Computer information real-time security detection method and system

Abstract

The invention belongs to the technical field of computer information security, and particularly relates to a computer information real-time security detection method and system. According to the method, the whole detection process can quickly respond to security threat changes through the real-time acquisition and dynamic compensation mechanism of the multi-source data, potential attacks can be found and defended in time, the threat assessment and compensation mechanism is continuously optimized through multi-round iteration, the detection precision and the real-time response capability are effectively improved, and the detection efficiency is improved. Various data sources such as network traffic, memory access, program behaviors and system logs are adopted, all links of network security attacks can be comprehensively covered, the risk of misjudgment or missed judgment of single data is reduced, all the data sources complement one another, details of abnormal behaviors can be more accurately captured, and therefore the detection capacity for complex attack techniques is enhanced, and the detection efficiency is improved. The method can adapt to a novel attack technology and a rapidly changing network environment.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer information security, and particularly relates to a method and system for real-time security detection of computer information. Background Art

[0002] With the continuous development of computer technology, network communication technology, and information systems, information data has become an important resource to support social operation, industrial development, and personal life. However, the complexity and openness of the network environment make computer information systems face increasingly severe security threats. Security incidents such as malicious attacks, system intrusions, abnormal behavior manipulations, and information theft occur frequently, seriously threatening the integrity, confidentiality, and availability of information assets. Therefore, how to perform real-time, efficient, and accurate security threat detection on computer information systems and make timely defensive responses has become one of the key issues in the field of network security.

[0003] Most of the existing security detection methods rely on static rule matching, black and white list identification, or single-dimensional behavior analysis. Although these methods have certain effects in specific scenarios, there are still deficiencies. Traditional methods mostly focus on network traffic or log data, ignoring important security features in other dimensions such as memory access and program behavior, which easily leads to security detection blind spots and reduces the comprehensiveness and accuracy of detection. They mostly make static judgments based on one-time evaluation results and cannot compensate and self-adjust according to changes in the system operation state, resulting in slow responses or inaccurate evaluations when facing sudden or hidden attacks. Most detection mechanisms only give threat prompts or abnormal alarms and fail to form a closed-loop linkage with defense strategies, making it difficult to achieve automated defense or auxiliary strategy deployment. Summary of the Invention

[0004] The purpose of the present invention is to provide a method and system for real-time security detection of computer information, which can perform dynamic compensation, adaptive iterative optimization, and real-time security detection methods and systems linked with defense strategies to achieve continuous, efficient, and precise protection of computer information systems.

[0005] The technical solutions adopted by the present invention are specifically as follows: A method for real-time security detection of computer information, including: Obtaining multi-source network security data of computer information, where the multi-source network security data includes network traffic packet data, memory access data, program behavior data, and system log data; Obtaining abnormal state evaluation information according to the multi-source network security data, and obtaining an initial compensation value according to the abnormal state evaluation information; Obtaining an information threat evaluation value based on the initial compensation value and the multi-source network security data, and obtaining a dynamic compensation value according to the information threat evaluation value; Based on the number of iterations for obtaining multi-source network security data, use the dynamic compensation value as the initial compensation value for the next round, and repeat the steps of obtaining the information threat assessment value and the dynamic compensation value until the number of iterations is met; Obtain the comprehensive threat information within the number of iterations, obtain the information defense strategy based on the comprehensive threat information, and generate a detection report.

[0006] In a preferred solution, the steps of obtaining the abnormal state assessment information based on the multi-source network security data, obtaining the initial compensation value based on the abnormal state assessment information, obtaining the information threat assessment value based on the initial compensation value and the multi-source network security data, and obtaining the dynamic compensation value based on the information threat assessment value include: Obtain the corresponding network traffic packet matrix according to the network traffic packet data, and obtain the corresponding multiple network traffic packet vectors according to the network traffic packet matrix; Obtain the corresponding memory access matrix according to the memory access data, and obtain the memory access vector corresponding to each network traffic packet vector according to the memory access matrix; Obtain the corresponding program behavior matrix according to the program behavior data, and obtain the program behavior vector corresponding to each network traffic packet vector according to the program behavior matrix; Obtain the corresponding system log matrix according to the system log data, and obtain the system log vector corresponding to each network traffic packet vector according to the system log matrix; Obtain the security state value based on the multiple network traffic packet vectors, multiple memory access vectors, multiple program behavior vectors, and multiple system log vectors; Obtain the preset standard of the security state, and determine whether the security state value meets the preset standard of the security state; If the security state value does not meet the preset standard of the security state, determine that the network security of the computer information is in an abnormal state, and mark it as abnormal state assessment information; If the security state value meets the preset standard of the security state, determine that the network security of the computer information is in a normal state, and mark it as normal state assessment information.

[0007] Obtain the initial compensation value according to the abnormal state assessment information.

[0008] In a preferred solution, the steps of obtaining the initial compensation value according to the abnormal state assessment information include: Obtain the corresponding security state value according to the abnormal state assessment information; Obtain the initial compensation table, where the initial compensation table includes multiple security state intervals and the initial compensation value corresponding to each security state interval; Obtain the corresponding initial compensation value from the initial compensation table according to the security state interval corresponding to the security state value.

[0009] In a preferred solution, the step of obtaining a dynamic compensation value according to the initial compensation value and the information threat assessment value obtained from multi-source network security data includes: Obtain multiple network traffic packet vectors, multiple memory access vectors, multiple program behavior vectors, and multiple system log vectors based on the multi-source network security data; Obtain the information threat assessment value according to the initial compensation value, multiple network traffic packet vectors, multiple memory access vectors, multiple program behavior vectors, and multiple system log vectors; Obtain the dynamic compensation value according to the information threat assessment value.

[0010] In a preferred solution, the step of obtaining a dynamic compensation value according to the information threat assessment value includes: Obtain the standard information threat assessment value; Obtain the threat deviation value according to the standard information threat assessment value, the information threat assessment value, and the initial compensation value; Obtain the dynamic compensation table, where the dynamic compensation table includes multiple threat deviation intervals and the dynamic compensation values corresponding to each threat deviation interval; Obtain the corresponding dynamic compensation value from the dynamic compensation table according to the threat deviation interval corresponding to the threat deviation value.

[0011] In a preferred solution, the step of obtaining the number of iterations according to the multi-source network security data, using the dynamic compensation value as the initial compensation value for the next round, and repeating the steps of obtaining the information threat assessment value and the dynamic compensation value until the number of iterations is met includes: Obtain the corresponding security status value according to the abnormal status assessment information; Obtain the comprehensive index value according to the security status value, the initial compensation value, and the information threat assessment value; Obtain the number table, where the number table includes multiple comprehensive index intervals and the number of iterations corresponding to each comprehensive index interval; Obtain the corresponding number of iterations from the number table according to the comprehensive index interval corresponding to the comprehensive index value; Use the dynamic compensation value as the initial compensation value for the next round, and repeat the steps of obtaining the information threat assessment value and the dynamic compensation value until the number of iterations is met.

[0012] In a preferred solution, it further includes: When, within the number of iterations, the information threat assessment values obtained by continuous iteration do not meet the preset conditions, mark the information threat assessment values that do not meet the preset conditions as abnormal information threat assessment values; Obtain the comprehensive index update value according to the security status value, the initial compensation value, and multiple abnormal information threat assessment values; Obtain an update times table, where the update times table includes multiple comprehensive index update intervals and the corresponding iterative update times for each comprehensive index update interval; Obtain the corresponding iterative update times from the update times table according to the comprehensive index update interval corresponding to the comprehensive index update value, and re-iterate according to the iterative update times until the iterative update times are satisfied; Obtain the comprehensive threat information within the iterative update times, obtain the information defense strategy according to the comprehensive threat information, and generate a detection report.

[0013] In a preferred solution, the steps of obtaining the comprehensive threat information within the iterative times, obtaining the information defense strategy according to the comprehensive threat information, and generating a detection report include: Obtain multiple information threat assessment values within the iterative times; Obtain the comprehensive threat value according to the multiple information threat assessment values and mark it as comprehensive threat information; Obtain a strategy table, where the strategy table includes multiple comprehensive threat intervals and the corresponding defense strategies for each comprehensive threat interval; Obtain the corresponding defense strategy from the strategy table according to the comprehensive threat interval corresponding to the comprehensive threat value, and generate a detection report.

[0014] The present invention also provides a computer information real-time security detection system for the above computer information real-time security detection method, including: A network data module for obtaining multi-source network security data of computer information, where the multi-source network security data includes network traffic packet data, memory access data, program behavior data, and system log data; An anomaly compensation module for obtaining anomaly status evaluation information according to the multi-source network security data and obtaining an initial compensation value according to the anomaly status evaluation information; A threat compensation module for obtaining an information threat assessment value based on the initial compensation value and the multi-source network security data, and obtaining a dynamic compensation value according to the information threat assessment value; An iteration module for obtaining the iteration times according to the multi-source network security data, using the dynamic compensation value as the initial compensation value for the next round, and repeating the steps of obtaining the information threat assessment value and the dynamic compensation value until the iteration times are satisfied; A defense module for obtaining the comprehensive threat information within the iteration times, obtaining the information defense strategy according to the comprehensive threat information, and generating a detection report.

[0015] And, a computer information real-time security detection terminal, including: One or more processors; A storage device on which one or more programs are stored; When one or more programs are executed by one or more processors, the one or more processors implement a method for real-time security detection of computer information.

[0016] The technical effects achieved by the present invention are as follows: In the present invention, the real-time acquisition of multi-source data and the dynamic compensation mechanism enable the entire detection process to quickly respond to changes in security threats, timely discover and defend against potential attacks. Through multiple rounds of iteration, the threat assessment and compensation mechanism are continuously optimized, effectively improving the detection accuracy and real-time response ability. By using multiple data sources such as network traffic, memory access, program behavior, and system logs, all aspects of network security attacks can be comprehensively covered, reducing the risk of misjudgment or missed judgment of single data. Each data source complements each other, enabling more accurate capture of details of abnormal behavior, thereby enhancing the detection ability for complex attack techniques and being able to adapt to new attack technologies and rapidly changing network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a flowchart of the method provided by the present invention; Figure 2 is a system module diagram provided by the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0018] In order to make the above objects, features, and advantages of the present invention more obvious and understandable, the following detailed description of the specific embodiments of the present invention will be given with reference to the accompanying drawings of the specification.

[0019] In the following description, many specific details are set forth in order to fully understand the present invention. However, the present invention can also be implemented in other ways different from those described herein. Those skilled in the art can make similar generalizations without departing from the connotation of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed below.

[0020] Secondly, the so-called "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that can be included in at least one implementation manner of the present invention. The "in a preferred embodiment" that appears in different places in this specification does not all refer to the same embodiment, nor is it a separate or alternative embodiment that mutually excludes other embodiments.

[0021] Furthermore, the present invention is described in detail with reference to the schematic diagrams. When describing the embodiments of the present invention in detail, for the sake of convenience of explanation, the schematic diagrams are only examples and should not limit the scope of protection of the present invention here.

[0022] Please refer to the attached Figure 1 As shown, a method for real-time security detection of computer information is provided, including: S1. Obtain multi-source network security data of computer information, where the multi-source network security data includes network traffic packet data, memory access data, program behavior data, and system log data; S2. Obtain abnormal state evaluation information based on the multi-source network security data, and obtain an initial compensation value according to the abnormal state evaluation information; S3. Obtain an information threat evaluation value based on the initial compensation value and the multi-source network security data, and obtain a dynamic compensation value according to the information threat evaluation value; S4. Obtain the number of iterations based on the multi-source network security data, use the dynamic compensation value as the initial compensation value for the next round, and repeat the steps of obtaining the information threat evaluation value and the dynamic compensation value until the number of iterations is satisfied; S5. Obtain the comprehensive threat information within the number of iterations, obtain an information defense strategy according to the comprehensive threat information, and generate a detection report.

[0023] In the above steps S1 to S5, multi-source network security data is obtained from the computer system. This data covers multiple dimensions such as network traffic packets, memory access, program behavior, and system logs. According to the collected multi-source data, it is determined whether there are abnormal behaviors or security risks in the current state. The evaluated abnormal state evaluation information is compared with a preset security benchmark to obtain an initial compensation value. Based on the initial compensation value, the multi-source data is comprehensively considered again to calculate the information threat evaluation value. According to the information threat evaluation value, the compensation value is dynamically adjusted. An iteration number is generated based on the obtained multi-source network security data to determine the number of times the detection and evaluation process needs to be repeated. The dynamic compensation value is used as the initial compensation value for the next round of iteration. The steps of obtaining the information threat evaluation value and the dynamic compensation value are repeatedly executed until the preset number of iterations is completed. During all preset iteration cycles, the threat information obtained from each evaluation is accumulated and integrated. Based on the comprehensive threat information, a corresponding information defense strategy is generated. This strategy can include measures such as network isolation, adjustment of access control rules, and configuration of log alarms. A detailed detection report is generated according to the entire detection process and results, providing a reference and decision-making basis for system administrators. The real-time collection of multi-source data and the dynamic compensation mechanism enable the entire detection process to quickly respond to changes in security threats, timely detect and defend potential attacks. Through multiple rounds of iteration, the threat evaluation and compensation mechanism are continuously optimized, effectively improving the detection accuracy and real-time response ability. Using multiple data sources such as network traffic, memory access, program behavior, and system logs can comprehensively cover all aspects of network security attacks, reducing the risk of misjudgment or missed judgment of single data. Each data source complements each other, enabling more accurate capture of the details of abnormal behaviors, thereby enhancing the detection ability for complex attack techniques and being able to adapt to new attack technologies and rapidly changing network environments.

[0024] In a preferred embodiment, the steps of obtaining abnormal state evaluation information according to multi-source network security data, obtaining an initial compensation value according to the abnormal state evaluation information, obtaining an information threat evaluation value according to the initial compensation value and the multi-source network security data, and obtaining a dynamic compensation value according to the information threat evaluation value include: S201. Obtain a corresponding network traffic packet matrix according to the network traffic packet data, and obtain a corresponding plurality of network traffic packet vectors according to the network traffic packet matrix; S202. Obtain a corresponding memory access matrix according to the memory access data, and obtain a memory access vector corresponding to each network traffic packet vector according to the memory access matrix; S203. Obtain a corresponding program behavior matrix according to the program behavior data, and obtain a program behavior vector corresponding to each network traffic packet vector according to the program behavior matrix; S204. Obtain a corresponding system log matrix according to the system log data, and obtain a system log vector corresponding to each network traffic packet vector according to the system log matrix; S205. Obtain a security state value according to the plurality of network traffic packet vectors, the plurality of memory access vectors, the plurality of program behavior vectors, and the plurality of system log vectors; S206. Obtain a preset security state standard, and determine whether the security state value meets the preset security state standard; If the security state value does not meet the preset security state standard, determine that the network security of the computer information is in an abnormal state, and mark it as abnormal state evaluation information; If the security state value meets the preset security state standard, determine that the network security of the computer information is in a normal state, and mark it as normal state evaluation information.

[0025] S207. Obtain an initial compensation value according to the abnormal state evaluation information.

[0026] In the above steps S201 to S207, the original message data is obtained from computer network transmission, and a network traffic message matrix is generated through preprocessing (such as data cleaning, segmentation, reconstruction, etc.). Subsequently, using feature extraction or matrix decomposition techniques, the matrix is decomposed into multiple network traffic message vectors, each vector corresponding to a different time period or different communication session. After obtaining the memory access data, a memory access matrix is similarly constructed, and then the memory access vectors corresponding to each network traffic message vector are extracted. Through this mapping, the interaction between the program and the memory in each message corresponding time period can be reflected. Similar to processing program behavior data, a program behavior matrix is constructed, and the behavior vectors associated with the network traffic message vectors are extracted, so that abnormal calls or behavior trajectories during program operation can be captured. The system log data is transformed into a system log matrix, and the log vectors related to each message vector are extracted to restore system operations and event records. The multiple network traffic message vectors, memory access vectors, program behavior vectors, and system log vectors obtained above are fused to calculate the current security state value. The calculation formula for the security state value is , where Q represents the security state value, g represents the numbers of multiple network traffic message vectors, multiple memory access vectors, multiple program behavior vectors, and multiple system log vectors. Among them, g = 1, 2, 3... k, represents the g-th network traffic message vector, represents the g-th memory access vector, represents the g-th program behavior vector, represents the g-th system log vector. A security state standard is preset in advance, and the calculated security state value is compared with the standard. If the state value is lower than the preset standard, it indicates that there is an abnormal risk, and at this time, it is marked as abnormal state evaluation information. If the state value reaches or exceeds the standard, it is considered to be in a normal state and is marked as normal state evaluation information. According to the aforementioned abnormal state evaluation information, an initial compensation value is given to the situation deviating from the normal standard. By processing data in different dimensions such as network traffic, memory access, program behavior, and system log, various abnormal details can be captured, and the risk of misjudgment or missed judgment due to a single data source can be reduced. Using the security state preset standard to compare with the calculated security state value forms an automated abnormal evaluation mechanism, making the detection process efficient, stable, and easy to expand.

[0027] In a preferred embodiment, the steps of obtaining the initial compensation value according to the abnormal state evaluation information include: S2071. Obtain the corresponding security state value according to the abnormal state evaluation information; S2072. Obtain the initial compensation table, where the initial compensation table includes multiple security state intervals and the initial compensation values corresponding to each security state interval; S2073. Obtain the corresponding initial compensation value from the initial compensation table according to the security state range corresponding to the security state value.

[0028] As in the above steps S2071 to S2073, extract the security state value obtained through previous multi-source data fusion and security state evaluation from the abnormal state evaluation information. Preset an initial compensation table in advance. The compensation table divides multiple security state ranges, and each range corresponds to a predefined initial compensation value. Each range reflects different degrees of security state, from highly abnormal to completely normal. The compensation value is usually inversely proportional to the security risk or has a linear or non-linear relationship with the degree of deviation from the normal state. Match the security state value with the preset security state range in the initial compensation table to determine the range where the security state value is located. After matching the corresponding range, directly read the corresponding initial compensation value from the compensation table as the compensation standard in the current detection stage. After the security state value is matched with the preset range, the initial compensation value is automatically obtained, reducing the errors caused by human intervention and subjective judgment, improving the objectivity and credibility of the evaluation. Allocating different initial compensation values according to different security state ranges enables the security defense strategy to better reflect the current security risk level, giving greater compensation to high-risk areas and appropriately alleviating low-risk areas.

[0029] In a preferred embodiment, the steps of obtaining the dynamic compensation value according to the initial compensation value and the information threat evaluation value of the multi-source network security data acquisition information include: S301. Based on the multi-source network security data, obtain multiple network traffic packet vectors, multiple memory access vectors, multiple program behavior vectors, and multiple system log vectors; S302. Obtain the information threat evaluation value according to the multiple network traffic packet vectors, multiple memory access vectors, multiple program behavior vectors, and the initial compensation value of the multiple system log vectors; S303. Obtain the dynamic compensation value according to the information threat evaluation value.

[0030] As in the above steps S301 to S303, collect multi-source data in real time from the computer network, including network traffic packets, memory access, program behavior, and system logs. Through preprocessing, data cleaning, formatting, and feature extraction technologies, convert the original data into multiple network traffic packet vectors, memory access vectors, program behavior vectors, and system log vectors respectively. Based on the obtained multi-source data vectors and the previously determined initial compensation value, calculate the information threat evaluation value. The calculation formula of the information threat evaluation value is , where P represents the information threat assessment value, and g represents the numbers of multiple network traffic packet vectors, multiple memory access vectors, multiple program behavior vectors, and multiple system log vectors, where g = 1, 2, 3... k, represents the g-th network traffic packet vector, represents the g-th memory access vector, represents the g-th program behavior vector, represents the g-th system log vector, represents the initial compensation value. According to the information threat assessment value obtained in the previous step, a dynamic mapping mechanism is adopted to convert the threat assessment value into a dynamic compensation value. Through vectorization processing, the multi-source fusion of network traffic, memory access, program behavior, and system log data is realized, which can accurately capture the security features at each level and reduce the risks of missed judgment and misjudgment.

[0031] In a preferred embodiment, the steps of obtaining the dynamic compensation value according to the information threat assessment value include: S3031. Obtain the standard information threat assessment value; S3032. Obtain the threat deviation value according to the standard information threat assessment value, the information threat assessment value, and the initial compensation value; S3033. Obtain the dynamic compensation table, where the dynamic compensation table includes multiple threat deviation intervals and the corresponding dynamic compensation values for each threat deviation interval; S3034. Obtain the corresponding dynamic compensation value from the dynamic compensation table according to the threat deviation interval corresponding to the threat deviation value.

[0032] In the above steps S3031 to S3034, a "standard information threat assessment value" is predefined. This value usually reflects the threat baseline under normal circumstances or obtained through historical data statistics. The information threat assessment value obtained from the actual calculation, combined with the preset standard value, and considering the previously obtained initial compensation value, obtains the "threat deviation value" through mathematical operations. The calculation formula of the threat deviation value is , where X represents the threat deviation value, represents the initial compensation value, and P represents the information threat assessment value, Expressed as a standard information threat assessment value, a dynamic compensation table is preset and stored. In this table, threat deviation values are divided into multiple intervals, and each interval corresponds to a specific dynamic compensation value. The division of each threat deviation interval takes into account the risk characteristics at different deviation levels to ensure targeted compensation adjustment in different security postures. The threat deviation value is matched with the preset intervals in the dynamic compensation table to determine the interval into which the current deviation value falls. According to the matched interval, the corresponding dynamic compensation value is directly read and used as the adjustment basis for the risk defense measures in the next stage. The dynamic compensation table divides continuous threat deviation values into different intervals, enabling hierarchical responses based on different security postures, automatically obtaining the corresponding dynamic compensation value from the threat deviation value, realizing the full-process automation from risk quantification to defense strategy adjustment, and reducing human intervention and risk judgment.

[0033] In a preferred embodiment, according to the number of iterations obtained from multi-source network security data, the dynamic compensation value is used as the initial compensation value for the next round, and the steps of obtaining the information threat assessment value and the dynamic compensation value are repeated until the number of iterations is satisfied. The steps include: S401. Obtain the corresponding security status value according to the abnormal state assessment information; S402. Obtain the comprehensive index value according to the security status value, the initial compensation value, and the information threat assessment value; S403. Obtain the number table, where the number table includes multiple comprehensive index intervals and the corresponding number of iterations for each comprehensive index interval; S404. Obtain the corresponding number of iterations from the number table according to the comprehensive index interval corresponding to the comprehensive index value; S405. Use the dynamic compensation value as the initial compensation value for the next round, and repeat the steps of obtaining the information threat assessment value and the dynamic compensation value until the number of iterations is satisfied.

[0034] In the above steps S401 to S405, the current security status value is extracted from the previous abnormal state assessment information, and a comprehensive index value is calculated using the currently obtained security status value, the known initial compensation value, and the already obtained information threat assessment value. The calculation formula for the comprehensive index value is , where Z represents the comprehensive index value, Denoted as the initial compensation value, Q is denoted as the security status value, and P is denoted as the information threat assessment value. A frequency table is established in advance. This table divides the comprehensive index value into multiple intervals and sets corresponding iteration frequencies for each interval. These intervals and corresponding iteration frequencies are usually obtained based on a large amount of historical data or expert experience, and are used to distinguish the evaluation and defense adjustment cycles required under different risk levels. According to the comprehensive index value, the corresponding comprehensive index interval in the frequency table is matched to determine the iteration frequency that needs to be executed in the current security environment. In each round of iteration, the currently obtained dynamic compensation value is used as the initial compensation value for the next round of iteration. The calculation of information threat assessment and dynamic compensation is repeated until the preset iteration frequency is reached. The continuously updated dynamic compensation value during the iteration process can effectively correct data deviations and measurement errors that may occur in the initial assessment, and finally make the assessment of security threats more accurate. The closed-loop feedback from the security status value to the comprehensive index and then to the compensation value helps to achieve self-correction when facing complex threats, thereby significantly improving the reliability of the assessment results. The iteration frequency determined according to the comprehensive index enables corresponding iteration frequencies to be adopted for threats of different levels, realizing hierarchical management of defense strategies in environments from low risk to high risk. By continuously updating the initial parameters with the dynamic compensation value, it can more quickly adapt to changes in the real-time security environment and enhance the response speed and flexibility of network security defense.

[0035] In a preferred embodiment, it further includes: S40501. When the information threat assessment values obtained from consecutive iterations within the iteration frequency do not meet the preset conditions, mark the information threat assessment values that do not meet the preset conditions as abnormal information threat assessment values; S40502. Obtain a comprehensive index update value based on the security status value, the initial compensation value, and multiple abnormal information threat assessment values; S40503. Obtain an update frequency table, where the update frequency table includes multiple comprehensive index update intervals and the corresponding iteration update frequencies for each comprehensive index update interval; S40504. Obtain the corresponding iteration update frequency from the update frequency table according to the comprehensive index update interval corresponding to the comprehensive index update value, and re-iterate according to the iteration update frequency until the iteration update frequency is met; S40505. Obtain the comprehensive threat information within the iteration update frequency, obtain an information defense strategy based on the comprehensive threat information, and generate a detection report.

[0036] In the above steps S40501 to S40505, within the preset number of iterations, continuously calculate and obtain the information threat assessment value. When the information threat assessment values obtained from continuous iterations do not meet the preset conditions (such as security thresholds, statistical ranges, or stability requirements), mark these non-conforming assessment values and classify them as abnormal information threat assessment values. Combine the current security status value, the initial compensation value, and multiple information threat assessment values marked as abnormal. By calculating the "comprehensive index update value", the calculation formula for the comprehensive index update value is , where Z represents the comprehensive index update value, represents the initial compensation value, Q represents the security status value, u represents the number of multiple abnormal information threat assessment values, u = 1, 2, 3... v, represents the u-th information threat assessment value within the number of iterations. Pre-determine an "update times table", which divides the update process into multiple intervals according to the comprehensive index update value, and each interval corresponds to a certain number of iterative updates. According to the currently calculated comprehensive index update value, match the corresponding comprehensive index update interval in the update times table to determine the number of updates that need to be re-iterated currently. According to the obtained number of update iterations, re-adjust the iterative process, use the dynamic compensation value as the initial compensation value for the next round of iteration, repeat the process of obtaining the information threat assessment value and calculating the dynamic compensation until the update times requirement is met. After completing the set number of update iterations, accumulate the comprehensive threat information from all iterative processes. Based on this comprehensive threat information, generate corresponding information defense strategies in combination with predefined defense models, risk response strategies, or expert rules, and finally generate a detection report. By marking abnormal threat assessment values that do not meet the preset conditions, effectively reduce the interference of abnormal noise on the overall assessment result, thereby achieving a more accurate risk quantification effect. Using the update times table to perform hierarchical response on the comprehensive index update value can automatically adjust the number of iterations and defense intensity according to the risk level, realizing flexible and differentiated adaptive protection.

[0037] In a preferred embodiment, the steps of obtaining the comprehensive threat information within the number of iterations, obtaining the information defense strategy according to the comprehensive threat information, and generating a detection report include: S501. Obtain multiple information threat assessment values within the number of iterations; S502. Obtain the comprehensive threat value according to the multiple information threat assessment values and mark it as comprehensive threat information; S503. Obtain the strategy table, where the strategy table includes multiple comprehensive threat intervals and the defense strategies corresponding to each comprehensive threat interval; S504. Obtain the corresponding defense strategy from the strategy table according to the comprehensive threat interval corresponding to the comprehensive threat value and generate a detection report.

[0038] As in the above steps S501 to S504, during the entire iteration process, an information threat assessment value is generated in each round of iteration. Based on the collected multiple information threat assessment values, a "comprehensive threat value" is calculated. The calculation formula of the comprehensive threat value is , where W represents the comprehensive threat value, i represents the number of multiple information threat assessment values within the iteration times, i = 1, 2, 3…n, represents the i-th information threat assessment value within the iteration times. A "policy table" is preset. This table is divided into multiple threat intervals according to the comprehensive threat value, and each interval corresponds to one or more defense strategies. The policy table is usually constructed based on historical data, risk models, expert experience or best practices, reflecting the specific countermeasures to be taken under different threat levels. According to the comprehensive threat value, by matching each comprehensive threat interval in the policy table, the specific defense strategy corresponding to the current comprehensive threat value is found. Subsequently, this defense strategy is summarized with the evaluation data and security status recorded in the previous iteration process to generate a detailed detection report. The detection report will include the multi-source data analysis process, risk assessment results, defense strategy suggestions and relevant decision-making information, aiming to provide intuitive and comprehensive security situation feedback for managers, be able to provide a global and objective description of the security situation, help to comprehensively understand various security risks, use the preset policy table to realize the automatic mapping of the comprehensive threat value to the specific defense strategy, reduce human judgment and decision-making biases. The detection report details the security assessment data obtained in multiple iterations, the defense strategy formulation process and the final strategy suggestions, providing intuitive and transparent decision-making basis for managers.

[0039] Please refer to the appendix Figure 2 As shown, the present invention also provides a computer information real-time security detection system for the above computer information real-time security detection method, including: A network data module for obtaining multi-source network security data of computer information, where the multi-source network security data includes network traffic packet data, memory access data, program behavior data, and system log data; An anomaly compensation module for obtaining anomaly status evaluation information according to the multi-source network security data and obtaining an initial compensation value according to the anomaly status evaluation information; A threat compensation module for obtaining an information threat assessment value based on the initial compensation value and the multi-source network security data and obtaining a dynamic compensation value according to the information threat assessment value; An iteration module for obtaining the iteration times according to the multi-source network security data, taking the dynamic compensation value as the initial compensation value for the next round, and repeating the steps of obtaining the information threat assessment value and the dynamic compensation value until the iteration times are met; A defense module, which is used to obtain comprehensive threat information within the number of iterations, obtain an information defense strategy based on the comprehensive threat information, and generate a detection report.

[0040] As described above, the network data module collects multi-source security data from a computer, and forms structured data by cleaning, feature extraction, and vectorization processing of the original network traffic, memory access, program behavior, and system log data. The anomaly compensation module calculates a security status value using multi-source data, compares it with a preset security standard to obtain anomaly status evaluation information, and then maps the anomaly status evaluation information to a corresponding initial compensation value. The threat compensation module calculates an information threat evaluation value by combining the initial compensation value and multi-source network security data. Then, according to a preset model and mapping mechanism, the threat evaluation value is converted into a dynamic compensation value. The iteration module determines the total number of iterations based on multi-source security data, and uses the current dynamic compensation value to update the initial compensation value for the next round of calculation in each iteration. Through multiple iterations, the security evaluation and compensation mechanism is gradually converged and optimized, and finally a set of comprehensive and stable threat evaluation results are obtained. The defense module, after the iteration is completed, integrates the comprehensive threat information obtained in all iteration cycles, and based on a preset policy table, maps out corresponding defense strategies according to different threat levels. Finally, a detailed detection report is formed by combining various detection results, defense suggestions, and security risk situations, and fed back to security managers, which can comprehensively capture the security status of computer information, provide rich data support for risk assessment, reduce information blind spots, adapt to external environment changes in real time by calculating the initial compensation value and the dynamic compensation value, and ensure that the security detection results maintain high accuracy in the face of data fluctuations.

[0041] And, a computer information real-time security detection terminal, including: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the computer information real-time security detection method.

[0042] The above are only the preferred embodiments of the present invention. It should be noted that for those of ordinary skill in the art in this technical field, without departing from the principle of the present invention, several improvements and refinements can be made, and these improvements and refinements should also be regarded as the protection scope of the present invention. The structures, devices, and operation methods not specifically described and explained in the present invention, unless otherwise specifically stated and limited, are implemented according to the conventional means in this field.

Claims

1. A real-time security detection method for computer information, characterized in that, Including: Obtaining multi-source network security data of computer information, where the multi-source network security data includes network traffic packet data, memory access data, program behavior data, and system log data; Obtaining abnormal state evaluation information according to the multi-source network security data, and obtaining an initial compensation value according to the abnormal state evaluation information; Obtaining an information threat evaluation value based on the initial compensation value and the multi-source network security data, and obtaining a dynamic compensation value according to the information threat evaluation value; Obtaining the number of iterations according to the multi-source network security data, taking the dynamic compensation value as the initial compensation value for the next round, and repeating the steps of obtaining the information threat evaluation value and the dynamic compensation value until the number of iterations is satisfied; Obtaining the comprehensive threat information within the number of iterations, obtaining an information defense strategy according to the comprehensive threat information, and generating a detection report.

2. The real-time security detection method for computer information according to claim 1, characterized in that, The steps of obtaining abnormal state evaluation information according to the multi-source network security data, obtaining an initial compensation value according to the abnormal state evaluation information, obtaining an information threat evaluation value based on the initial compensation value and the multi-source network security data, and obtaining a dynamic compensation value according to the information threat evaluation value include: Obtaining a corresponding network traffic packet matrix according to the network traffic packet data, and obtaining a corresponding plurality of network traffic packet vectors according to the network traffic packet matrix; Obtaining a corresponding memory access matrix according to the memory access data, and obtaining a memory access vector corresponding to each network traffic packet vector according to the memory access matrix; Obtaining a corresponding program behavior matrix according to the program behavior data, and obtaining a program behavior vector corresponding to each network traffic packet vector according to the program behavior matrix; Obtaining a corresponding system log matrix according to the system log data, and obtaining a system log vector corresponding to each network traffic packet vector according to the system log matrix; Obtaining a security state value according to the plurality of network traffic packet vectors, the plurality of memory access vectors, the plurality of program behavior vectors, and the plurality of system log vectors; Obtaining a preset standard for the security state, and determining whether the security state value conforms to the preset standard for the security state; If the security state value does not conform to the preset standard for the security state, it is determined that the network security of the computer information is in an abnormal state, and it is marked as abnormal state evaluation information; If the security state value conforms to the preset standard for the security state, it is determined that the network security of the computer information is in a normal state, and it is marked as normal state evaluation information; Obtaining an initial compensation value according to the abnormal state evaluation information.

3. The real-time security detection method for computer information according to claim 2, wherein The steps of obtaining an initial compensation value according to the abnormal state evaluation information include: Obtaining a corresponding security state value according to the abnormal state evaluation information; Obtaining an initial compensation table, where the initial compensation table includes a plurality of security state intervals and the initial compensation value corresponding to each security state interval; Obtaining the corresponding initial compensation value from the initial compensation table according to the security state interval corresponding to the security state value.

4. The real-time security detection method for computer information according to claim 1, characterized in that The steps of obtaining an information threat evaluation value based on the initial compensation value and the multi-source network security data, and obtaining a dynamic compensation value according to the information threat evaluation value include: Obtaining a plurality of network traffic packet vectors, a plurality of memory access vectors, a plurality of program behavior vectors, and a plurality of system log vectors based on the multi-source network security data; Obtain an information threat assessment value based on multiple network traffic packet vectors, multiple memory access vectors, multiple program behavior vectors, and multiple system log vector initial compensation values; Obtain a dynamic compensation value based on the information threat assessment value.

5. The real-time security detection method for computer information according to claim 4, characterized in that The steps of obtaining a dynamic compensation value according to the information threat assessment value include: Obtain a standard information threat assessment value; Obtain a threat deviation value based on the standard information threat assessment value, the information threat assessment value, and the initial compensation value; Obtain a dynamic compensation table, where the dynamic compensation table includes multiple threat deviation intervals and the corresponding dynamic compensation values for each threat deviation interval; Obtain the corresponding dynamic compensation value from the dynamic compensation table according to the threat deviation interval corresponding to the threat deviation value.

6. The real-time security detection method for computer information according to claim 1, wherein Obtain the number of iterations according to multi-source network security data, use the dynamic compensation value as the initial compensation value for the next round, and repeat the steps of obtaining the information threat assessment value and the dynamic compensation value until the number of iterations is satisfied. The steps include: Obtain the corresponding security status value according to the abnormal status assessment information; Obtain a comprehensive index value according to the security status value, the initial compensation value, and the information threat assessment value; Obtain a number table, where the number table includes multiple comprehensive index intervals and the corresponding number of iterations for each comprehensive index interval; Obtain the corresponding number of iterations from the number table according to the comprehensive index interval corresponding to the comprehensive index value; Use the dynamic compensation value as the initial compensation value for the next round, and repeat the steps of obtaining the information threat assessment value and the dynamic compensation value until the number of iterations is satisfied.

7. The real-time security detection method for computer information according to claim 6, characterized in that, It also includes: When the information threat assessment values obtained by continuous iteration within the number of iterations do not meet the preset conditions, mark the information threat assessment values that do not meet the preset conditions as abnormal information threat assessment values; Obtain a comprehensive index update value according to the security status value, the initial compensation value, and multiple abnormal information threat assessment values; Obtain an update number table, where the update number table includes multiple comprehensive index update intervals and the corresponding iterative update numbers for each comprehensive index update interval; Obtain the corresponding iterative update number from the update number table according to the comprehensive index update interval corresponding to the comprehensive index update value, and perform iteration again according to the iterative update number until the iterative update number is satisfied; Obtain the comprehensive threat information within the iterative update number, obtain an information defense strategy according to the comprehensive threat information, and generate a detection report.

8. The real-time security detection method for computer information according to claim 1, wherein The steps of obtaining the comprehensive threat information within the number of iterations, obtaining an information defense strategy according to the comprehensive threat information, and generating a detection report include: Obtain multiple information threat assessment values within the number of iterations; Obtain a comprehensive threat value according to multiple information threat assessment values and mark it as comprehensive threat information; Obtain a policy table, where the policy table includes multiple comprehensive threat intervals and the corresponding defense strategies for each comprehensive threat interval; Obtain the corresponding defense strategy from the policy table according to the comprehensive threat interval corresponding to the comprehensive threat value, and generate a detection report.

9. A real-time computer information security detection system, which is applied to the real-time computer information security detection method described in any one of claims 1 to 8, and is characterized in that, It includes: A network data module for obtaining multi-source network security data of computer information, where the multi-source network security data includes network traffic packet data, memory access data, program behavior data, and system log data; Anomaly compensation module, configured to obtain anomaly status evaluation information based on multi-source network security data, and obtain an initial compensation value according to the anomaly status evaluation information; Threat compensation module, configured to obtain an information threat evaluation value based on the initial compensation value and multi-source network security data, and obtain a dynamic compensation value according to the information threat evaluation value; Iteration module, configured to obtain the number of iterations according to multi-source network security data, use the dynamic compensation value as the initial compensation value for the next round, and repeat the steps of obtaining the information threat evaluation value and the dynamic compensation value until the number of iterations is satisfied; Defense module, configured to obtain comprehensive threat information within the number of iterations, obtain an information defense strategy according to the comprehensive threat information, and generate a detection report.

10. A real-time security detection terminal for computer information, characterized in that, Comprising: One or more processors; A storage device storing one or more programs thereon; When the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the computer information real-time security detection method according to any one of claims 1 to 8.

Images