A method for evaluating security performance of information system for level protection construction

Abstract

The application discloses a kind of information system security performance evaluation methods for level protection construction, belong to information system field, for solving the problem that information system is mostly fixed security protection level, file analysis module carries out protection analysis to the protection file in temporary storage module, obtains the file protection value of protection file and sends to performance adaptation module, the security performance of information system is analyzed using security analysis module, obtains the system protection value of information system and sends to performance adaptation module, the protection performance of protection file and information system is adapted by performance adaptation module, corresponding preset security level is obtained according to file protection value and system protection value, preset security level is compared to generate performance adaptation signal or performance increment signal, the security protection level of the application changes information system fixed, and the security protection level of information system is intelligently adjusted in combination with the protection requirement of file.

Description

Technical Field

[0001] This invention belongs to the field of information systems and relates to security performance assessment technology, specifically a method for assessing the security performance of information systems used in the construction of graded protection systems. Background Technology

[0002] An information system is a human-machine integrated system composed of computer hardware, network and communication equipment, computer software, information resources, information users, and regulations, designed to process information flow. It primarily has five basic functions: information input, storage, processing, output, and control. Information systems have evolved through three stages: simple data processing information systems, isolated business management information systems, and integrated intelligent information systems.

[0003] In existing technologies, the protection level of most companies' information systems remains unchanged, but the uploaded files have different encryption levels. Once the protection level requirement of the encrypted file is higher than the protection level of the information system, the information system will be unable to provide security protection for the encrypted file. Therefore, we propose an information system security performance evaluation method for graded protection construction. Summary of the Invention

[0004] To address the shortcomings of existing technologies, the purpose of this invention is to provide a method for evaluating the security performance of information systems used in the construction of graded protection systems.

[0005] The technical problem to be solved by this invention is:

[0006] How to change the fixed protection level of an information system and intelligently adjust the security protection level of the information system based on the security protection performance of documents.

[0007] The objective of this invention can be achieved through the following technical solutions:

[0008] A method for evaluating the security performance of information systems used in the construction of graded protection systems, the method is as follows:

[0009] Step S101: Users upload protection files to the temporary storage module via their user terminals;

[0010] Step S102: The file analysis module performs protection analysis on the protected files in the temporary storage module, calculates the file protection value of the protected files based on the runtime and bad sector ratio, and sends it to the performance adaptation module.

[0011] Step S103: The data acquisition module collects network data and protection data of the information system and sends the network data and protection data to the security analysis module.

[0012] Step S104: Analyze the security performance of the information system using the security analysis module, calculate the system protection value of the information system by combining the download network stability coefficient, upload network stability coefficient and total attack duration, and send it to the performance adaptation module.

[0013] Step S105: The protection performance of the protected file and the information system is adapted through the performance adaptation module. The corresponding preset security level is obtained based on the file protection value and the system protection value. The preset security level is compared to generate a performance adaptation signal or a performance enhancement signal. If a performance enhancement signal is generated, the preset security level of the information system is increased.

[0014] Furthermore, the information system includes a server, which is connected to a user terminal, a temporary storage module, a file analysis module, a performance adaptation module, a security analysis module, and a data acquisition module;

[0015] The user terminal is used for users to upload protection files and send the protection files to the temporary storage module. The temporary storage module is used to temporarily store the protection files uploaded by the user terminal.

[0016] The file analysis module is used to perform protection analysis on the protection files in the temporary storage module. The protection analysis obtains the file protection value of the protection file and feeds it back to the server. The server sends the file protection value FHu of the protection file to the performance adaptation module.

[0017] The data acquisition module is used to collect network data and protection data of the information system and send the network data and protection data to the server. The server then sends the network data and protection data to the security analysis module.

[0018] The security analysis module is used to analyze the security performance of the information system, and the system protection value of the information system is fed back to the server. The server then sends the system protection value of the information system to the performance adaptation module.

[0019] The server stores preset security levels corresponding to system protection values ​​and preset security levels corresponding to file protection values; the performance adaptation module is used to adapt the protection performance of protected files and information systems, and generates performance adaptation signals or performance enhancement signals to be fed back to the server.

[0020] If the server receives a performance adaptation signal, it will not perform any operation. If the server receives a performance enhancement signal, it will increase the preset security level of the information system.

[0021] Furthermore, the protection analysis process of the file analysis module is as follows:

[0022] Step 1: Mark the protected file as u, u=1,2,...,z, where z is a positive integer; establish a file analysis simulation server in the file analysis module, in which a virtual machine runs;

[0023] Step 2: Copy the protection file from the temporary storage module and transfer the copy of the protection file to the simulation server;

[0024] Step 3: Place a copy of the protection document and the virtual machine in the same folder, start the virtual machine, and record the start time of the virtual machine.

[0025] Step 4: Continuously acquire real-time sector data of the protected document copy during the virtual machine's operation until the virtual machine finishes running. Compare the real-time sector data with the initial sector data and record the virtual machine's end time.

[0026] Step 5: Subtract the virtual machine's startup time from the virtual machine's end time to obtain the runtime TYu of the virtual machine corresponding to the protection file;

[0027] Step Six: If the initial sector data corresponding to the real-time sector data has not changed, no operation is performed. If the initial sector data corresponding to the real-time sector data has changed, the number of bad sectors in the changed real-time sector data is counted, and the number of bad sectors is compared with the total number of sectors to obtain the percentage of bad sectors corresponding to the protected file.

[0028] Step 7: Calculate the file protection value FHu of the protected file using the formula FHu=α×(TYu / ZHu); where α is a fixed error compensation coefficient, and the value of α is greater than zero.

[0029] Furthermore, network data refers to the network download and network upload values ​​of the information system;

[0030] Protection data includes the number of times an information system is attacked per unit of time and the duration of each attack.

[0031] Furthermore, the security analysis module is used to analyze the security performance of the information system. The specific analysis process is as follows:

[0032] Step S1: Obtain the network connected to the information system, set the security analysis period of the information system, and set several time points within the security analysis period;

[0033] Step S2: Obtain the network download and network upload values ​​of the network connected to the information system at each time point;

[0034] Step S3: Calculate the network download fluctuation rate and network upload fluctuation rate of the network connected to the information system within the time interval between adjacent time points. Sum the network download fluctuation rate and network upload fluctuation rate within the time interval between adjacent time points to obtain the network download fluctuation rate and network upload fluctuation rate of the network connected to the information system during the security analysis period.

[0035] Step S4: If the network download fluctuation rate is less than the preset network download fluctuation rate, then set the download network stability coefficient XWX and take the value X1;

[0036] If the network upload fluctuation rate is less than the preset network upload fluctuation rate, then set the upload network stability coefficient SWX and take the value Y1;

[0037] If the network download fluctuation rate is greater than or equal to the preset network download fluctuation rate, then set the download network stability coefficient XWX and take the value X2;

[0038] If the network upload fluctuation rate is greater than or equal to the preset network upload fluctuation rate, then set the upload network stability coefficient SWX and take the value Y2;

[0039] Step S5: Obtain the number of attacks on the information system during the security analysis period and the duration of each attack. Sum the durations of each attack to obtain the total attack duration TZG of the information system.

[0040] Step S6: Calculate the system protection value XFH of the information system using the formula XFH=XWX×a1+SWX×a2+TZG×a3; where a1, a2 and a3 are fixed weighting coefficients, and the values ​​of a1, a2 and a3 are all greater than zero.

[0041] Furthermore, the feature is that the values ​​of X1, X2, Y1 and Y2 are all greater than zero, and the value of X1 is greater than X2, and the value of Y1 is greater than Y2.

[0042] Furthermore, the specific working process of the performance adaptation module is as follows:

[0043] Step SS1: Obtain the file protection value of the protected file and the system protection value of the information system;

[0044] Step SS2: Determine the corresponding preset security level based on the file protection value and system protection value;

[0045] Step SS3: If the preset security level corresponding to the file protection value is the same as the preset security level corresponding to the system protection value, then generate a performance adaptation signal;

[0046] Step SS4: If the preset security level corresponding to the file protection value is higher than the preset security level corresponding to the system protection value, then a performance enhancement signal is generated;

[0047] Step SS5: If the preset security level corresponding to the file protection value is lower than the preset security level corresponding to the system protection value, a performance adaptation signal is generated.

[0048] Compared with the prior art, the beneficial effects of the present invention are:

[0049] This invention involves uploading protective files to a temporary storage module via a user terminal. A file analysis module performs protection analysis on the protective files in the temporary storage module, calculating the file protection value based on runtime and bad sector ratio, and sending it to the performance adaptation module. A security analysis module then analyzes the security performance of the information system, calculating the system protection value by combining download network stability coefficient, upload network stability coefficient, and total attack duration, and sending it to the performance adaptation module. Finally, the performance adaptation module adapts the protection performance of the protective files and the information system, obtaining corresponding preset security levels based on the file protection value and system protection value. The preset security levels are then compared to generate a performance adaptation signal or a performance enhancement signal. When generating a performance enhancement signal, the preset security level of the information system is increased.

[0050] This invention performs security performance assessments on information systems and uploaded protected files, changes the fixed protection level of the information system, and intelligently adjusts the security protection level of the information system based on the security performance of the files. Attached Figure Description

[0051] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0052] Figure 1 This is a flowchart of the process of the present invention;

[0053] Figure 2 This is an overall system block diagram of the present invention. Detailed Implementation

[0054] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0055] Please see Figure 1 As shown, an information system security performance evaluation method for graded protection construction is described below:

[0056] Step S101: Users upload protection files to the temporary storage module via their user terminals;

[0057] Step S102: The file analysis module performs protection analysis on the protected files in the temporary storage module, calculates the file protection value of the protected files based on the runtime and bad sector ratio, and sends it to the performance adaptation module.

[0058] Step S103: The data acquisition module collects network data and protection data of the information system and sends the network data and protection data to the security analysis module.

[0059] Step S104: Analyze the security performance of the information system using the security analysis module, calculate the system protection value of the information system by combining the download network stability coefficient, upload network stability coefficient and total attack duration, and send it to the performance adaptation module.

[0060] Step S105: The protection performance of the protected file and the information system is adapted through the performance adaptation module. The corresponding preset security level is obtained based on the file protection value and the system protection value. The preset security level is compared to generate a performance adaptation signal or a performance enhancement signal. If a performance enhancement signal is generated, the preset security level of the information system is increased.

[0061] Please see Figure 2 As shown, in a specific implementation, the information system includes a server, which is connected to a user terminal, a temporary storage module, a file analysis module, a performance adaptation module, a security analysis module, and a data acquisition module.

[0062] Users register and log in to the server by entering their personal information through their user terminals and then send their personal information to the server. This personal information includes their name, mobile phone number, etc.

[0063] The user terminal is used for users to upload protection files and send the protection files to the temporary storage module. The temporary storage module is used to temporarily store the protection files uploaded by the user terminal.

[0064] The file analysis module is used to perform protection analysis on the protected files in the temporary storage module. The protection analysis process is as follows:

[0065] Step 1: Mark the protected file as u, u=1,2,...,z, where z is a positive integer; establish a file analysis simulation server in the file analysis module, in which a virtual machine runs;

[0066] In practice, virtual machines are used by viruses to infiltrate software.

[0067] Step 2: Copy the protection file from the temporary storage module and transfer the copy of the protection file to the simulation server;

[0068] Step 3: Place a copy of the protection document and the virtual machine in the same folder, start the virtual machine, and record the start time of the virtual machine.

[0069] Step 4: Continuously acquire real-time sector data of the protected document copy during the virtual machine's operation until the virtual machine finishes running. Compare the real-time sector data with the initial sector data and record the virtual machine's end time.

[0070] Step 5: Subtract the virtual machine's startup time from the virtual machine's end time to obtain the runtime TYu of the virtual machine corresponding to the protection file;

[0071] Step Six: If the initial sector data corresponding to the real-time sector data has not changed, no operation is performed. If the initial sector data corresponding to the real-time sector data has changed, the number of bad sectors in the changed real-time sector data is counted, and the number of bad sectors is compared with the total number of sectors to obtain the percentage of bad sectors corresponding to the protected file.

[0072] Step 7: Calculate the file protection value FHu of the protected file using the formula FHu=α×(TYu / ZHu); where α is a fixed error compensation coefficient, and the value of α is greater than zero;

[0073] The file analysis module feeds back the file protection value FHu of the protected file to the server, and the server sends the file protection value FHu of the protected file to the performance adaptation module;

[0074] The data acquisition module is used to collect network data and protection data of the information system and send the network data and protection data to the server. The server then sends the network data and protection data to the security analysis module.

[0075] It should be noted that network data refers to the network download and upload values ​​of the information system; protection data refers to the number of attacks on the information system per unit time and the duration of each attack.

[0076] The security analysis module is used to analyze the security performance of the information system. The analysis process is as follows:

[0077] Step S1: Obtain the network connected to the information system, set the security analysis period of the information system, and set several time points within the security analysis period;

[0078] Step S2: Obtain the network download and network upload values ​​of the network connected to the information system at each time point;

[0079] Step S3: Calculate the network download fluctuation rate and network upload fluctuation rate of the network connected to the information system within the time interval between adjacent time points. Sum the network download fluctuation rate and network upload fluctuation rate within the time interval between adjacent time points to obtain the network download fluctuation rate and network upload fluctuation rate of the network connected to the information system during the security analysis period.

[0080] Step S4: If the network download fluctuation rate is less than the preset network download fluctuation rate, then set the download network stability coefficient XWX and take the value X1;

[0081] If the network upload fluctuation rate is less than the preset network upload fluctuation rate, then set the upload network stability coefficient SWX and take the value Y1;

[0082] If the network download fluctuation rate is greater than or equal to the preset network download fluctuation rate, then set the download network stability coefficient XWX and take the value X2;

[0083] If the network upload fluctuation rate is greater than or equal to the preset network upload fluctuation rate, then set the upload network stability coefficient SWX and take the value Y2;

[0084] In practice, the values ​​of X1, X2, Y1 and Y2 are all greater than zero, and the value of X1 is greater than X2 and the value of Y1 is greater than Y2.

[0085] Step S5: Obtain the number of attacks on the information system during the security analysis period and the duration of each attack. Sum the durations of each attack to obtain the total attack duration TZG of the information system.

[0086] Step S6: Calculate the system protection value XFH of the information system using the formula XFH=XWX×a1+SWX×a2+TZG×a3; where a1, a2 and a3 are fixed weighting coefficients, and the values ​​of a1, a2 and a3 are all greater than zero.

[0087] The security analysis module feeds back the system protection value XFH of the information system to the server, and the server sends the system protection value XFH of the information system to the performance adaptation module.

[0088] The server stores preset security levels corresponding to system protection values ​​and preset security levels corresponding to file protection values.

[0089] The performance adaptation module is used to adapt the protection performance of protected files and information systems. The specific working process is as follows:

[0090] Step SS1: Obtain the file protection value FHu of the protected file and the system protection value XFH of the information system calculated above;

[0091] Step SS2: Determine the corresponding preset security level based on the file protection value and system protection value;

[0092] Step SS3: If the preset security level corresponding to the file protection value is the same as the preset security level corresponding to the system protection value, then generate a performance adaptation signal;

[0093] Step SS4: If the preset security level corresponding to the file protection value is higher than the preset security level corresponding to the system protection value, then a performance enhancement signal is generated;

[0094] Step SS5: If the preset security level corresponding to the file protection value is lower than the preset security level corresponding to the system protection value, then generate a performance adaptation signal;

[0095] The performance adaptation module feeds back a performance adaptation signal or a performance enhancement signal to the server. If the server receives a performance adaptation signal, it does not perform any operation. If the server receives a performance enhancement signal, it increases the preset security level of the information system.

[0096] A method for evaluating the security performance of an information system used in the construction of graded protection systems. During operation, users upload protection files through user terminals and send the protection files to a temporary storage module.

[0097] The file analysis module performs protection analysis on the protected files in the temporary storage module, marking the protected files as "u". A simulated server for file analysis is established within the file analysis module, running a virtual machine. The protected files in the temporary storage module are copied, and a copy is transferred to the simulated server. The copy of the protected file and the virtual machine are then stored in the same folder, and the virtual machine is started. The start time of the virtual machine is recorded. During the virtual machine's operation, real-time sector data of the copied protected file is continuously acquired until the virtual machine finishes running. The real-time sector data is then compared with the initial sector data, and the end time of the virtual machine is recorded. Subtracting the virtual machine startup time from the runtime gives the runtime TYu of the virtual machine corresponding to the protected file. If the initial sector data corresponding to the real-time sector data has not changed, no operation is performed. If the initial sector data corresponding to the real-time sector data has changed, the number of bad sectors in the changed real-time sector data is counted. The number of bad sectors is compared with the total number of sectors to obtain the proportion of bad sectors corresponding to the protected file ZHu. The file protection value FHu of the protected file is calculated using the formula FHu=α×(TYu / ZHu). The file analysis module feeds back the file protection value FHu of the protected file to the server, and the server sends the file protection value FHu of the protected file to the performance adaptation module.

[0098] The data acquisition module collects network data and protection data from the information system and sends the network data and protection data to the server. The server then sends the network data and protection data to the security analysis module.

[0099] The security performance of the information system is analyzed using a security analysis module. This involves acquiring information about the networks connected to the information system, setting a security analysis period, and defining several time points within that period. At each time point, the download and upload values ​​of the networks connected to the information system are acquired. The fluctuation rates of the download and upload speeds of the networks connected to the information system are calculated within the time interval between adjacent time points. These fluctuation rates are then summed to obtain the network download and upload speeds of the network connected to the information system during the security analysis period. If the download fluctuation rate is less than a preset value, a download network stability coefficient XWX is set and set to X1. If the upload fluctuation rate is less than a preset value... For the upload network stability coefficient, set the upload network stability coefficient SWX and take the value Y1. If the download network fluctuation rate is greater than or equal to the preset download network fluctuation rate, set the download network stability coefficient XWX and take the value X2. If the upload network fluctuation rate is greater than or equal to the preset upload network fluctuation rate, set the upload network stability coefficient SWX and take the value Y2. Obtain the number of attacks on the information system during the security analysis period and the duration of each attack. Sum the durations of each attack to obtain the total attack duration TZG of the information system. Calculate the system protection value XFH of the information system using the formula XFH=XWX×a1+SWX×a2+TZG×a3. The security analysis module feeds back the system protection value XFH of the information system to the server. The server sends the system protection value XFH of the information system to the performance adaptation module.

[0100] The server stores preset security levels corresponding to system protection values ​​and file protection values. A performance adaptation module adapts the protection performance of the protected files and the information system, obtaining the calculated file protection value FHu and system protection value XFH of the protected file. Based on these values, a corresponding preset security level is determined. If the preset security level corresponding to the file protection value is the same as the preset security level corresponding to the system protection value, a performance adaptation signal is generated. If the preset security level corresponding to the file protection value is higher than the preset security level corresponding to the system protection value, a performance enhancement signal is generated. If the preset security level corresponding to the file protection value is lower than the preset security level corresponding to the system protection value, a performance adaptation signal is generated. The performance adaptation module feeds back the performance adaptation signal or performance enhancement signal to the server. If the server receives a performance adaptation signal, it performs no operation. If the server receives a performance enhancement signal, it increases the preset security level of the information system. This invention performs security performance evaluation on the information system and the uploaded protected files, changing the fixed protection level of the information system and intelligently adjusting the security protection level of the information system based on the security protection performance of the files.

[0101] The above formulas are all dimensionless numerical calculations. The formulas are derived from software simulations using a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation. The weighting coefficient and the ratio coefficient are specific values ​​obtained by quantifying each parameter to facilitate subsequent comparisons. Regarding the weighting coefficient and the ratio coefficient, it is acceptable as long as they do not affect the proportional relationship between the parameters and the quantified values.

[0102] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A method for evaluating the security performance of an information system for classified protection construction, characterized in that, The method specifically comprises the following steps: Step S101, a user uploads a protection file to a temporary storage module through a user terminal; Step S102, a file analysis module analyzes the protection file in the temporary storage module, calculates a file protection value of the protection file according to a running time and a bad sector proportion, and sends the file protection value to a performance adaptation module; The protection analysis process of the file analysis module specifically comprises the following steps: Step one: mark the protection file as u, u = 1, 2, …, z, z is a positive integer; an analog server for file analysis is established in the file analysis module, and a virtual machine runs in the analog server; Step two: copy the protection file in the temporary storage module, and transmit the copy of the protection file to the analog server; Step three: store the copy of the protection file and the virtual machine in the same folder and start the virtual machine, and record the start time of the virtual machine; Step four: continuously acquire real-time sector data of the copy of the protection file during the running of the virtual machine, compare the real-time sector data with initial sector data when the running of the virtual machine ends, and record the end time of the virtual machine; Step five: subtract the start time of the virtual machine from the end time of the virtual machine to obtain a running time TYu of the virtual machine corresponding to the protection file; Step six: if the initial sector data corresponding to the real-time sector data has not changed, no operation is performed, and if the initial sector data corresponding to the real-time sector data has changed, count the number of bad sectors of the real-time sector data, compare the number of bad sectors with the total number of sectors to obtain a bad sector proportion ZHu of the protection file; Step seven: calculate the file protection value FHu of the protection file by the formula FHu = α × (TYu / ZHu); in the formula, α is an error compensation coefficient of a fixed value, and the value of α is greater than zero; Step S103, a data acquisition module acquires network data and protection data of an information system, and sends the network data and the protection data to a security analysis module; Step S104, the security analysis module is used to analyze the security performance of the information system, a system protection value of the information system is calculated according to a download network stability coefficient, an upload network stability coefficient and a total attack time, and the system protection value is sent to the performance adaptation module; Step S105, the performance adaptation module is used to adapt the protection performance of the protection file and the information system, a preset security level corresponding to the file protection value and the system protection value is obtained, the preset security levels are compared to generate a performance adaptation signal or a performance supplement signal, and if the performance supplement signal is generated, the preset security level of the information system is increased.

2. The method for evaluating the security performance of an information system for hierarchical protection construction according to claim 1, characterized in that, The information system comprises a server, a user terminal, a temporary storage module, a file analysis module, a performance adaptation module, a security analysis module and a data acquisition module; The user terminal is used for a user to upload a protection file, and sends the protection file to the temporary storage module, and the temporary storage module is used to temporarily store the protection file uploaded by the user terminal; The file analysis module is used for protection analysis on the protection file in the staging module, and the file protection value of the protection file obtained by the protection analysis is fed back to the server. The server sends the file protection value FHu of the protection file to the performance adaptation module; The data acquisition module is used for acquiring network data and protection data of the information system, and sending the network data and the protection data to the server. The server sends the network data and the protection data to the security analysis module; The security analysis module is used for analyzing the security performance of the information system, and feeding back the system protection value of the information system to the server. The server sends the system protection value of the information system to the performance adaptation module; The server stores preset security levels corresponding to the system protection value and preset security levels corresponding to the file protection value; The performance adaptation module is used for adapting the protection performance of the protection file and the information system, and generating a performance adaptation signal or a performance enhancement signal and feeding back to the server; If the server receives the performance adaptation signal, no operation is performed. If the server receives the performance enhancement signal, the preset security level of the information system is increased.

3. The method for evaluating the security performance of an information system for hierarchical protection construction according to claim 2, characterized in that, The network data is the network download value and the network upload value of the information system; The protection data is the number of attacks per unit time and the attack duration of each attack of the information system.

4. The method for evaluating the security performance of an information system for hierarchical protection construction according to claim 1, characterized in that, The security analysis module is used for analyzing the security performance of the information system, and the analysis process is as follows: Step S1: Obtain the network connected by the information system, set the security analysis period of the information system, and set a plurality of time points in the security analysis period; Step S2: Obtain the network download value and the network upload value of the network connected by the information system at each time point; Step S3: Calculate the network download fluctuation rate and the network upload fluctuation rate of the network connected by the information system in the time length between adjacent time points. The network download fluctuation rate and the network upload fluctuation rate in the time length between adjacent time points are added to obtain the network download fluctuation rate and the network upload fluctuation rate of the network connected by the information system in the security analysis period; If the network download fluctuation rate is less than the preset network download fluctuation rate, the download network stability coefficient XWX is set to X1; If the network upload fluctuation rate is less than the preset network upload fluctuation rate, the upload network stability coefficient SWX is set to Y1; If the network download fluctuation rate is greater than or equal to the preset network download fluctuation rate, the download network stability coefficient XWX is set to X2; If the network upload fluctuation rate is greater than or equal to the preset network upload fluctuation rate, the upload network stability coefficient SWX is set to Y2; Step S5: Obtain the number of attacks and the attack duration of each attack of the information system in the security analysis period. The attack duration of each attack is added to obtain the total attack duration TZG of the information system; Step S6: The system protection value XFH of the information system is calculated by the formula XFH=XWX×a1+SWX×a2+TZG×a3; wherein a1, a2 and a3 are weight coefficients of fixed values, and the values of a1, a2 and a3 are greater than zero.

5. The method for evaluating the security performance of an information system for hierarchical protection construction according to claim 4, characterized in that, X1, X2, Y1 and Y2 are greater than zero, and the value of X1 is greater than X2, and the value of Y1 is greater than Y2.

6. The method for evaluating the security performance of an information system for hierarchical protection construction according to claim 1, characterized in that, The working process of the performance adaptation module is specifically as follows: Step SS1: obtaining a file protection value of the protection file and a system protection value of the information system; Step SS2: obtaining a corresponding preset security level according to the file protection value and the system protection value; Step SS3: if the preset security level corresponding to the file protection value and the preset security level corresponding to the system protection value are in the same level, a performance adaptation signal is generated; Step SS4: if the preset security level corresponding to the file protection value is higher than the preset security level corresponding to the system protection value, a performance adaptation signal is generated; Step SS5: if the preset security level corresponding to the file protection value is lower than the preset security level corresponding to the system protection value, a performance adaptation signal is generated.

Images