncore represents the number of DBSCAN core points, N drepresents the number of samples in the d-th cluster, ε 2 represents the neighborhood radius parameter, represents the time interval smoothing factor, D represents the total number of clusters generated by the clustering algorithm, t e and t j represent the timestamps of two different decryption failure events. The algorithm switches the frequency domain features to extract the main frequency amplitude through Fourier transform and calculates by adjusting the attenuation factor, specifically expressed as: , F a represents the algorithm-switching frequency domain feature, a t represents the algorithm-switching time series, F represents the Fourier transform operator, f 0 represents the main frequency component, η represents the amplitude sensitivity coefficient, and μ represents the frequency domain attenuation factor.

[0028] The call density of the key derivation function is used to detect key leakage or abuse and solve the problem of abnormal key derivation frequency. The skewness-kurtosis product of random numbers is used to evaluate the quality of random numbers, discover pseudo-random defects, and solve the problem of random number generator vulnerabilities. The clustering degree of decryption failure time is used to identify brute-force cracking attempts and solve the time pattern analysis of decryption attacks. The algorithm-switching frequency domain feature is used to detect abnormal algorithm switches and identify the use of backdoors or weak algorithms.

[0029] The running feature group of the cryptographic module is used to detect side-channel vulnerabilities and backdoors of the cryptographic module. For the first time, the signal processing method is applied to the monitoring of the cryptographic module. By identifying abnormal algorithm switching patterns through frequency domain features, it solves the problem that traditional solutions only verify cryptographic results. This group can discover key derivation attacks based on time features and algorithm selection vulnerabilities.

[0030] S3: Comprehensive threat detection calculation: Fuse the security features extracted in S2 through a non-linear formula to generate a quantified threat value, including the kernel behavior entropy weight fusion model, the encrypted channel multi-modal detection model, the hardware health attenuation prediction model, and the cryptographic side-channel countermeasure evaluation model.

[0031] The kernel behavior entropy weight fusion model is specifically expressed as: , Ψ s represents the comprehensive detection value of system process anomalies, ν 1 represents the entropy value weight adjustment exponent, ζ 1 Process behavior coupling coefficient, ε 3 Process activity correction amount, A p represents the normalized value of the survival time.

[0032] The kernel behavior entropy weight fusion model fuses the process hash check deviation and the system call entropy value through geometric mean, retains the feature differences of different dimension indicators, and uses the exponential parameter ν 1Adjust the entropy weight, introduce the arctangent function to constrain the product of the subprocess discrete coefficient and the drive loading volatility, effectively suppress the risk of numerical overflow. The logarithmic term combines with the process survival time factor to enhance the detection sensitivity to long-term latent malicious processes. Finally, comprehensively quantify the multi-dimensional anomalies such as process behavior, kernel calls, and drive loading, significantly improve the detection ability for fileless attacks, kernel-level Rootkits, and stealth process injection, reduce the false positive rate of single-index detection in traditional solutions, break through the limitation of traditional antivirus software relying only on signature matching, and solve the problem of difficult correlation analysis of multi-dimensional behavior characteristics in advanced threats.

[0033] The multi-modal detection model of the encrypted channel is specifically expressed as: , Φ n represents the comprehensive value of the network traffic covert channel, f represents the main frequency component of the traffic, f is extracted by FFT, f c represents the cut-off frequency of the channel characteristics, and Π is a constant.

[0034] The multi-modal detection model of the encrypted channel amplifies the abnormal characteristics of encrypted traffic through the product of the protocol entropy value and the payload mutation index, quantifies the difference in traffic self-similarity using the Hurst index deviation in the denominator term, captures the resonance phenomenon of TLS metadata on specific frequency components through the infinite norm operation in the frequency domain, and realizes the frequency domain enhancement of abnormal characteristics through sine function modulation. Finally, fuse the time domain and frequency domain characteristics to identify the encrypted channel, effectively identify the covert communication in encrypted traffic such as HTTPS camouflage channels and DNS tunnels, overcome the parsing obstacle of the deep packet inspection technology for encrypted payloads, and solve the problem that traditional traffic analysis solutions cannot associate protocol metadata, payload statistical characteristics, and traffic timing rules.

[0035] The hardware health decay prediction model is specifically expressed as: , Ω h represents the comprehensive index of the storage medium health, λ 1 represents the bad block growth sensitivity coefficient, erf represents the Gaussian error function, κ 1 represents the temperature gradient amplification factor, and ΔT represents the temperature change rate.

[0036] The hardware health decay prediction model uses an exponential function to strengthen the early warning ability of the bad block growth acceleration, converts the firmware verification abnormal value into a probability distribution form through the error function, and combines the joint calculation of the temperature-delay correlation coefficient and the access dispersion with the hyperbolic tangent function to quantify the impact of physical environment changes on storage security, realize the multi-physical quantity collaborative perception of hardware anomalies, early warn of data storage risks caused by media aging or physical attacks, distinguish between natural hardware wear and malicious tampering behaviors, overcome the defect of SMART technology only monitoring a single physical parameter, and solve the problem of non-correlation of multi-dimensional physical characteristics in hardware-level security threats.

[0037] The password side-channel countermeasure evaluation model is specifically expressed as: , Γ c represents the comprehensive security evaluation value of the password module, ⊘ represents element-wise division, ⊗ represents the contraction operation of the tensor product, and W τ represents the time decay weight matrix, and ι 1 represents the random number stability factor.

[0038] The password side-channel countermeasure evaluation model balances the relationship between key derivation density and random number statistical quality through element-wise division, filters low-risk decryption failure events using the rectified linear unit, combines time-varying weighted analysis of frequency domain features with second-order norm operations to capture instantaneous abnormal patterns of password algorithm switching, realizes multi-scale evaluation of the runtime security state, accurately identifies password module security threats such as side-channel attacks and weak random number vulnerabilities, improves the real-time defense against new password attacks, breaks through the limitation of traditional password verification that only focuses on algorithm correctness, and solves the technical blind spot of not monitoring multi-dimensional features during the operation of the password system.

[0039] S4: Adaptive threat decision-making: Adopt a dynamic threat grading mechanism to divide threat levels, perform adaptive threshold calculation, and finally make threat determination and level matching according to the response policy library to achieve decision control.

[0040] The dynamic threat grading mechanism divides the judgment conditions into emergency level, high-risk level, medium-risk level, and low-risk level. The emergency level is triggered when the target system Ψ s > θ 1 and Γ c > θ 4 The high-risk level is triggered when Φ n exceeds θ for 3 consecutive cycles 2 The medium-risk level is triggered when Ω h > θ 3 and > 0. The low-risk level is triggered when any threat value exceeds the baseline value but does not reach the threshold.

[0041] The core algorithm of the adaptive threshold calculation is specifically expressed as: , θ u (t) represents the threat value, μhist represents the historical data mean, μ real represents the real-time sliding window mean, α 1 represents the historical weight factor, β 1 represents the variance decay coefficient, k 1 represents the sensitivity parameter, and σ is the standard deviation.

[0042] Reference Figure 2, the response policy library includes emergency-level response, high-risk-level response, medium-risk-level response, and low-risk-level response. When the emergency-level response is triggered, the system first freezes the abnormal process and clears the memory mapping through the cgroup subsystem of the kernel, then sends an RST packet to the corresponding network connection to forcibly terminate the session, and calls the OpenSSL interface to revoke the TLS session key. Immediately afterwards, it triggers the physical presence verification process of the TPM chip to lock the password module operation, pauses all asymmetric encryption calculations, and finally creates an encrypted memory snapshot through the LiME tool and directly clones the solid-state disk data with the NVMe controller to generate a forensic image that complies with the DFRWS standard. When the high-risk-level response is triggered, the system redirects the suspicious data packets to the sandbox environment through the DPDK high-speed traffic framework for in-depth protocol analysis, and at the same time creates a storage snapshot based on the copy-on-write technology of LVM and switches to read-only mode to prevent data tampering. Subsequently, it dynamically issues flow table rules through the OpenFlow protocol to isolate the abnormal IP and deploys a mimic defense gateway at the network boundary to dynamically change the service fingerprint, forming a multi-layer protection system to block lateral penetration. When the medium-risk-level response is triggered, the system first identifies the active sectors recorded in the FTL layer, transparently migrates the hot data to the healthy storage node through the NVMe-oF protocol, and at the same time checks the UEFI firmware signature chain and rolls back to the secure version, and calls the IPMI interface to reduce the controller voltage, combined with the liquid cooling system pressurization and the IO scheduling algorithm switch, to achieve the suppression of hardware failures. When the low-risk-level response is triggered, the system generates Syslog events that comply with the RFC5424 standard, pushes standardized alarms to the network management platform through the SNMP Trap protocol, triggers three-dimensional visual warnings on the management interface, and at the same time intercepts the first 128-byte metadata of the traffic packet and the complete kernel audit log, generates a structured report according to the STIX 2.1 threat intelligence framework and archives it in the blockchain evidence storage system to provide a traceable data basis.

[0043] Secondly: In the accompanying drawings of the disclosed embodiments of the present invention, only the structures related to the disclosed embodiments of the present disclosure are involved. Other structures can refer to the general design. Without conflict, the same embodiment and different embodiments of the present invention can be combined with each other; Finally: The above are only the preferred embodiments of the present invention and are not used to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An information security management method based on data processing, characterized in that: include: S1: Multi-source heterogeneous data collection: Construct a distributed probe network in the target system kernel layer, network protocol stack, storage controller and cryptographic module to collect raw data, including system layer probes, network layer probes, storage layer probes and cryptographic layer probes; S2: Calculation of multi-dimensional characteristic indicators: Perform second-order calculations on the original data collected by S1, and extract security features through mathematical modeling, including the system process abnormal entropy value group, network traffic covert channel detection group, storage medium health monitoring group, and cryptographic module operation feature group; S3: Comprehensive threat detection calculation: The security features extracted by S2 are fused through nonlinear formulas to generate quantitative threat values, including kernel behavior entropy weight fusion model, encrypted channel multimodal detection model, hardware health attenuation prediction model, and cryptographic side channel adversarial assessment model; S4: Adaptive threat decision-making: A dynamic threat classification mechanism is used to divide threat levels and perform adaptive threshold calculations. Finally, threat determination and level matching are performed based on the response strategy library to achieve decision control.

2. The information security management method based on data processing according to claim 1 is characterized in that: The system layer probe deploys BPF program in kernel state through eBPF Runtime to capture process creation events, driver loading logs and system call address offsets. The process creation event tracking point is task_newtask, and the driver loading log tracking point is module_load. The process hash benchmark library is generated by using the BLAKE3 algorithm through the whitelist hash library, and the process memory image hash is calculated in real time. The network layer probe collects and diverts 10Gbps encrypted traffic and handshake stage metadata through DPDK bypass, and extracts statistical packet length distribution and traffic self-similarity through load feature extraction. The storage layer probe obtains the bad block growth rate and reads the medium temperature sensor through the NVMe Admin instruction extension, and measures the read and write delay jitter and firmware verification events through physical layer monitoring. The cryptographic layer probe intercepts through HSM instructions, deploys a hardware sniffer on the cryptographic module bus and records key derivation function calls, and monitors the sampled random number buffer through the entropy source and calculates the real-time entropy value.

3. The information security management method based on data processing according to claim 1 is characterized in that: The system process abnormal entropy value group includes process hash check deviation, sub-process generation discrete coefficient, system call offset entropy value and driver loading frequency volatility; the network traffic covert channel detection group includes protocol type distribution entropy, load length mutation index, traffic time series self-similarity and TLS handshake metadata deviation; the storage medium health monitoring group includes bad block growth acceleration, firmware check cycle abnormal value, temperature-read and write delay correlation coefficient and sector access frequency discreteness; the cryptographic module operation feature group includes key derivation function call density, random number skewness-kurtosis product, decryption failure time clustering degree and algorithm switching frequency domain characteristics.

4. The information security management method based on data processing according to claim 3 is characterized in that: The process hash check deviation is obtained by performing an XOR operation on the hash value of each process and the reference hash in the whitelist, calculating the average value of the difference rate, and performing a nonlinear amplification calculation, which is specifically expressed as: D p Indicates the process hash check deviation, N indicates the total number of whitelist processes, H c (i) Represents the binary hash value of the current process i, H w (i) represents the base hash of process i in the whitelist, L represents the hash length, α represents the nonlinear amplification factor, and the discrete coefficient of sub-process generation is calculated by counting the number of sub-processes in multiple time windows and calculating the ratio of the standard deviation to the mean, which is specifically expressed as: C s Indicates that the subprocess generates discrete coefficients, x t represents the number of subprocesses in the tth time window, T represents the total number of monitoring time windows, μ x represents the mean number of subprocesses, ε represents the smoothing factor, and the entropy of the system call offset is calculated by counting the frequency of occurrence of different system call addresses, calculating the Shannon entropy, and combining it with the degree of variation of the offset. It is specifically expressed as: E sc Indicates the entropy value of the system call offset, p k represents the frequency of occurrence of the k-th type of system call address, σΔ represents the standard deviation of the call address offset, μΔ represents the mean of the offset, b represents the entropy calculation base, γ represents the offset correction factor, and the driver loading frequency volatility is obtained by monitoring the number of driver loading times in each cycle and calculating the ratio of the maximum and minimum differences to the mean, which is specifically expressed as: F d represents the driving loading frequency fluctuation rate, f m represents the number of drive loadings in the mth monitoring cycle, M represents the total number of monitoring cycles, and τ represents the cycle length correction coefficient.

5. The information security management method based on data processing according to claim 3 is characterized in that: The protocol type distribution entropy is obtained by counting the frequency of occurrence of protocols on non-standard ports and calculating the entropy value, which is specifically expressed as: E p represents the entropy of the protocol type distribution, n j represents the number of occurrences of non-standard port protocol type j, N1 represents the total number of connections, P std Represents a set of standard protocol ports. represents the indicator function, β represents the abnormal protocol penalty factor, J represents the number of non-standard protocol types, and the payload length mutation index is calculated by calculating the kurtosis of the payload length to measure the sharpness of the distribution, combined with the Sigmoid function adjustment, and is specifically expressed as: Ib represents the load length mutation index, l w represents the mean load length of the wth time window, W represents the total number of time windows, λ represents the kurtosis amplification factor, κ represents the steepness of the Sigmoid curve, L0 represents the benchmark load length, and the self-similarity of the traffic time series is calculated by the Hurst index calculated by rescaling the range analysis, which is specifically expressed as: H represents the self-similarity of the traffic time series, R represents the rescaled range, S represents the standard deviation, T represents the observation time scale, δ represents the time fractal correction coefficient, η represents the Hurst exponent adjustment, and the TLS handshake metadata deviation is calculated by comparing the difference between the TLS field and the standard value and weighted calculation of the Euclidean distance, which is specifically expressed as: D t Indicates the TLS handshake metadata deviation, v c (obs) represents the cth TLS field observation value, v c (ref) Indicates the standard reference value, d c represents the importance level of the field, φ represents the exponential decay factor, and v c (max) Indicates the maximum observed value of the TLS field, v c (min) represents the minimum observed value of the TLS field, and C represents the number of key fields of the LS protocol.

6. The information security management method based on data processing according to claim 3 is characterized in that: The bad block growth acceleration is calculated by measuring the bad block growth trend through the second-order derivative and combining the aging coefficient and nonlinear attenuation, and is specifically expressed as: A b Indicates the bad block growth acceleration, B t It represents the total number of bad blocks at time t, Δt represents the monitoring interval, ρ represents the medium aging coefficient, ω represents the nonlinear attenuation factor, and the firmware verification cycle abnormal value is obtained by calculating the Z-Score of the current number of failures, which is specifically expressed as: Z f Indicates the abnormal value of the firmware verification cycle, F indicates the number of verification failures in the current cycle, μ F represents the mean number of failures in the historical cycle, σ F represents the standard deviation, θ represents the dynamic sensitivity coefficient, ζ represents the nonlinear suppression factor, and the temperature-read / write delay correlation coefficient is calculated by combining the Pearson correlation coefficient with the temperature gradient, which is specifically expressed as: R tl represents the temperature-read / write delay correlation coefficient, T n Indicates the nth temperature sampling value, L n represents the corresponding delay value, ΔT represents the temperature change gradient, ξ represents the environmental compensation coefficient, ν represents the temperature sensitivity parameter, and the sector access frequency dispersion is measured by the Gini coefficient to measure the uneven access distribution, which is calculated by adding the compensation term. Specifically, it is expressed as: G s represents the sector access frequency dispersion, K represents the total number of sector access frequency groups, k represents the current calculated segment number, f r represents the frequency of the rth segment in ascending order of access frequency, ι represents the cardinality correction index, and π represents the Lorenz curve compensation term.

7. The information security management method based on data processing according to claim 3 is characterized in that: The key derivation function call density is obtained by calculating the change rate of the key derivation times and suppressing periodic fluctuations, which is specifically expressed as: , ρ k represents the key derivation function call density, K t represents the number of key derivations at time t, Δ represents the differential time window, ε1 represents the periodic fluctuation suppression factor, ω1 represents the system load correlation frequency, and the random number skewness-kurtosis product is obtained by calculating the product of the skewness and kurtosis of the random number and adjusting the sample size effect, which is specifically expressed as: , P r represents the random number skewness-kurtosis product, r s represents the sth random number sample, S represents the total number of samples, ψ represents the statistical coupling coefficient, χ represents the sample size correction factor, and the decryption failure time clustering degree is obtained by calculating the ratio of the DBSCAN clustering core point to the time interval and smoothing it, which is specifically expressed as: , C d represents the clustering degree of decryption failure time, Ncore represents the number of DBSCAN core points, and N d represents the number of samples in the dth cluster, ε2 represents the neighborhood radius parameter, represents the time interval smoothing factor, D represents the total number of clusters generated by the clustering algorithm, and t e and t j Indicates the timestamps of two different decryption failure events. The algorithm switches the frequency domain features by extracting the main frequency amplitude through Fourier transform and adjusting the attenuation factor to calculate. Specifically, it is expressed as: , F a represents the frequency domain characteristics of algorithm switching, a t represents the algorithm switching time series, F represents the Fourier transform operator, f0 represents the main frequency component, η represents the amplitude sensitivity coefficient, and μ represents the frequency domain attenuation factor.

8. The information security management method based on data processing according to claim 1 is characterized by: The kernel behavior entropy weight fusion model is specifically expressed as: ,Ψ s represents the comprehensive detection value of system process anomalies, ν1 represents the entropy weight adjustment index, ζ1 represents the process behavior coupling coefficient, ε3 represents the process activity correction value, A p represents the standardized value of survival time; The encrypted channel multimodal detection model is specifically expressed as: , Φ n represents the comprehensive value of the network traffic covert channel, f represents the main frequency component of the traffic, f is extracted through FFT, and f c represents the channel characteristic cutoff frequency, Π is a constant; The hardware health decay prediction model is specifically expressed as: ,Ω h represents the comprehensive index of storage medium health, λ1 represents the bad block growth sensitivity coefficient, erf represents the Gaussian error function, κ1 represents the temperature gradient amplification factor, and ΔT represents the temperature change rate; The cryptographic side channel adversarial evaluation model is specifically expressed as: , Γ c represents the comprehensive security evaluation value of the cryptographic module, ⊘ represents element-level division, ⊗ represents tensor product-contraction operation, and W τ represents the time decay weight matrix, and ι1 represents the random number stability factor.

9. The information security management method based on data processing according to claim 1 is characterized in that: The dynamic threat classification mechanism divides the judgment conditions into emergency level, high risk level, medium risk level and low risk level. The emergency level is determined by the target system. s >θ1 and Γ c >θ4, the high-risk level is Φ n Triggered when θ2 is exceeded for 3 consecutive cycles, medium-risk level is Ω h >θ3 and >0, the low-risk level is triggered when any threat value exceeds the baseline value but does not reach the threshold; The core algorithm of the adaptive threshold calculation is specifically expressed as follows: ,θ u (t) represents the threat value, μhist represents the mean of historical data, μ real represents the real-time sliding window mean, α1 represents the historical weight factor, β1 represents the variance attenuation coefficient, k1 represents the sensitivity parameter, and σ represents the standard deviation; The response strategy library includes emergency response, high-risk response, medium-risk response and low-risk response. When the emergency response is triggered, the system first freezes the abnormal process and clears the memory mapping through the kernel's cgroup subsystem, then sends an RST packet to the corresponding network connection to forcefully terminate the session, and calls the OpenSSL interface to revoke the TLS session key, and then triggers the physical presence verification process of the TPM chip to lock the password module operation, suspend all asymmetric encryption calculations, and finally creates an encrypted memory snapshot through the LiME tool, and uses the NVMe controller to directly clone the solid-state disk data to generate a forensic image that meets the DFRWS standard. When the high-risk response is triggered, the system redirects the suspicious data packet to the sandbox environment for deep protocol analysis through the DPDK high-speed traffic framework. When a medium-risk response is triggered, the system prioritizes identifying active sectors recorded in the FTL layer, transparently migrates hot data to healthy storage nodes through the NVMe-oF protocol, verifies the UEFI firmware signature chain and rolls back to the safe version, calls the IPMI interface to reduce the controller voltage, combines the liquid cooling system boost and IO scheduling algorithm switching to suppress hardware failures, and generates a Syslog event that complies with the RFC5424 standard when a low-risk response is triggered. It pushes standardized alarms to the network management platform through the SNMP Trap protocol, triggers a three-dimensional visual alarm on the management interface, and intercepts the first 128 bytes of metadata and the complete kernel audit log of the traffic packet. A structured report is generated according to the STIX 2.1 threat intelligence framework and archived in the blockchain evidence storage system to provide a traceable data basis.

Images