Secret-related computer secrecy self-supervision detection method based on gigabit network

Abstract

The invention relates to the technical field of computer secrecy, and discloses a secrecy-related computer secrecy self-supervision detection method based on a gigabit network, which comprises the following steps of: firstly, acquiring communication data and equipment characteristic data through a network flow analysis module, and determining monitoring node division; constructing a detection index set according to the communication data, and determining an abnormal data acquisition strategy by combining monitoring node division; then, acquiring real-time communication data by using an abnormal data acquisition terminal according to a strategy, and identifying a confidentiality risk level and a violation item to obtain detection result data; and finally, the detection result data is transmitted to the supervision control platform according to a self-supervision feedback mechanism for index updating. According to the method, accurate detection and self-supervision of the confidentiality risk of the confidential computer in the gigabit network environment are realized, the confidentiality security is improved, and the method is suitable for the field of confidentiality detection of the confidential computer.

Description

Technical Field

[0001] The present invention relates to the technical field of computer confidentiality, in particular to a confidentiality self-monitoring detection method for a confidential computer based on a gigabit network. Background Art

[0002] In today's rapidly developing information technology landscape, gigabit networks have become the mainstream mode of data transmission. However, this also poses increasingly severe security challenges to classified computers. As cyberattacks continue to escalate and become more sophisticated, traditional methods for detecting confidentiality in classified computers are gradually revealing their shortcomings. From a monitoring perspective, traditional methods mostly rely on periodic manual inspections or simple rule matching. This passive monitoring model struggles to capture abnormal network behavior in real time. In a gigabit network environment, data transmission rates are extremely fast, reaching gigabits per second, and large amounts of data flow instantly. Due to limitations in processing speed and real-time performance, traditional methods can easily miss critical abnormal data and fail to promptly identify potential confidentiality risks.

[0003] In terms of detection accuracy, traditional detection methods are less adaptable to complex network environments. Modern networks feature a rich and diverse range of communication protocols, and data flows are complex and ever-changing. Traditional methods are often limited to detecting a limited number of protocol types and simple data flows. Their inability to perform deep packet analysis makes it difficult to accurately extract key communication data, such as protocol types, data flows, and transmission rates. This results in inaccurate identification of confidentiality risks.

[0004] Traditional methods lack a comprehensive analysis of the characteristics of classified computer devices. Device characteristics, such as hardware configuration, operating system version, and security software deployment status, are crucial for determining the appropriate monitoring nodes. However, traditional methods rarely conduct in-depth extraction and analysis of these characteristics, making it impossible to scientifically and rationally divide monitoring nodes, which in turn affects the effectiveness of overall confidentiality detection.

[0005] Traditional abnormal data collection strategies lack flexibility and specificity. They cannot dynamically adjust to the risk profile of different monitoring nodes and time windows. The selection of collection points and planning of collection paths are also suboptimal. This makes it difficult to ensure the integrity and accuracy of data collection in the face of complex situations such as electromagnetic interference and network congestion.

[0006] Traditional confidentiality risk identification model training methods are relatively simple, usually based on limited labeled data and simple algorithms. They are difficult to adapt to the diverse communication scenarios and complex confidentiality risk level identification needs in gigabit network environments, and the statistics of violations are not comprehensive and accurate enough.

[0007] Traditional detection result feedback mechanisms are inadequate, preventing them from effectively feeding back detection results to the supervisory control platform for indicator updates. This results in the inability to timely adjust and optimize detection indicators based on actual conditions, making it difficult to continuously adapt to the ever-changing security landscape. Traditional confidentiality detection methods for classified computers suffer from significant deficiencies in real-time performance, detection accuracy, adaptability, and flexibility in gigabit network environments. A new, self-regulatory method for confidentiality detection of classified computers based on gigabit networks is urgently needed to address these issues. Summary of the Invention

[0008] The purpose of the present invention is to provide a method for detecting confidentiality of confidential computers based on a gigabit network, so as to solve the problems raised in the above background technology.

[0009] To achieve the above-mentioned object, the present invention provides the following technical solution: a method for detecting confidentiality of confidential computers based on a gigabit network, the method comprising:

[0010] Acquire gigabit network communication data and device characteristic data of the confidential computer based on the network traffic analysis module, and determine the monitoring node division of the confidential computer according to the device characteristic data;

[0011] Constructing a confidentiality self-regulatory detection indicator set based on the communication data, and determining an abnormal data collection strategy based on the detection indicator set and the monitoring node division;

[0012] The abnormal data collection terminal obtains the real-time communication data of the confidential computer according to the collection strategy, identifies the confidentiality risk level and violation items of the confidential computer according to the real-time communication data, and obtains the detection result data;

[0013] The test result data is transmitted to the supervision control platform according to the self-supervision feedback mechanism for indicator update.

[0014] Preferably, the network traffic analysis module obtains gigabit network communication data and device feature data of the confidential computer, and determines the monitoring node division of the confidential computer according to the device feature data, specifically as follows:

[0015] Based on the network traffic analysis module, the protocol decoding algorithm is called to perform deep packet analysis on the gigabit network communication data to extract the communication protocol type, data flow direction, and transmission rate communication data;

[0016] Extract features of the hardware configuration, operating system version, and security software deployment status of confidential computers to obtain device feature data;

[0017] Performing spatial feature clustering on the device feature data based on the K-means clustering algorithm, and setting the initial threshold of the cluster center as the device safety level coefficient;

[0018] According to the clustering results, the confidential computers are divided into M monitoring nodes. Each monitoring node is labeled with the network interface identifier, data interaction frequency, and security sensitivity level, and a node feature vector set is constructed.

[0019] Acquire a topological connection relationship of the node feature vector set, and construct a three-dimensional monitoring node distribution map based on the topological connection relationship;

[0020] The communication load weight of each node is calculated according to the three-dimensional monitoring node distribution map, a monitoring node weight heat map and a load gradient field are constructed according to the communication load weight, and the monitoring node division of the confidential computer is determined according to the heat map and gradient field.

[0021] Preferably, the construction of a confidentiality self-regulatory detection indicator set based on the communication data and the determination of an abnormal data collection strategy based on the detection indicator set and the monitoring node division are specifically as follows:

[0022] Perform multi-dimensional feature extraction on the communication data, construct an indicator feature tensor through normalization processing, identify confidentiality risk factors based on the transmission characteristics of the communication data based on the fuzzy analytic hierarchy process, and generate a confidentiality self-regulatory detection indicator set including data encryption strength, frequency of illegal external connections, and sensitive data transmission volume;

[0023] Performing a dimensional matching operation on the monitoring node division and the detection indicator set to construct a multi-dimensional assessment model for confidentiality risk, and dividing the assessment model according to a preset time step to construct T time window segments;

[0024] Obtain risk score information for each time window segment according to the monitoring node division, and cluster the time window segments with similar score trends in the risk multidimensional assessment model based on the OPTICS clustering algorithm to obtain cluster output;

[0025] Determine a priority ranking for risk assessment of each time window segment based on the clustering output, obtain corresponding spatiotemporal coordinates of each time window segment in the confidential computer, and perform a risk detection importance assessment on each node in the confidential computer based on the priority ranking and the corresponding spatiotemporal coordinates to obtain a detection importance score for each node;

[0026] Determining detection requirement information for each node in the confidential computer according to the detection importance score of each node, wherein the detection requirement information includes whether to trigger collection and collection frequency requirement information;

[0027] Obtaining a collection integrity parameter of data from different nodes by the abnormal data collection terminal, determining an optimal distance parameter for the abnormal data collection terminal to collect data from each node of the confidential computer based on the collection integrity parameter and detection requirement information, and determining a collection point set of the abnormal data collection terminal based on the optimal distance parameter;

[0028] An abnormal data collection strategy of the abnormal data collection terminal is determined according to the collection point set.

[0029] Preferably, the abnormal data collection strategy of the abnormal data collection terminal is determined according to the collection point set, specifically:

[0030] Obtaining the spatiotemporal coordinate parameters of each collection point and the initial deployment position parameters of the abnormal data collection terminal, and determining the communication blind spot in the confidential computer based on the detection indicator set;

[0031] Optimizing the path of the initial deployment location parameters and the spatiotemporal coordinate parameters of each collection point based on a genetic algorithm, taking the communication blind area as a path constraint area, and outputting the shortest initial collection path for the abnormal data collection terminal;

[0032] Acquire in real time the device state change parameters when the abnormal data acquisition terminal performs acquisition according to the shortest initial acquisition path, and determine the electromagnetic interference intensity and network congestion level at the real-time acquisition location of the abnormal data acquisition terminal according to the state change parameters;

[0033] Obtaining anti-interference performance parameters of the abnormal data acquisition terminal, wherein the anti-interference performance parameters include parameters of the terminal's ability to filter signals of interference of different intensities;

[0034] Obtaining a response delay parameter of the abnormal data collection terminal to the electromagnetic interference intensity and the network congestion level, and determining a collection path adjustment hysteresis amount of the abnormal data collection terminal according to the response delay parameter;

[0035] Analyzing the electromagnetic interference intensity and network congestion level of the real-time collection location of the abnormal data collection terminal according to the anti-interference performance parameter and the collection path adjustment hysteresis, and calculating the cumulative value of the collection path deviation of the abnormal data collection terminal within the response delay time;

[0036] If the accumulated value of the acquisition path offset is less than a set threshold, determining the path offset direction and offset amount of the abnormal data acquisition terminal along the shortest initial acquisition path according to the accumulated value of the offset, and determining the adjustment direction and adjustment amount of the abnormal data acquisition terminal according to the offset direction and offset to obtain an adjustment parameter;

[0037] Adjusting the shortest initial acquisition path of the abnormal data acquisition terminal in real-time acquisition according to the adjustment parameters to obtain a first acquisition strategy;

[0038] If the accumulated value of the acquisition path deviation is greater than a set threshold, the electromagnetic interference intensity and network congestion degree parameters of the real-time acquisition path of the abnormal data acquisition terminal are obtained, an interference change map is constructed based on the parameters, and the interference change trend of the detection area in the confidential computer is determined based on the interference change map;

[0039] Based on the spline interpolation method, the interference change trend is interpolated, and the interference parameters within the preset range of the shortest initial acquisition path are determined. The acquisition stability of the abnormal data acquisition terminal within the preset range of the shortest initial acquisition path is determined based on the interference parameters and the anti-interference performance parameters. According to the acquisition stability, the shortest initial acquisition path section with the cumulative value of the acquisition path offset greater than the set threshold is optimized to obtain an updated acquisition path. The abnormal data acquisition terminal performs an acquisition operation according to the updated acquisition path to obtain a second acquisition strategy.

[0040] Preferably, the abnormal data acquisition terminal acquires the real-time communication data of the confidential computer according to the acquisition strategy, identifies the confidentiality risk level and violation items of the confidential computer according to the real-time communication data, and obtains the detection result data, specifically:

[0041] Obtaining standard communication data of different communication scenarios of a confidential computer, and labeling the standard communication data with risk levels to obtain labeled communication data;

[0042] Constructing a confidentiality risk identification model based on a support vector machine algorithm, and importing the labeled communication data into the identification model for training;

[0043] The abnormal data acquisition terminal obtains the real-time communication data of the confidential computer according to the acquisition strategy, imports the real-time communication data into the trained confidentiality risk identification model to identify the confidentiality risk level, and counts the violations in each communication scenario to obtain detection result data.

[0044] Preferably, the test result data is transmitted to the supervision control platform according to the self-supervision feedback mechanism to update the indicators, specifically:

[0045] Building a hierarchical data update protocol stack based on a self-regulatory feedback mechanism, extracting features from the detection result data, and building a detection feedback signal;

[0046] The detection feedback signal is transmitted to the supervision control platform according to the layered data update protocol stack, and an indicator mapping operation is performed on the detection feedback signal to obtain confidential self-supervision detection update data of the confidential computer.

[0047] Preferably, the detection feedback signal is transmitted to the supervision control platform according to the layered data update protocol stack, and an indicator mapping operation is performed on the detection feedback signal to obtain the confidentiality self-supervision detection update data of the confidential computer, specifically:

[0048] Obtaining a historical detection database of a supervisory control platform, performing similarity matching between the detection feedback signal and the historical detection database, and obtaining a matching output;

[0049] Determine the distribution characteristics of abnormal data in the detection feedback signal based on the matching output, and perform a time series smoothing operation on the abnormal data based on a moving average filtering algorithm to obtain valid feedback data;

[0050] Aligning the effective feedback data with the detection indicator set, constructing an indicator update association matrix, and determining the detection indicator items that need to be adjusted according to the weight change trend of each indicator in the association matrix;

[0051] The threshold range or weight coefficient of the detection indicator item that needs to be adjusted is updated to generate an updated confidentiality self-regulation detection indicator set, and the updated detection indicator set is stored in the supervision control platform to obtain the confidentiality self-regulation detection update data of the confidential computer.

[0052] Preferably, the effective feedback data is dimensionally aligned with the detection indicator set, an indicator update association matrix is ​​constructed, and the detection indicator items that need to be adjusted are determined according to the weight change trend of each indicator in the association matrix, specifically:

[0053] Performing factor analysis on the effective feedback data to extract key factors that affect confidentiality risk, and determining corresponding correlation relationships with the detection indicator set based on the key factors;

[0054] Calculate the correlation values ​​of each detection index and key factors based on the correlation coefficient matrix, and construct the index update correlation matrix;

[0055] The correlation values ​​of the indicators in the correlation matrix are sorted, and detection indicator items with absolute correlation values ​​less than a set threshold are screened out as detection indicator items that need to be adjusted.

[0056] Preferably, the threshold range or weight coefficient of the detection indicator item that needs to be adjusted is updated to generate an updated confidentiality self-regulatory detection indicator set, specifically:

[0057] For quantitative indicators that need to be adjusted, reset the upper and lower thresholds based on the statistical distribution of valid feedback data;

[0058] For qualitative indicators that need to be adjusted, redefine the level description based on the semantic analysis results of effective feedback data;

[0059] The weight coefficients of all detection indicator items are normalized and adjusted to ensure that the sum of the weights is 1, and an updated confidentiality self-regulatory detection indicator set is generated.

[0060] Preferably, the construction of a multi-dimensional confidentiality risk assessment model is specifically as follows:

[0061] Identify the core dimensions of confidentiality risk assessment, including data transmission compliance, interface access security, log record integrity, and violation traceability;

[0062] Specific evaluation indicators are set for each core dimension, including data transmission compliance, including encryption protocol matching degree and sensitive data identification rate; interface access security, including external device authentication rate and remote login authorization rate; log record integrity, including operation log retention period and abnormal behavior record completeness; violation traceability, including event tracing success rate and responsible party location accuracy rate;

[0063] An expert system is organized based on the Bayesian network algorithm to evaluate the importance of each dimension and indicator. The weight coefficient of each dimension and the sub-weight coefficient of each indicator in the corresponding dimension are calculated based on the evaluation results.

[0064] The evaluation indicators, weight coefficients and sub-weight coefficients of each dimension are structured and integrated to construct a multidimensional assessment model for confidentiality risk that includes multidimensional indicators and hierarchical weights.

[0065] Compared with the prior art, the present invention has the following beneficial effects:

[0066] In terms of monitoring node division, the network traffic analysis module calls the protocol decoding algorithm to perform deep packet analysis on gigabit network communication data, which can accurately extract communication data such as communication protocol type, data flow direction, transmission rate, etc. At the same time, it extracts feature data of equipment characteristics such as the hardware configuration of confidential computers, and then uses the K-means clustering algorithm to perform spatial feature clustering. The initial threshold of the cluster center is set according to the equipment security level coefficient, and the confidential computer science is divided into M monitoring nodes. The relevant information is annotated to construct a node feature vector set, and the topological connection relationship is obtained to construct a three-dimensional monitoring node distribution map. Then, the communication load weight is calculated to construct a heat map and gradient field. In this way, the precise and scientific division of confidential computer monitoring nodes is achieved, laying a solid foundation for subsequent confidentiality detection.

[0067] In constructing a detection indicator set and determining an abnormal data collection strategy, we extract and normalize multidimensional features of communication data to construct an indicator feature tensor. We use the fuzzy analytic hierarchy process to identify confidentiality risk factors and generate a detection indicator set containing key elements. We then construct a multidimensional assessment model by matching the monitoring node divisions with the detection indicator set dimensions and segmenting them into time windows. We then cluster these time windows using the OPTICS clustering algorithm to determine risk assessment priorities and node detection importance scores. We then combine the collection completeness parameter to determine the optimal distance parameter and collection point set, thereby forming a scientific and reasonable abnormal data collection strategy. This strategy dynamically adjusts the collection points and frequency based on the risk profile and collection requirements of different nodes, improving the pertinence and effectiveness of data collection.

[0068] To optimize the path for abnormal data collection, the system obtains parameters for collection points and initial terminal deployment locations, identifies communication blind spots, and uses a genetic algorithm to optimize the path. Using these blind spots as constraints, the system outputs the shortest initial collection path. It also acquires device status change parameters in real time, analyzes electromagnetic interference intensity and network congestion levels, and calculates the cumulative value of the collection path offset based on anti-interference performance parameters and response delay parameters. Based on the comparison of this cumulative value with a set threshold, the collection path is adjusted or optimized to arrive at a reasonable collection strategy. This effectively addresses the issue of collection paths being affected by electromagnetic interference and network congestion in complex network environments, ensuring the stability and accuracy of data collection.

[0069] To identify confidentiality risk levels and violations, standard communication data from different communication scenarios is collected and labeled with risk levels. A confidentiality risk identification model is constructed and trained based on the support vector machine algorithm. An abnormal data collection terminal captures real-time communication data and imports it into the model for identification and violation statistics, generating test results. This method improves the accuracy of confidentiality risk level identification and the comprehensiveness of violation statistics, enabling more precise identification of confidentiality risks posed by classified computers.

[0070] In terms of test result feedback and indicator updates, a hierarchical data update protocol stack is constructed based on a self-regulatory feedback mechanism. The test result data features are extracted to construct a test feedback signal, which is then transmitted to the supervisory control platform and mapped to an indicator. The historical test database is then accessed for similarity matching, and the distribution characteristics of abnormal data are determined and smoothed to obtain valid feedback data. This data is then aligned with the test indicator set dimensions to construct an association matrix. Based on the weight change trend, test indicator items that require adjustment are identified, and their threshold ranges or weight coefficients are updated to generate an updated test indicator set. This achieves dynamic updating of test indicators, enabling the detection method to continuously adapt to the ever-changing confidentiality and security landscape, and improving the effectiveness and reliability of confidentiality detection.

[0071] Through the synergistic effect of the above links, the present invention realizes comprehensive, real-time and accurate detection and self-regulation of confidentiality risks of confidential computers in a gigabit network environment, greatly improving the confidentiality security of confidential computers, and has significant technical advantages and practical value. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 This is a working principle diagram of the confidentiality self-regulation detection method for confidential computers based on gigabit networks according to the present invention;

[0073] Figure 2 Flowchart of the monitoring node division method;

[0074] Figure 3 Flowchart generated for the anomaly data collection strategy;

[0075] Figure 4 Flowchart for optimizing the path of abnormal data collection terminals. DETAILED DESCRIPTION

[0076] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0077] See also Figures 1-4 The present invention relates to a method for detecting confidentiality of a computer based on a gigabit network, and the specific implementation steps are as follows:

[0078] Acquire gigabit network communication data and device characteristic data of the confidential computer based on the network traffic analysis module, and determine the monitoring node division of the confidential computer according to the device characteristic data;

[0079] Constructing a confidentiality self-regulatory detection indicator set based on the communication data, and determining an abnormal data collection strategy based on the detection indicator set and the monitoring node division;

[0080] The abnormal data collection terminal obtains the real-time communication data of the confidential computer according to the collection strategy, identifies the confidentiality risk level and violation items of the confidential computer according to the real-time communication data, and obtains the detection result data;

[0081] The test result data is transmitted to the supervision control platform according to the self-supervision feedback mechanism for indicator update.

[0082] Example 1:

[0083] This embodiment mainly focuses on the process of obtaining gigabit network communication data and device feature data of a confidential computer based on a network traffic analysis module, and determining the monitoring node division of the confidential computer based on the device feature data.

[0084] The network traffic analysis module needs to obtain gigabit network communication data. This module uses the protocol decoding algorithm to perform in-depth analysis of data packets transmitted in the gigabit network. In actual operation, there may be multiple communication protocols in the network, such as TCP / IP, UDP, ICMP, etc. For each protocol, the protocol decoding algorithm will parse its specific format and structure. Taking the TCP / IP protocol as an example, the algorithm will parse the source IP address, destination IP address, port number, sequence number, acknowledgment number and other fields in its header, and analyze the data portion to extract the communication protocol type. When determining the direction of data flow, the relationship between the source IP address and the destination IP address is used to determine whether the data is sent from a confidential computer to an external device, or received from an external device to a confidential computer. The transmission rate is obtained by calculating the amount of data transmitted per unit time, such as the number of bytes or bits transmitted per second.

[0085] The network traffic analysis module also needs to extract the device feature data of confidential computers. This process involves multiple aspects: in terms of hardware configuration, it is necessary to obtain information such as the CPU model, number of cores, main frequency, memory capacity and type, hard disk capacity, interface type, etc.; in terms of operating system version, it is necessary to clarify whether it is a Windows system, Linux system or other operating system, as well as the specific version number, such as Windows 10 Professional Edition 1909, Ubuntu 20.04 LTS, etc.; in terms of security software deployment status, it is necessary to determine whether firewalls, antivirus software, intrusion detection systems and other security software are installed. If installed, it is also necessary to understand the specific software name, version number and current operating status, such as whether it is normally enabled and whether the virus database is updated to the latest version. By extracting this information, comprehensive device feature data is formed.

[0086] The K-means clustering algorithm is used to perform spatial feature clustering on device feature data. When applying this algorithm, the initial threshold of the cluster center is first set as the device security level coefficient. Determining the device security level coefficient requires comprehensive consideration of multiple factors, such as the security performance of the hardware, whether secure hardware such as encrypted hard drives are used; the security of the operating system, whether all security patches are installed in a timely manner; the protection capabilities of the security software, the virus detection rate of the antivirus software, and whether the firewall rule settings are reasonable. These factors jointly determine the device security level coefficient, which will serve as the initial value of the cluster center. Through iterative calculations of the K-means clustering algorithm, confidential computers with similar device feature data are classified into the same category, and ultimately the entire confidential computer system is divided into M monitoring nodes.

[0087] Detailed labeling is required for each monitoring node. The network interface identifier is a unique identifier for each node, such as eth0, eth1, wlan0, etc., which is used to distinguish different network interfaces. The data interaction frequency refers to the number of times the node exchanges data with other nodes per unit time. This parameter can be counted using network traffic monitoring tools. The security sensitivity level is determined based on the sensitivity of the data processed by the node, and is usually divided into three levels: high, medium, and low. For example, nodes that process state secret-level data are labeled as high security sensitivity levels, while nodes that process ordinary office data are labeled as low security sensitivity levels. Through these annotations, a set of node feature vectors is constructed. Each vector contains information such as the network interface identifier, data interaction frequency, and security sensitivity level, thereby comprehensively describing the characteristics of each monitoring node.

[0088] After constructing the node feature vector sets, it is necessary to obtain the topological connection relationships of these vector sets. The topological connection relationships reflect the physical and logical connection methods of each monitoring node in the network, including information such as the connection path, bandwidth, and latency between nodes. Through the network topology discovery algorithm, the connection relationships between nodes can be automatically detected and mapped. Using these topological connection relationships, a three-dimensional monitoring node distribution map is constructed. In this distribution map, each node is presented in the form of three-dimensional coordinates, and the connecting lines between nodes represent the communication links between them. Different colors and thicknesses can be used to represent the bandwidth and load of the links, thereby intuitively displaying the structure and node distribution of the entire confidential computer network.

[0089] To determine the division of monitoring nodes, the communication load weight of each node must be calculated. This calculation takes into account multiple factors, such as the amount of data processed per unit time, data transmission latency, and CPU and memory utilization. By collecting these parameters and applying a weighted calculation, a communication load weight value for each node is obtained. Based on these weights, a heat map of monitoring node weights is constructed. In the heat map, nodes with high loads appear darker, while nodes with low loads appear lighter, providing a visual representation of the load situation at each node. A load gradient field is also constructed, displaying load trends through the direction and magnitude of the gradient.

[0090] The monitoring node division for classified computers is comprehensively determined based on the three-dimensional monitoring node distribution map, monitoring node weight heat map, and load gradient field. During the division process, the node's security sensitivity level, communication load, and topological connectivity are considered. Nodes with similar characteristics and functions are grouped together as a monitoring node for targeted monitoring and management. For example, nodes with high security sensitivity and high communication load can be grouped as one monitoring node and equipped with higher-level security monitoring measures; nodes with low security sensitivity and low communication load can be grouped as another monitoring node and employ a relatively simplified monitoring approach.

[0091] Example 2:

[0092] This embodiment mainly focuses on the process of constructing a confidentiality self-regulatory detection indicator set based on communication data and determining an abnormal data collection strategy in combination with the division of monitoring nodes.

[0093] Extracting multidimensional features from communication data is the foundation for building a detection indicator set. This process requires analyzing the characteristics of communication data from multiple perspectives: in terms of time, the specific time periods for data transmission, such as morning, afternoon, or nighttime on weekdays, and the frequency of transmission within different time periods are extracted; in terms of content, the proportion of sensitive information in the transmitted data is analyzed, for example, by identifying confidential files and sensitive text through keyword matching or data classification algorithms; in terms of protocol, parameters such as the type of encryption protocol used (such as SSL / TLS version) and key length are obtained; and in terms of traffic, the number of packets per unit time, byte size, and transmission rate fluctuations are counted. After extracting these features, the data needs to be normalized, converting features of different dimensions into values ​​within a uniform range (e.g., between 0 and 1) to eliminate the impact of dimensional differences on subsequent analysis. This allows the construction of an indicator feature tensor, which integrates multidimensional feature data and provides structured input for subsequent risk assessment.

[0094] Based on the fuzzy analytic hierarchy process (FAHP), confidentiality risk factors are identified based on the transmission characteristics of communication data. This method first requires the construction of a fuzzy judgment matrix and invites domain experts to evaluate the relative importance of each risk factor, such as the comparison of the importance of data encryption strength and the frequency of illegal external connections. Fuzzy logic is used to deal with the uncertainty in the expert evaluation and determine the weight ranking of each risk factor. The final set of confidentiality self-regulatory detection indicators includes core indicators: data encryption strength, which can be measured by parameters such as the security of the encryption algorithm (such as AES-256 or DES) and the key update cycle; the frequency of illegal external connections, which counts the number of connections between confidential computers and unauthorized external networks (such as the public Internet); and the amount of sensitive data transmitted, which calculates the total size of sensitive files or the number of sensitive information fields transmitted within a specified time. These indicators are directly related to the core dimensions of confidentiality risk of confidential computers.

[0095] The monitoring nodes are divided and dimensionally matched with the detection indicator set. Each monitoring node has been marked with features such as security sensitivity level and data interaction frequency when it was divided. At this time, these features need to be matched with the detection indicator set: for example, for nodes with high security sensitivity levels, their sensitive data transmission volume indicators need to have stricter thresholds; for nodes with frequent data interactions, the monitoring frequency of illegal external connection frequency indicators needs to be increased accordingly. Through this matching, a multi-dimensional assessment model for confidentiality risk is constructed. The model uses monitoring nodes as the assessment objects and detection indicators as the assessment dimensions to form a multi-node, multi-indicator assessment system. Subsequently, the assessment model is divided into T time window segments according to the preset time step (such as 1 hour, 6 hours or 1 day). Each window segment corresponds to an independent assessment cycle, which facilitates dynamic analysis of risk trends over time.

[0096] Based on the monitoring node division, a risk score is calculated for each time window. The scoring process integrates the degree of deviation between the actual values ​​of each detection indicator and the security threshold. For example, if the sensitive data transmission volume of a node in a certain time window exceeds the threshold by 20%, the corresponding indicator score is 80 points (out of a maximum of 100 points); if the encryption strength does not meet the AES-256 standard, the score is 60 points. The weighted sum of the scores of each indicator is used to obtain a comprehensive risk score for the time window. The OPTICS (Ordering Points To Identify the Clustering Structure) clustering algorithm is used to cluster time windows with similar scoring trends. This algorithm calculates the reachable distance between sample points to identify densely connected clusters of sample points and is effective in handling non-convex clustering problems. For example, time windows with high risk scores on consecutive weekday mornings are grouped into one category, while weekend windows with low risk scores are grouped into another category, resulting in the clustering output.

[0097] Based on the clustering output, determine the risk assessment priority ranking for each time window segment. Window segments with high priorities (such as those in high-risk clusters) need to be monitored intensively, while window segments with low priorities can appropriately reduce the monitoring frequency. At the same time, obtain the corresponding spatiotemporal coordinates of each time window segment in the confidential computer, that is, the physical location or network topological location of the monitoring nodes involved in the window segment, as well as the corresponding time range. Combining the priority ranking and spatiotemporal coordinates, perform a detection importance assessment on each node: monitoring nodes in key topological positions (such as network core nodes) in high-priority window segments have higher detection importance scores; conversely, edge nodes in low-priority window segments have lower scores. The detection importance score is calculated by comprehensively considering factors such as node risk score, topological location, and security sensitivity level.

[0098] Based on each node's detection importance score, detection requirements are determined. A threshold (e.g., 60 points) is set. Nodes with scores exceeding the threshold trigger data collection. Higher scores require more frequent collection. For example, a node with a score of 90 must collect data every minute, while a node with a score of 70 must collect data every 10 minutes. Simultaneously, the abnormal data collection terminal obtains the data collection completeness parameter for different nodes. This parameter reflects the comprehensiveness of the node data collected by the collection terminal in different locations or network environments. For example, within 3 meters of the node, the collection completeness can reach 95%, while beyond 5 meters, it drops to 80%. Based on the collection completeness parameter and detection requirements, the optimal distance parameter for the collection terminal to each node is determined: for nodes with high detection requirements and a rapid decrease in collection completeness with distance, the optimal distance is set to 2 meters. Conversely, for nodes with low detection requirements, the optimal distance can be set to 5 meters. Based on the optimal distance parameter and the node's spatiotemporal coordinates, a set of collection points is determined. Each point corresponds to a specific physical location (e.g., next to a cabinet, under a desk) or network access point (e.g., a switch port).

[0099] Determine the abnormal data collection strategy based on the collection point set. The strategy needs to clearly define the deployment location, movement path, and collection frequency of the collection terminal: for nodes with fixed locations (such as servers), the collection terminal is fixedly deployed at the optimal distance; for mobile nodes (such as laptops), the collection terminal needs to dynamically adjust its position based on the time and space coordinates of the node. For example, if a laptop is located in Office A from 9 to 11 a.m., the collection terminal needs to be moved to a location 2 meters away from the computer in Office A before 8:50 a.m. and collect data at a frequency of once per minute; after 11 a.m., the computer moves to Conference Room B, and the collection terminal needs to arrive at the corresponding point in Conference Room B before 11:10 a.m. The strategy also needs to consider the resource allocation of the collection terminal. For example, when multiple nodes have high priority at the same time, the node with the highest importance score is collected first to ensure efficient use of detection resources.

[0100] Example 3:

[0101] This embodiment mainly focuses on the process of determining the abnormal data collection strategy according to the collection point set by the abnormal data collection terminal, and specifically involves key steps such as collection path optimization, real-time interference analysis and path adjustment.

[0102] The abnormal data collection terminal needs to obtain the spatiotemporal coordinate parameters of each collection point. The spatiotemporal coordinate parameters here include the physical location coordinates of the collection point (such as the specific values ​​of the X, Y, and Z axes) and the effective collection time window corresponding to the point. For example, a certain point only needs to collect data between 8:00 and 18:00 on weekdays. At the same time, it is also necessary to clarify the initial deployment location parameters of the abnormal data collection terminal, that is, the initial physical location of the terminal when it starts to perform the collection task. On this basis, according to the established confidentiality self-regulation detection indicator set, the network communication status of confidential computers is analyzed to determine the communication blind spots therein. Communication blind spots usually refer to areas where the network signal is weak and data transmission is difficult to be effectively monitored, such as certain corners in buildings, near edge nodes in the network topology structure, etc.

[0103] A genetic algorithm is used to optimize the path parameters for the initial deployment location and the spatiotemporal coordinates of each collection point. The genetic algorithm requires encoding the path solution, for example, encoding the order of each collection point as a chromosome. A fitness function is then set, which primarily considers factors such as the total length of the path and whether all points can be covered within the specified time. During the algorithm's execution, iterative optimization is performed through operations such as selection, crossover, and mutation, searching for the optimal solution within the space of possible path solutions. It is important to note that during the optimization process, communication blind spots are considered as path constraints, ensuring that the generated path does not pass through these blind spots to avoid incomplete data collection due to signal problems. After multiple iterations of the genetic algorithm, the shortest initial collection path for the abnormal data collection terminal is ultimately output. This path enables the terminal to cover all collection points with the shortest travel distance and time.

[0104] As the abnormal data collection terminal performs real-time data collection along the shortest initial collection path, it is necessary to obtain real-time data on the terminal's device status. These parameters include the terminal's battery level, operating temperature, and network connection status. Analysis of these status change parameters can determine the electromagnetic interference intensity and network congestion level at the terminal's real-time collection location. For example, when the terminal's battery level is low, its signal reception capability may decrease, indirectly indicating that electromagnetic interference may be high at the current location. High network connection latency and packet loss rates indicate high network congestion at the current location.

[0105] It is necessary to obtain the anti-interference performance parameters of the abnormal data collection terminal. These parameters primarily include the terminal's ability to filter signals of varying interference strengths. For example, when facing strong electromagnetic interference, the terminal can filter out a certain percentage of interfering signals to ensure valid data reception; in weak interference situations, its signal filtering capability may be even stronger. Furthermore, it is necessary to obtain the terminal's response delay parameters for electromagnetic interference intensity and network congestion levels. This refers to the time it takes for the terminal to detect interference or congestion and take appropriate corrective measures. Based on this response delay parameter, the terminal's collection path adjustment lag can be determined, which is the time delay in path adjustment caused by the response delay.

[0106] Based on anti-interference performance parameters and the acquisition path adjustment hysteresis, a comprehensive analysis of the electromagnetic interference intensity and network congestion level at the terminal's real-time acquisition location is performed. The cumulative value of the terminal's acquisition path deviation during the response delay is calculated. This cumulative value reflects the extent to which the terminal's actual acquisition path deviates from the shortest initial acquisition path due to interference and congestion during the response delay.

[0107] If the accumulated collection path offset is less than a pre-set threshold, it indicates that the current electromagnetic interference and network congestion have minimal impact on the collection path, and no significant path adjustment is required. At this point, the accumulated offset value is used to determine the path offset direction and amount for the terminal when collecting along the shortest initial collection path. This is then used to determine the adjustment direction and amount, resulting in an adjustment parameter. Based on this adjustment parameter, a small-scale adjustment is performed on the shortest initial collection path to obtain the first collection strategy. For example, if the accumulated offset value indicates that the terminal shifted 0.5 meters to the right during the response delay, the adjustment parameter is to move the terminal 0.5 meters to the left, returning the terminal to the vicinity of the initial path.

[0108] If the accumulated collection path offset exceeds the set threshold, it indicates that the current interference and congestion are significantly impacting the collection path, necessitating path replanning. At this point, the terminal obtains the electromagnetic interference intensity and network congestion level parameters for the real-time collection path, and constructs an interference change map based on these parameters. This map displays the changes in electromagnetic interference intensity and network congestion level using time and space as coordinate axes, intuitively reflecting the changing trends of interference, such as whether the interference intensity is gradually increasing or the congested area is expanding.

[0109] The interference change trend is interpolated based on the spline interpolation method. The spline interpolation method can construct a smooth curve based on known data points, thereby predicting the interference parameters of each point within the preset range of the shortest initial acquisition path. Based on the predicted interference parameters and the anti-interference performance parameters of the terminal, the acquisition stability of the terminal within the preset range of the shortest initial acquisition path is evaluated. For example, if the electromagnetic interference intensity of a certain path is predicted to exceed the anti-interference capability of the terminal, it is determined that the acquisition stability of this path is poor. Based on the acquisition stability evaluation results, the shortest initial acquisition path section with a cumulative acquisition path offset value greater than the set threshold is optimized to avoid high interference and high congestion areas, re-plan the path, and obtain an updated acquisition path. The abnormal data acquisition terminal performs acquisition operations according to the updated acquisition path to obtain a second acquisition strategy.

[0110] Example 4:

[0111] This embodiment mainly focuses on the process of an abnormal data collection terminal acquiring real-time communication data according to a collection strategy, identifying confidentiality risk levels and violations with the help of a confidentiality risk identification model, and ultimately obtaining detection result data. The following describes the implementation method in detail with reference to specific examples.

[0112] Taking a certain unit's confidential office network as an example, the network contains multiple computers that process data of different confidentiality levels. Daily communication scenarios include internal file transfers, external device access, and confidential system access. It is necessary to obtain the standard communication data of the confidential computer in different communication scenarios. For example, in the internal file transfer scenario, standard communication data may include non-sensitive office documents transmitted through the unit's internal encryption protocol. Its data traffic characteristics are 10-20 data packets per second, each data packet size is approximately 10KB-50KB, and the AES-256 encryption algorithm is used. In the external device access scenario, standard communication data is the communication record when an authenticated confidential USB flash drive is connected. It is characterized by a short period of high traffic (approximately 500KB / s) at the moment of access, followed by a return to normal data exchange frequency, and the device access process complies with the preset authentication process. In the confidential system access scenario, standard communication data is the traffic accessing the confidential server through the VPN encrypted channel, characterized by a continuous and stable low traffic (approximately 5KB / s-10KB / s), and the communication protocol complies with specific security specifications.

[0113] After obtaining these standard communication data, they need to be labeled with risk levels. Risk levels are generally divided into three levels: low risk, medium risk, and high risk. Taking the internal file transfer scenario as an example, if the transmitted document is non-sensitive and the encryption algorithm meets the requirements, it is labeled as low risk; if the transmitted file is non-sensitive but does not use the specified encryption algorithm, it is labeled as medium risk; if the transmitted file is sensitive and is not encrypted, it is labeled as high risk. For external device access scenarios, unauthenticated device access or abnormal data transmission during access will be labeled as medium risk or high risk. During the labeling process, the corresponding violations of each standard communication data are recorded, such as violations such as "not using the AES-256 encryption algorithm" and "transmitting sensitive data without marking the confidentiality level" in internal file transfers, and violations such as "failure to pass device authentication" and "illegal transmission of large amounts of data" in external device access, thereby obtaining labeled communication data.

[0114] A confidentiality risk identification model is constructed based on the support vector machine algorithm. The core of the support vector machine algorithm is to find an optimal hyperplane to classify communication data of different risk levels. When building the model, it is necessary to determine the type of kernel function. Common kernel functions include linear kernels, polynomial kernels, and radial basis function (RBF) kernels. For example, the radial basis function kernel can map data into a high-dimensional space, thus better handling nonlinear classification problems. Labeled communication data is imported into the identification model for training. During the training process, the model learns the mapping relationship between the characteristics of standard communication data and risk levels and violations.

[0115] Taking annotated data from an internal file transfer scenario as an example, the model learns to associate features like the use of the AES-256 encryption algorithm and data packet sizes within a normal range with low risk ratings; features like the transmission of non-sensitive data without using the specified encryption algorithm with medium risk ratings; and features like the transmission of sensitive data without encryption with high risk ratings. During training, model parameters, such as the kernel function parameters and penalty factors, are continuously adjusted to improve recognition accuracy.

[0116] Based on a defined collection strategy, the abnormal data collection terminal collects real-time communication data from confidential computers at designated times and locations. For example, within the aforementioned confidential office network, the collection strategy might dictate that real-time communication data from computers processing sensitive data be collected every 10 minutes between 8:00 AM and 6:00 PM on weekdays, from network access points near the cabinet where the computers are located. The real-time communication data captured by the collection terminal might include traffic data for a specific internal file transfer, such as the number and size of packets transmitted, the encryption algorithm used, and the source and destination IP addresses.

[0117] Real-time communication data is imported into the trained confidentiality risk identification model, which extracts and analyzes the data's features. For example, if real-time internal file transfer data shows the use of the DES encryption algorithm (rather than the required AES-256) and the transmission is of a standard office document, the model will identify the communication data as having a medium risk level based on the trained mapping relationship. The model will also compile statistics on violations in this communication scenario to identify any violations involving "failure to use the required encryption algorithm."

[0118] If the data collected in real time shows that a confidential computer has established a connection with an external non-secure network (such as the public Internet) and transmitted a large amount of data, the model will identify the risk level of the communication data as high risk based on the annotations of similar situations in the training data, and count violations such as "illegal external connection" and "possible leakage of sensitive data".

[0119] By processing real-time communication data collected at each session, the model continuously identifies confidentiality risk levels and violations on classified computers, ultimately generating detection results. This comprehensive data reflects the confidentiality risk status and violations of classified computers at different times and in different communication scenarios, providing a critical basis for subsequent indicator updates on the supervisory control platform.

[0120] In actual applications, with the changes in confidential computer communication scenarios and the emergence of new security threats, it is necessary to continuously update standard communication data and labeled communication data, and retrain the confidentiality risk identification model to improve the model's adaptability and recognition accuracy, ensure that various confidentiality risks and violations can be identified in a timely and accurate manner, and protect the information security of confidential computers.

[0121] Example 5:

[0122] In the Gigabit network-based confidentiality self-regulatory detection method for confidential computers, Example 5 focuses on the process of transmitting detection result data to the supervision and control platform through the self-regulatory feedback mechanism and updating indicators. The following describes the implementation method in detail with reference to specific examples.

[0123] For example, consider the network system of a confidential unit. The unit deploys multiple confidential computers, each used to process files of varying levels of confidentiality. After the abnormal data collection terminal completes real-time communication data collection on a confidential computer, it generates a set of detection results. For example, within a certain time period, the computer connected to an unauthorized external network three times, transmitting data packets containing unencrypted sensitive documents. The detection results indicate a high confidentiality risk level, with violations including "illegal external connections" and "unencrypted transmission of sensitive data."

[0124] A layered data update protocol stack is constructed based on a self-regulatory feedback mechanism. This protocol stack comprises the physical layer, data link layer, network layer, transport layer, and application layer. The physical layer is responsible for converting test result data into electrical or optical signals for transmission, such as via optical fiber or network cables. The data link layer encapsulates data into frames, adding information such as the source and destination addresses to ensure reliable data transmission within the link. The network layer selects an appropriate path based on the network topology to transmit data to the supervisory control platform. The transport layer is responsible for data segmentation and reassembly to ensure data transmission integrity. The application layer parses and processes the data so that it can be recognized and used by the supervisory control platform.

[0125] Feature extraction is performed on the detection result data to construct a detection feedback signal. In the above example, the extracted features include the number of illegal external connections, the amount of sensitive data transmitted, the use of encryption algorithms, and the risk level. This information is then integrated into the detection feedback signal, for example, by encapsulating it into a data packet in a specific format, including fields such as a timestamp, the identification of the confidential computer, the risk level, and a list of violations.

[0126] The protocol stack is updated based on the layered data, and the detection feedback signal is transmitted to the supervisory control platform. During the transmission process, each layer of the protocol processes the data. For example, the physical layer ensures stable signal transmission, the data link layer performs error detection and correction, the network layer selects the optimal path, the transport layer controls the flow and sequence of data, and the application layer parses the data and transmits it to the corresponding module of the supervisory control platform.

[0127] After the transmission is complete, the detection feedback signal is mapped to indicators. The historical detection database of the supervisory control platform is obtained. This database stores the confidential unit's previous detection data, such as violation records of each confidential computer over the past six months, changes in risk levels, and detection indicator thresholds and weights. Similarity matching is performed between the detection feedback signal and the historical detection database. For example, by comparing characteristics such as the number of illegal external connections and the amount of sensitive data transmitted with similar cases in the historical data, a high-matching historical record is found.

[0128] Suppose that the historical detection database contains similar cases of illegal external connections and unencrypted transmission of sensitive data. The matching output shows that the risk level of these cases is high, and the main detection indicators involved are "illegal external connection frequency" and "sensitive data transmission volume." Based on the matching output, the distribution characteristics of the abnormal data in the detection feedback signal are determined, indicating that the abnormal data is mainly concentrated in these two detection indicators.

[0129] A moving average filter algorithm is used to smooth out abnormal data in a time series. For example, similar abnormal data from the past week is selected and its moving average is calculated to eliminate random fluctuations in the data and obtain effective feedback data. Assuming that the frequency of illegal external connections of the confidential computer in the past week was 2 times, 1 time, 3 times, 2 times, 1 time, 3 times, and 2 times, respectively, after calculation using a moving average filter (window size of 3), the smoothed frequency of illegal external connections is 2 times, 2 times, 2 times, 2 times, and 2 times, making the data more stable and convenient for subsequent analysis.

[0130] Dimensionally align valid feedback data with the detection indicator set to construct an indicator update correlation matrix. The detection indicator set includes indicators such as "Data Encryption Strength," "Frequency of Illegal External Connections," and "Volume of Sensitive Data Transmission." For the valid feedback data in the above example, "Frequency of Illegal External Connections" and "Volume of Sensitive Data Transmission" are closely correlated with the abnormal data, while "Data Encryption Strength" is also affected by the unencrypted transmission of sensitive data.

[0131] Based on the correlation coefficient matrix, we calculated the correlation between each detection indicator and the key factors. The key factors are the main factors that led to the high risk this time, namely "illegal external connections" and "unencrypted transmission of sensitive data." We calculated the correlation coefficients between each detection indicator and these key factors. For example, the correlation coefficient between "illegal external connection frequency" and the key factor is 0.9, the correlation coefficient between "sensitive data transmission volume" is 0.85, the correlation coefficient between "data encryption strength" is 0.7, and the correlation coefficient between other indicators such as "interface access security" is 0.3. Based on these correlation values, we constructed an indicator update association matrix. Each row and column in the matrix corresponds to a detection indicator and a key factor, and the cell value is the correlation coefficient.

[0132] Sort the correlation values ​​of each indicator in the correlation matrix and select the detection indicators whose absolute correlation values ​​are less than a set threshold (such as 0.5) as the detection indicators that need to be adjusted. In this example, indicators with low correlation, such as "Interface Access Security", are selected.

[0133] Update the threshold range or weight coefficient for detection indicators that require adjustment. For the quantitative indicator "Frequency of Illegal External Connections," the original threshold was no more than once per month. Based on valid feedback data showing that this computer repeatedly engaged in illegal external connections within a short period of time, the upper threshold has been reset to no more than once per week, lowering the threshold to increase monitoring intensity. For the qualitative indicator "Data Encryption Strength," the original level description of "Failure to Use the Specified Encryption Algorithm" was considered medium risk. Based on feedback data showing that sensitive data was not encrypted, resulting in high risk, the level description has been redefined as "Failure to Use the Specified Encryption Algorithm and Transmitting Sensitive Data is High Risk."

[0134] The weight coefficients of all detection indicators were normalized and adjusted to ensure that the total weight was 1. For example, the original weight of "Frequency of Illegal External Connections" was 20%, "Volume of Sensitive Data Transmission" was 25%, "Data Encryption Strength" was 20%, and the other indicators had a total weight of 35%. Because the abnormal data showed an increase in the importance of the first three indicators, the weight of "Frequency of Illegal External Connections" was adjusted to 25%, "Volume of Sensitive Data Transmission" to 30%, "Data Encryption Strength" to 25%, and the other indicators had a total weight of 20%. The total weight of all weights after the adjustment still remains 100%.

[0135] Generate an updated set of confidentiality self-regulatory detection indicators and store them on the supervision and control platform. In subsequent testing processes, the supervision and control platform will use the updated indicator set to assess and detect confidentiality risks of confidential computers, so that the detection indicators can better reflect the current security status and improve the accuracy and effectiveness of detection.

[0136] Through such a self-regulatory feedback mechanism and indicator update process, the confidentiality self-regulatory detection method of confidential computers can continuously adapt to new security threats and changes, continuously optimize detection indicators, improve the ability to identify and prevent confidentiality risks, and ensure the security of confidential information.

[0137] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0138] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A method for detecting confidentiality of confidential computers based on gigabit networks, characterized in that: The following steps are involved: Acquire gigabit network communication data and device characteristic data of the confidential computer based on the network traffic analysis module, and determine the monitoring node division of the confidential computer according to the device characteristic data; Constructing a confidentiality self-regulatory detection indicator set based on the communication data, and determining an abnormal data collection strategy based on the detection indicator set and the monitoring node division; The abnormal data collection terminal obtains the real-time communication data of the confidential computer according to the collection strategy, identifies the confidentiality risk level and violation items of the confidential computer according to the real-time communication data, and obtains the detection result data; The test result data is transmitted to the supervision control platform according to the self-supervision feedback mechanism for indicator update.

2. The method for detecting confidentiality of a computer based on a gigabit network according to claim 1, characterized in that: The network traffic analysis module obtains the Gigabit network communication data and device feature data of the confidential computer, and determines the monitoring node division of the confidential computer according to the device feature data, specifically: Based on the network traffic analysis module, the protocol decoding algorithm is called to perform deep packet analysis on the gigabit network communication data to extract the communication protocol type, data flow direction, and transmission rate communication data; Extract features of the hardware configuration, operating system version, and security software deployment status of confidential computers to obtain device feature data; Performing spatial feature clustering on the device feature data based on the K-means clustering algorithm, and setting the initial threshold of the cluster center as the device safety level coefficient; According to the clustering results, the confidential computers are divided into M monitoring nodes. Each monitoring node is labeled with the network interface identifier, data interaction frequency, and security sensitivity level, and a node feature vector set is constructed. Acquire a topological connection relationship of the node feature vector set, and construct a three-dimensional monitoring node distribution map based on the topological connection relationship; The communication load weight of each node is calculated according to the three-dimensional monitoring node distribution map, a monitoring node weight heat map and a load gradient field are constructed according to the communication load weight, and the monitoring node division of the confidential computer is determined according to the heat map and gradient field.

3. The method for detecting confidentiality of a computer based on a gigabit network according to claim 1, characterized in that: The confidentiality self-regulatory detection indicator set is constructed based on the communication data, and the abnormal data collection strategy is determined based on the detection indicator set and the monitoring node division, specifically: Perform multi-dimensional feature extraction on the communication data, construct an indicator feature tensor through normalization processing, identify confidentiality risk factors based on the transmission characteristics of the communication data based on the fuzzy analytic hierarchy process, and generate a confidentiality self-regulatory detection indicator set including data encryption strength, frequency of illegal external connections, and sensitive data transmission volume; Performing a dimensional matching operation on the monitoring node division and the detection indicator set to construct a multi-dimensional assessment model for confidentiality risk, and dividing the assessment model according to a preset time step to construct T time window segments; Obtain risk score information for each time window segment according to the monitoring node division, and cluster the time window segments with similar score trends in the risk multidimensional assessment model based on the OPTICS clustering algorithm to obtain cluster output; Determine a priority ranking for risk assessment of each time window segment based on the clustering output, obtain corresponding spatiotemporal coordinates of each time window segment in the confidential computer, and perform a risk detection importance assessment on each node in the confidential computer based on the priority ranking and the corresponding spatiotemporal coordinates to obtain a detection importance score for each node; Determining detection requirement information for each node in the confidential computer according to the detection importance score of each node, wherein the detection requirement information includes whether to trigger collection and collection frequency requirement information; Obtaining a collection integrity parameter of data from different nodes by the abnormal data collection terminal, determining an optimal distance parameter for the abnormal data collection terminal to collect data from each node of the confidential computer based on the collection integrity parameter and detection requirement information, and determining a collection point set of the abnormal data collection terminal based on the optimal distance parameter; An abnormal data collection strategy of the abnormal data collection terminal is determined according to the collection point set.

4. The method for detecting confidentiality of a computer based on a gigabit network according to claim 3, characterized in that: The abnormal data collection strategy of the abnormal data collection terminal is determined according to the collection point set, specifically: Obtaining the spatiotemporal coordinate parameters of each collection point and the initial deployment position parameters of the abnormal data collection terminal, and determining the communication blind spot in the confidential computer based on the detection indicator set; Optimizing the path of the initial deployment location parameters and the spatiotemporal coordinate parameters of each collection point based on a genetic algorithm, taking the communication blind area as a path constraint area, and outputting the shortest initial collection path for the abnormal data collection terminal; Acquire in real time the device state change parameters when the abnormal data acquisition terminal performs acquisition according to the shortest initial acquisition path, and determine the electromagnetic interference intensity and network congestion level at the real-time acquisition location of the abnormal data acquisition terminal according to the state change parameters; Obtaining anti-interference performance parameters of the abnormal data acquisition terminal, wherein the anti-interference performance parameters include parameters of the terminal's ability to filter signals of interference of different intensities; Obtaining a response delay parameter of the abnormal data collection terminal to the electromagnetic interference intensity and the network congestion level, and determining a collection path adjustment hysteresis amount of the abnormal data collection terminal according to the response delay parameter; Analyzing the electromagnetic interference intensity and network congestion level of the real-time collection location of the abnormal data collection terminal according to the anti-interference performance parameter and the collection path adjustment hysteresis, and calculating the cumulative value of the collection path deviation of the abnormal data collection terminal within the response delay time; If the accumulated value of the acquisition path offset is less than a set threshold, determining the path offset direction and offset amount of the abnormal data acquisition terminal along the shortest initial acquisition path according to the accumulated value of the offset, and determining the adjustment direction and adjustment amount of the abnormal data acquisition terminal according to the offset direction and offset to obtain an adjustment parameter; Adjusting the shortest initial acquisition path of the abnormal data acquisition terminal in real-time acquisition according to the adjustment parameters to obtain a first acquisition strategy; If the accumulated value of the acquisition path deviation is greater than a set threshold, the electromagnetic interference intensity and network congestion degree parameters of the real-time acquisition path of the abnormal data acquisition terminal are obtained, an interference change map is constructed based on the parameters, and the interference change trend of the detection area in the confidential computer is determined based on the interference change map; Based on the spline interpolation method, the interference change trend is interpolated, and the interference parameters within the preset range of the shortest initial acquisition path are determined. The acquisition stability of the abnormal data acquisition terminal within the preset range of the shortest initial acquisition path is determined based on the interference parameters and the anti-interference performance parameters. According to the acquisition stability, the shortest initial acquisition path section with the cumulative value of the acquisition path offset greater than the set threshold is optimized to obtain an updated acquisition path. The abnormal data acquisition terminal performs an acquisition operation according to the updated acquisition path to obtain a second acquisition strategy.

5. The method for detecting confidentiality of a computer based on a gigabit network according to claim 1, wherein: The abnormal data collection terminal obtains the real-time communication data of the confidential computer according to the collection strategy, identifies the confidentiality risk level and violation items of the confidential computer according to the real-time communication data, and obtains the detection result data, specifically: Obtaining standard communication data of different communication scenarios of a confidential computer, and labeling the standard communication data with risk levels to obtain labeled communication data; Constructing a confidentiality risk identification model based on a support vector machine algorithm, and importing the labeled communication data into the identification model for training; The abnormal data acquisition terminal obtains the real-time communication data of the confidential computer according to the acquisition strategy, imports the real-time communication data into the trained confidentiality risk identification model to identify the confidentiality risk level, and counts the violations in each communication scenario to obtain detection result data.

6. The method for detecting confidentiality of a computer based on a gigabit network according to claim 1, characterized in that: The test result data is transmitted to the supervision control platform according to the self-supervision feedback mechanism to update the indicators, specifically: Building a hierarchical data update protocol stack based on a self-regulatory feedback mechanism, extracting features from the detection result data, and building a detection feedback signal; The detection feedback signal is transmitted to the supervision control platform according to the layered data update protocol stack, and an indicator mapping operation is performed on the detection feedback signal to obtain confidential self-supervision detection update data of the confidential computer.

7. The method for detecting confidentiality of a computer based on a gigabit network according to claim 6, characterized in that: The detection feedback signal is transmitted to the supervision control platform according to the layered data update protocol stack, and the indicator mapping operation is performed on the detection feedback signal to obtain the confidentiality self-supervision detection update data of the confidential computer, specifically: Obtaining a historical detection database of a supervisory control platform, performing similarity matching between the detection feedback signal and the historical detection database, and obtaining a matching output; Determine the distribution characteristics of abnormal data in the detection feedback signal based on the matching output, and perform a time series smoothing operation on the abnormal data based on a moving average filtering algorithm to obtain valid feedback data; Aligning the effective feedback data with the detection indicator set, constructing an indicator update association matrix, and determining the detection indicator items that need to be adjusted according to the weight change trend of each indicator in the association matrix; The threshold range or weight coefficient of the detection indicator item that needs to be adjusted is updated to generate an updated confidentiality self-regulation detection indicator set, and the updated detection indicator set is stored in the supervision control platform to obtain the confidentiality self-regulation detection update data of the confidential computer.

8. The method for detecting confidentiality of a confidential computer based on a gigabit network according to claim 7, characterized in that: The effective feedback data is dimensionally aligned with the detection indicator set, an indicator update association matrix is ​​constructed, and the detection indicator items that need to be adjusted are determined according to the weight change trend of each indicator in the association matrix, specifically: Performing factor analysis on the effective feedback data to extract key factors that affect confidentiality risk, and determining corresponding correlation relationships with the detection indicator set based on the key factors; Calculate the correlation values ​​of each detection index and key factors based on the correlation coefficient matrix, and construct the index update correlation matrix; The correlation values ​​of the indicators in the correlation matrix are sorted, and detection indicator items with absolute correlation values ​​less than a set threshold are screened out as detection indicator items that need to be adjusted.

9. The method for detecting confidentiality of a confidential computer based on a gigabit network according to claim 8, characterized in that: The threshold range or weight coefficient of the detection indicator item that needs to be adjusted is updated to generate an updated confidentiality self-regulation detection indicator set, specifically: For quantitative indicators that need to be adjusted, reset the upper and lower thresholds based on the statistical distribution of valid feedback data; For qualitative indicators that need to be adjusted, redefine the level description based on the semantic analysis results of effective feedback data; The weight coefficients of all detection indicator items are normalized and adjusted to ensure that the sum of the weights is 1, and an updated confidentiality self-regulatory detection indicator set is generated.

10. The method for detecting confidentiality of a computer based on a gigabit network according to claim 3, characterized in that: The multi-dimensional confidentiality risk assessment model is constructed as follows: Identify the core dimensions of confidentiality risk assessment, including data transmission compliance, interface access security, log record integrity, and violation traceability; Specific evaluation indicators are set for each core dimension, including data transmission compliance, including encryption protocol matching degree and sensitive data identification rate; interface access security, including external device authentication rate and remote login authorization rate; log record integrity, including operation log retention period and abnormal behavior record completeness; violation traceability, including event tracing success rate and responsible party location accuracy rate; An expert system is organized based on the Bayesian network algorithm to evaluate the importance of each dimension and indicator. The weight coefficient of each dimension and the sub-weight coefficient of each indicator in the corresponding dimension are calculated based on the evaluation results. The evaluation indicators, weight coefficients and sub-weight coefficients of each dimension are structured and integrated to construct a multidimensional assessment model for confidentiality risk that includes multidimensional indicators and hierarchical weights.

Images