Information security event alarm level evaluation method and system

Abstract

The application provides an information security event alarm level evaluation method and system, the method comprises the following steps: obtaining transmission data information of data in a transmission process, wherein the transmission data information comprises transmission message data and transmission content data; obtaining turning data information of data after turning, wherein the turning data information comprises turning message data and turning content data; obtaining security evaluation information according to the transmission data information and the turning data information; and obtaining a security level by processing the security evaluation information through a neural network. The information security event alarm level evaluation method and system provided in the embodiment of the application can monitor data flow and communication data on a network, accurately match network attack behaviors and other information security events by using a large number of rules, timely discover attacks and give early warnings, accurately evaluate security levels and block detection behaviors.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial information security, and particularly relates to an information security event alarm level evaluation method and system. BACKGROUND

[0002] At present, industrial control systems and informatization gradually carry out deep integration, production systems also change from closed to open, system boundaries are also increasingly blurred, open services gradually increase, and exposed interfaces are more and more, so that the security risks faced by the system are also getting bigger and bigger. Industrial control systems are increasingly becoming the target of attack, and it is becoming easier for hackers to purposefully detect and lock attack targets. In addition, more and more vulnerability mining and vulnerability publishing are aimed at industrial control systems, and a large number of industrial control system security vulnerabilities and attack methods can be spread through various public or semi-public channels such as the Internet, and are easily obtained and used by hackers and other illegal persons. In addition to the vulnerability of industrial control protocols, attacks are becoming simpler and simpler. Industrial control systems are related to the real world, and once attacked, the loss is immeasurable. The commonly used security defense system can protect from multiple levels such as network and terminal, and can block most attacks according to the strategy, but cannot detect, warn and block the attack behavior in the detection stage in time. SUMMARY

[0003] Therefore, the present application provides an information security event alarm level evaluation method and system, which solves the problem that the prior art cannot detect, warn and block the attack behavior in time outside the preset strategy range or before the attack.

[0004] To achieve the above purpose, the present application provides the following technical scheme:

[0005] In a first aspect, the present application provides an information security event alarm level evaluation method, which comprises:

[0006] Obtaining transmission data information of data in a transmission process, wherein the transmission data information comprises transmission message data and transmission content data;

[0007] Obtaining turning data information of data after turning, wherein the turning data information comprises turning message data and turning content data;

[0008] Obtaining security evaluation information according to the transmission data information and the turning data information;

[0009] Obtaining a security level by processing the security evaluation information through a neural network.

[0010] The information security event alarm level evaluation method provided by the embodiment of the application can achieve the purpose of discovering attacks and giving early warnings in time, accurately evaluating security levels and blocking detection behaviors by monitoring data flow and communication data on a network, and precisely matching network attack behaviors and other information security events by using massive rules.

[0011] Optionally, the turning data information includes:

[0012] The turning data information is data information generated in the process of transmitting data from the sending end to the forwarding end;

[0013] The turning-receiving data information is data information generated in the process of transmitting data from the turning end to the receiving end.

[0014] The data in the transmission process is classified in detail, so that the transmission data can be processed more accurately, and the accuracy of the security event evaluation alarm is ensured.

[0015] Optionally, the security evaluation information includes:

[0016] The message judgment vector is obtained based on the transmission message data and the turning message data by using a binary tree data structure analysis;

[0017] The time security value is obtained based on the transmission message data and the turning message data, and the time security value is 1, indicating that the time elapsed in the transmission process is a safe time, and the time security value is 0, indicating that the time elapsed in the transmission process is an unsafe time;

[0018] The content similarity data is obtained based on the transmission data information and the turning data information, and includes a length similarity value and a content similarity value.

[0019] The security event is evaluated by the message judgment vector, the event security value and the content similarity data, the characteristics of the security event are more objectively and accurately reflected, subsequent processing and classification are facilitated, and the alarm is accurately evaluated.

[0020] Optionally, the acquisition process of the message judgment vector is as follows:

[0021] The root node and the header field length specified by the preset protocol specification standard are obtained, wherein the root node represents each header code fragment;

[0022] The header field length is used as the number of layers of the binary tree, and 1 and 0 are used as the values of the left child and the right child in the binary tree node, respectively, to construct the message judgment binary tree;

[0023] The plurality of split turning message data and the plurality of split transmission message data are input into the message judgment binary tree to obtain a plurality of judgment results, wherein if the split turning message data is equal to the split transmission message data, the judgment result is 1, and if the split turning message data is not equal to the split transmission message data, the judgment result is 0.

[0024] All the split turning message data and all the split transmission message data are input into the message judgment binary tree to obtain all the judgment results, and all the judgment results are sequentially constructed into a vector to obtain a message judgment vector.

[0025] By constructing the judgment binary tree, the values in the security information are input into the judgment binary tree for comparison, and a plurality of judgment values are obtained by repeatedly inputting the data, so as to judge whether the data is appropriate and save storage space.

[0026] Optionally, the obtaining process of the time security value comprises:

[0027] The data transmission distance and the transmission time are obtained, and the transmission rate is obtained by dividing the transmission distance by the transmission time.

[0028] The data turning distance and the turning time are obtained, and the turning rate is obtained by dividing the turning distance by the turning time.

[0029] The transmission entropy value is obtained by dividing the turning rate by the transmission rate, and the size of the transmission entropy value and the preset time threshold value is compared, wherein if the transmission entropy value is less than the preset time threshold value, the time security value is set to 1, and if the transmission entropy value is greater than the preset time threshold value, the time security value is set to 0.

[0030] In actual application, the data transmission rate of the same length is close, but the forwarding rate and the transmission rate are quite different, which may cause the data to be intercepted and stolen or the address to be changed to transmit other data. By calculating the quotient of the turning rate and the transmission rate to obtain the transmission entropy value, comparing the transmission entropy value with the preset time threshold value to obtain the time security value, the judgment of whether the event is safe is more accurate.

[0031] Optionally, the obtaining process of the content similar data comprises:

[0032] The lengths of all data with FIN value of 1 in the turning message data and the transmission message data are added respectively to obtain the lengths of complete turning content data and complete transmission content data respectively, wherein if the length of complete turning content data is equal to the length of complete transmission content data, the length similar value is set to 1, and if the length of complete turning content data is not equal to the length of complete transmission content data, the length similar value is set to 0.

[0033] All data with FIN value of 1 in the turning message data form a complete turning content data set, and all data with FIN value of 1 in the transmission message data form a complete transmission content data set.

[0034] The data in the complete turning content data set and the data in the complete transmission content data set are compared, if the data are similar, the number of similar data is added by 1, until all data are compared, and the similar length of the data is obtained;

[0035] The similar length is divided by the length of the complete turning content data, and the content similarity value is obtained, the content similarity value of 1 indicates that the transmission content data are the same, and the content similarity value of 0 indicates that the transmission content data are different.

[0036] Since the data may be replaced during the data transmission process, the content of the transmission data is compared, and since the data may be encrypted, the similarity of the data is compared, and the accuracy of the comparison is ensured.

[0037] Optionally, the process of obtaining the security level by processing the security assessment information through the preset neural network comprises:

[0038] The size relationship between the content similarity value and the preset first similarity threshold, the second similarity threshold and the third similarity threshold is compared, and a content similarity vector is obtained, the length of the content similarity vector is 3;

[0039] If the third vector value in the content similarity vector is 1, the content security event value is set to 1, and if the third vector value in the content similarity vector is 0, the content security event value is set to 0;

[0040] The value of the message judgment vector, the time security value, the content length similarity value and the security event value are added to obtain the number of security events;

[0041] The message judgment vector, the time security value and the content similarity data are input into the first neural network to obtain a first security level vector;

[0042] The first security level vector and the number of security events are input into the second neural network to adjust the security level, and a second security level vector is obtained, wherein the maximum vector value in the second security level vector is the final evaluated security level.

[0043] The information security event alarm level evaluation method provided by the application uses the calculated value of the message judgment vector, the time security value, the content length similarity value and the security event value, and the importance of the number of time security is deepened through twice neural network prediction and adjustment, and the security level is more accurately judged.

[0044] In the second aspect, the embodiments of the application provide an information security event alarm level evaluation system, comprising:

[0045] The transmission acquisition module is configured to acquire transmission data information of data in a transmission process, wherein the transmission data information comprises transmission message data and transmission content data.

[0046] The turning acquisition module is configured to acquire turning data information of data after turning, wherein the turning data information comprises turning message data and turning content data.

[0047] The data analysis module is configured to obtain security evaluation information according to the transmission data information and the turning data information.

[0048] The security evaluation module is configured to obtain a security level by processing the security evaluation information through a preset neural network.

[0049] The information security event alarm level evaluation system provided by the embodiment of the present application can achieve the purpose of discovering attacks and giving early warnings in time, accurately evaluating security levels and blocking detection behaviors by monitoring data flow and communication data on a network, and precisely matching network attack behaviors and other information security events by using massive rules.

[0050] In a third aspect, the embodiment of the present application provides a computer device, including a memory and a processor, which are in communication connection with each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the method in the first aspect or any optional implementation manner of the first aspect.

[0051] In a fourth aspect, the embodiment of the present application provides a computer readable storage medium, which stores computer instructions, and the computer instructions are used to make the computer execute the method in the first aspect or any optional implementation manner of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0052] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings needed to be used in the specific embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0053] Figure 1 The flow chart of the information security event alarm level evaluation method provided by the embodiment of the present application;

[0054] Figure 2 The structure diagram of the message judgment binary tree in the information security event alarm level evaluation method provided by the embodiment of the present application;

[0055] Figure 3 A structure schematic diagram of a neural network in an information security event alarm level evaluation method provided by an embodiment of the present application is shown in the figure.

[0056] Figure 4 A structure schematic diagram of an information security event alarm level evaluation system provided by an embodiment of the present application is shown in the figure.

[0057] Figure 5 A structure schematic diagram of a computer device provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0058] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in connection with the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0059] In the description of the present application, it should be noted that the orientations or positional relationships indicated by the terms “center”, “upper”, “lower”, “left”, “right”, “vertical”, “horizontal”, “inner”, “outer” and the like are based on the orientations or positional relationships shown in the drawings, and are only for the convenience of describing the present application and simplifying the description, and therefore cannot be understood as indicating or implying that the devices or elements referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation on the present application. In addition, the terms “first”, “second”, “third” are only for the purpose of description, and cannot be understood as indicating or implying relative importance.

[0060] In the description of the present application, it should be noted that, unless otherwise explicitly specified and limited, the terms “mounting”, “connection”, “connecting” should be understood in a broad sense, for example, can be fixed connection, can also be detachable connection, or integrally connected; can be mechanical connection, can also be electrical connection; can be directly connected, can also be indirectly connected through an intermediate medium; can be the communication between two elements inside, can be wireless connection, or wired connection. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0061] The technical features involved in the different embodiments of the present application described below can be combined with each other as long as there is no conflict between them.

[0062] The embodiments of the present application provide an information security event alarm level evaluation method, as shown in the figure, the method specifically includes the following steps: Figure 1

[0063] ​Step S1: obtaining transmission data information of the data in the transmission process, the transmission data information including transmission message data and transmission content data. Exemplarily, the transmission message data represents the packaging data of multiple protocols in the transmission process, such as IP address and port number in the TCP / IP protocol.

[0064] Step S2: obtaining turning data information of the data after turning, the turning data information including turning message data and turning content data. Exemplarily, the turning message data includes transmission-turning message data and transmission-receiving message data, and the turning content data includes transmission-turning content data and transmission-receiving content data. The turning message data represents the packaging data of multiple protocols in the turning transmission process, and the transmission-turning message data needs to be transmitted from the forwarding end to the receiving end for the evaluation of the information security event alarm level.

[0065] Specifically, in an embodiment, the turning data information includes: transmission-turning data information, data information generated in the process of transmitting the data from the sending end to the forwarding end, including transmission-turning message data and transmission-turning content data; and transmission-receiving data information, data information generated in the process of transmitting the data from the turning end to the receiving end, including transmission-receiving message data and transmission-receiving content data. Exemplarily, the sending end represents a terminal device that sends data, the receiving end represents a terminal device that receives data, and the turning end is a terminal device that receives the data from the sending end and sends the data to the receiving end. Since the length of the data affects the transmission time, and the transmission time is too long, the data may be intercepted and stolen due to some operations, or other data may be transmitted due to the change of the address. Therefore, the transmission-turning content data is transmitted first to ensure that the data length is the same, so as to judge the transmission time, and then the transmission-turning message data is transmitted to judge whether there is a security problem in the process of transmitting the data from the sending end to the forwarding end. The data in the transmission process is classified in detail, which facilitates more accurate processing of the transmission data and ensures the accuracy of the security event evaluation alarm.

[0066] Step S3: obtaining security evaluation information according to the transmission data information and the turning data information. The security event is evaluated through the message judgment vector, the event security value and the content similar data, which more objectively and accurately reflects the characteristics of the security event, facilitates subsequent processing and classification, and accurately evaluates the alarm.

[0067] Specifically, in an embodiment, the security evaluation information includes:

[0068] The message judgment vector is obtained based on the transmission message data and the turning message data by using the binary tree data structure. Specifically, in a specific embodiment, the obtaining process of the message judgment vector is as follows:

[0069] Step S311: obtaining a root node and a header field length specified by a preset protocol specification standard, wherein the root node represents each header code segment.

[0070] Step S312: Constructing a packet judgment binary tree with the header field length as the number of layers of the binary tree, and 1 and 0 as the values of the left child and the right child in the binary tree node, respectively, as shown in Figure 2

[0071] Step S313: Obtaining a plurality of split turning packet data and a plurality of split transmission packet data, and inputting them into the packet judgment binary tree to obtain a plurality of judgment results. If the split turning packet data is equal to the split transmission packet data, the judgment result is 1; if the split turning packet data is not equal to the split transmission packet data, the judgment result is 0. Exemplarily, the split turning packet data is the packet data of the transmission data after the turning content data is split, and the split transmission packet data is the packet data of the transmission data after the transmission content data is split.

[0072] Step S314: Inputting all split turning packet data and all split transmission packet data into the packet judgment binary tree to obtain all judgment results, and constructing a vector in order from all judgment results to obtain a packet judgment vector.

[0073] Exemplarily, the judgment method of the discrimination binary tree is exemplarily illustrated by taking IP address and port number as examples, but is not limited thereto. The IP address in the data information is compared with the IP address when the request is sent to obtain an IP address judgment value (the judgment rule is: if the IP address in the data information is the same as the IP address when the request is sent, the IP address judgment value is 1; if the IP address in the data information is different from the IP address when the request is sent, the IP address judgment value is 0), and the judgment method of the port number judgment value is the same as that of the IP address judgment value. By constructing the judgment binary tree, the value in the security information is inputted into the judgment binary tree for comparison and judgment. Since the protocol stipulates that the packet field is fixed, the header of all split data adopts a fixed format tree that can be judged, so only one judgment tree needs to be established, and multiple judgment values are obtained by repeatedly inputting data, so as to judge whether the data is appropriate, thereby saving storage space.

[0074] The time security value is obtained based on the transmission packet data and the turning packet data. The time security value is 1, indicating that the time elapsed in the transmission process is a safe time, and the time security value is 0, indicating that the time elapsed in the transmission process is an unsafe time. Specifically, in a specific embodiment, the process of obtaining the time security value includes:

[0075] Step S321: Obtaining the data transmission distance and the transmission time, and dividing the transmission distance by the transmission time to obtain the transmission rate. Exemplarily, the transmission distance is from the sending end to the receiving end, and the transmission time is obtained from the transmission packet data.

[0076] ​Step S322: Obtain the data turning distance and the turning time, and divide the turning distance by the turning time to obtain the turning rate; for example, the turning distance is the sum of the distance from the sending end to the turning end and the distance from the turning end to the receiving end, and the turning time is obtained from the turning message data, and the hardware conditions of data transmission are the same as those in the process of obtaining the data transmission distance and the transmission time.

[0077] Step S323: Divide the turning rate by the transmission rate to obtain the transmission entropy value, compare the transmission entropy value with the preset time threshold value, if the transmission entropy value is less than the preset time threshold value, set the time safety value as 1, indicating that the data in this period of time is safe, if the transmission entropy value is greater than the preset time threshold value, set the time safety value as 0, indicating that the data in this period of time is not safe, in the embodiment, the preset time threshold value is 20kbps, but it is not limited thereto. In actual application, the data transmission rates of the same length are close, but the forwarding rate and the transmission rate are quite different, which may cause the data to be intercepted and stolen or the address to be changed to cause other data to be transmitted, the transmission entropy value is obtained by dividing the turning rate by the transmission rate, the transmission entropy value is compared with the preset time threshold value to obtain the time safety value, and thus it is more accurate to judge whether the event is safe.

[0078] The content similar data is obtained based on the transmission data information and the turning data information, and includes a length similar value and a content similar value. Specifically, in a specific embodiment, the process of obtaining the content similar data includes:

[0079] Step S331: Add the lengths of all data with the FIN value of 1 in the turning message data and the transmission message data respectively to obtain the length of the complete turning content data and the length of the complete transmission content data respectively, if the length of the complete turning content data is equal to the length of the complete transmission content data, set the length similar value as 1, if the length of the complete turning content data is not equal to the length of the complete transmission content data, set the length similar value as 0;

[0080] Step S332: All data with the FIN value of 1 in the turning message data form a complete turning content data set, and all data with the FIN value of 1 in the transmission message data form a complete transmission content data set;

[0081] Step S333: Perform similarity judgment on the data in the complete turning content data set and the data in the complete transmission content data set, if the data are similar, increase the similar data number by 1, until all data are judged, and the similar length of the data is obtained;

[0082] Step S334: dividing the similar length by the length of the complete turning content data to obtain a content similarity value, wherein the content similarity value of 1 indicates that the transmitted content data is the same, and the content similarity value of 0 indicates that the transmitted content data is different. Exemplarily, the content similarity data includes the length similarity value and the content similarity value. Since the data may be replaced during the data transmission process, the content of the transmitted data is judged, and since the data may be encrypted, the similarity of the data is judged, and such a judgment method ensures the accuracy of the judgment.

[0083] Step S4: obtaining the security level by processing the security evaluation information through the neural network. Specifically, in an embodiment, the process of obtaining the security level by processing the security evaluation information through the preset neural network includes:

[0084] Step S411: comparing the content similarity value with the size relationship between the preset first similarity threshold, the second similarity threshold and the third similarity threshold to obtain a content similarity vector, wherein the length of the content similarity vector is 3. Exemplarily, the content similarity value is compared in size with the three similarity thresholds two by two, if the content similarity value is less than the first similarity threshold, the first vector in the content similarity vector is set to 1, if the content similarity value is not less than the first similarity threshold and not greater than the second similarity threshold, the first vector in the content similarity vector is set to 0; if the content similarity value is greater than the first similarity threshold and less than the second similarity threshold, the second vector in the content similarity vector is set to 1, if the content similarity value is less than the first similarity threshold or greater than the second similarity threshold, the second vector in the content similarity vector is set to 0; if the content similarity value is greater than the second similarity threshold and less than the third similarity threshold, the third vector in the content similarity vector is set to 1, if the content similarity value is less than the second similarity threshold or greater than the third similarity threshold, the third vector in the content similarity vector is set to 0. In the embodiment, the first similarity threshold is 0.3, the second similarity threshold is 0.7, and the third similarity threshold is 1.0, which is only an example, but not limited thereto. Since the data may be replaced during the data transmission process, it is necessary to judge the content of the transmitted data, and since the data may be encrypted during the data transmission process, it is necessary to judge the similarity of the data.

[0085] Step S412: if the third vector value in the content similarity vector is 1, the content security event value is set to 1, if the third vector value in the content similarity vector is 0, the content security event value is set to 0. The third vector value in the content similarity vector represents the content security event value.

[0086] Step S413: adding the value of the message judgment vector, the time security value, the content length similarity value and the security event value to obtain the number of security events.

[0087] Step S414: input the packet judgment vector, time security value and content similarity data into the first neural network to obtain a first security level vector. Exemplarily, the first neural network is a trained neural network, and the structure is as shown in Figure 3 The actual situation is complex and diverse, and sometimes it is impossible to mark each one. The neural network is trained using the marked security level to achieve the purpose of predicting the unmarked security level. When performing security detection, "1" and "0" are used to represent whether a security event occurs in the data transmission process. Only the security level needs to be judged, and the specific situation of the security event does not need to be judged. Therefore, "1" and "0" can reduce the case that different data types in different events have too large differences in neural network prediction, so that the neural network calculation is more accurate and fast.

[0088] Step S415: inputting the first security level vector and the event security number into the second neural network, adjusting the security level, and obtaining a second security level vector, wherein the maximum vector value in the second security level vector is the final evaluated security level. Illustratively, when the second neural network is trained, the first security level vector and the event security number are input into the second neural network, the second neural network parameters are adjusted through a loss value, the first security level vector predicted by the first neural network is backward propagated to train the first neural network, the first security level vector predicted by the first neural network is input into the trained second neural network to obtain a predicted second security level vector, and the first neural network is backward propagated to train. The information security event alarm level evaluation method provided by the present application uses the calculated message judgment vector value, time security value, content length similarity value and security event value, and uses the predicted value to update to obtain more accurate data, but different situations may produce the same security level prediction, the event security number is added, which is fused with other data to judge the predicted security level, and the importance of the time security number is deepened through two times of neural network prediction and adjustment, and the security level is more accurately judged. Because the second data is less, the second neural network can be more simply and quickly obtained after accurate adjustment during training, the first neural network for predicting the first security level vector is more accurately obtained through backward adjustment of the first neural network by using the trained second neural network. In a specific embodiment, the industrial control intrusion detection system is deployed in a bypass mode at a key node of a network, does not occupy network bandwidth resources, and provides comprehensive functions such as industrial control protocol deep analysis, high-risk instruction detection, common attack behavior detection, log auditing and the like, adopts a high-performance and high-stability multi-core hardware architecture, and provides efficient and stable security protection for users. The event is analyzed and detected to determine whether there is a possibility of intrusion, attack behavior and the like, and whether the judgment data of each layer of protocol is correct needs to be determined during judgment. The method of constructing a third-party forwarder is adopted to compare the messages and contents in the existing forwarder and the directly transmitted data, determine whether the transmission is safe and determine the security level, and compare the binary tree to determine the data that should be equal in the header, for example, whether the virus data is transmitted by determining whether the IP address and the port number change, whether the data is intercepted by determining whether the transmission rate changes, and whether the data is replaced by determining the content data.

[0089] The information security event alarm level evaluation method provided by the embodiment of the present application can accurately match network attack behaviors and other information security events by monitoring data streams and communication data on a network, so as to timely discover attacks and give early warnings, accurately evaluate security levels and block detection behaviors.

[0090] The embodiment of the present application provides an information security event alarm level evaluation system, like Figure 4As shown, comprising:

[0091] The transmission acquisition module 1 is configured to acquire transmission data information of the data in the transmission process, and the transmission data information comprises transmission message data and transmission content data.

[0092] The turning acquisition module 2 is configured to acquire turning data information of the data after the turning, and the turning data information comprises turning message data and turning content data.

[0093] The data analysis module 3 is configured to obtain security evaluation information according to the transmission data information and the turning data information.

[0094] The security evaluation module 4 is configured to obtain a security level by processing the security evaluation information through a preset neural network.

[0095] The information security event alarm level evaluation system provided by the embodiment of the application can achieve the purpose of discovering attacks and giving early warnings in time, accurately evaluating security levels and blocking detection behaviors by monitoring data flow and communication data on a network, and precisely matching network attack behaviors and other information security events by using massive rules.

[0096] Figure 5 The structure schematic diagram of the computer device in the embodiment of the application is shown, comprising: a processor 901 and a memory 902, wherein the processor 901 and the memory 902 can be connected through a bus or other manners, Figure 5 For example, the bus connection.

[0097] The processor 901 can be a central processing unit (CPU). The processor 901 can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above-mentioned chips or the combinations of the above-mentioned chips.

[0098] The memory 902, as a non-transitory computer readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the methods in the above method embodiments. The processor 901 performs various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory 902, that is, implements the methods in the above method embodiments.

[0099] The memory 902 can include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application program required by a function; and the data storage area can store data created by the processor 901 and the like. In addition, the memory 902 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory 902 can optionally include a memory disposed remotely with respect to the processor 901, and these remote memories can be connected to the processor 901 through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0100] One or more modules are stored in the memory 902, and when executed by the processor 901, the methods in the above method embodiments are performed.

[0101] The above computer device specific details can be understood in correspondence with the relevant description and effects of the corresponding method embodiments, which will not be described here.

[0102] Those skilled in the art can understand that all or part of the processes in the above method embodiments can be completed by a computer program instructing related hardware, and the implemented program can be stored in a computer readable storage medium. When the program is executed, it can include the processes of the above method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid state drive (SSD), etc. The storage medium can also include a combination of the above types of memories.

[0103] Although the embodiments of the present application are described in conjunction with the accompanying drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes fall within the scope defined by the appended claims.

Claims

1. A method for assessing the alarm level of an information security incident, characterized in that, include: Acquire the transmission data information during the data transmission process, wherein the transmission data information includes transmission message data and transmission content data; The transition data information transmitted after the data has undergone a transition is obtained, and the transition data information includes: transition message data and transition content data; Security assessment information is obtained based on the transmitted data information and the transition data information. This security assessment information includes: a message judgment vector, obtained by analyzing the transmitted message data and the transition message data using a binary tree data structure; a time security value, obtained based on the transmitted message data and the transition message data, where a time security value of 1 indicates that the elapsed time of the transmission process is safe, and a time security value of 0 indicates that the elapsed time of the transmission process is insecure; and content similarity data, obtained based on the transmitted data information and the transition data information, including length similarity values ​​and content similarity values. The process of obtaining the time security value includes: obtaining the data transmission distance and transmission time, and dividing the transmission distance by the transmission time to obtain the transmission rate; obtaining the data transition distance and transition time, and dividing the transition distance by the transition time to obtain the transition rate; dividing the transition rate by the transmission rate to obtain the transmission entropy value, and comparing the transmission entropy value with a preset time threshold. If the transmission entropy value is less than the preset time threshold, the time security value is set to 1; if the transmission entropy value is greater than the preset time threshold, the time security value is set to 0. The security assessment information is processed through a neural network to obtain the security level.

2. The information security incident alarm level assessment method according to claim 1, characterized in that, The transition data information includes: Data information is transmitted from the sending end to the forwarding end. Data information is the information generated during the transmission of data from the transfer point to the receiving point.

3. The information security incident alarm level assessment method according to claim 1, characterized in that, The process of obtaining the message judgment vector is as follows: Get the root node and the length of the header fields specified by the default protocol specification standard, where the root node represents each header code segment; The length of the header field is used as the level of the binary tree, and 1 and 0 are used as the values ​​of the left and right children of the binary tree nodes, respectively, to construct a message judgment binary tree; Multiple segmented transition message data and multiple segmented transmission message data are obtained and input into the message judgment binary tree to obtain multiple judgment results. If the segmented transition message data is equal to the segmented transmission message data, the judgment result is 1; if the segmented transition message data is not equal to the segmented transmission message data, the judgment result is 0. Input all segmented transition message data and all segmented transmission message data into the message judgment binary tree to obtain all judgment results. Construct all judgment results into a vector in order to obtain the message judgment vector.

4. The information security incident alarm level assessment method according to claim 1, characterized in that, The process of obtaining the content similarity data includes: Add the lengths of all data with a FIN value of 1 in the transition message data and the transmission message data respectively to obtain the length of the complete transition content data and the length of the complete transmission content data. If the length of the complete transition content data is equal to the length of the complete transmission content data, the length similarity value is set to 1. If the length of the complete transition content data is not equal to the length of the complete transmission content data, the length similarity value is set to 0. In the transition message data, all data with a FIN value of 1 constitute a complete transition content data set; in the transmission message data, all data with a FIN value of 1 constitute a complete transmission content data set. The data in the complete transition content data set and the data in the complete transmission content data set are compared for similarity. If the data are similar, the number of similar data is incremented by 1 until all data is compared, and the similarity length of the data is obtained. Divide the similarity length by the length of the complete transition content data to obtain the content similarity value. A content similarity value of 1 indicates that the transmitted content data is the same, and a content similarity value of 0 indicates that the transmitted content data is different.

5. The information security incident alarm level assessment method according to any one of claims 3-4, characterized in that, The process of processing the security assessment information through a preset neural network to obtain the security level includes: The content similarity value is compared with preset first similarity threshold, second similarity threshold, and third similarity threshold to obtain a content similarity vector. The content similarity vector has a length of 3. If the content similarity value is less than the first similarity threshold, the first vector in the content similarity vector is set to 1. If the content similarity value is not less than the first similarity threshold and not greater than the second similarity threshold, the first vector in the content similarity vector is set to 0. If the content similarity value is greater than the first similarity threshold and less than the second similarity threshold, the second vector in the content similarity vector is set to 1. If the content similarity value is less than the first similarity threshold or greater than the second similarity threshold, the second vector in the content similarity vector is set to 0. If the content similarity value is greater than the second similarity threshold and less than the third similarity threshold, the third vector in the content similarity vector is set to 1. If the content similarity value is less than the second similarity threshold or greater than the third similarity threshold, the third vector in the content similarity vector is set to 0. If the value of the third vector in the content similarity vector is 1, the content security event value is set to 1; if the value of the third vector in the content similarity vector is 0, the content security event value is set to 0. The number of security events is obtained by adding the values ​​of the message judgment vector, time security value, content length similarity value, and security event value. The message judgment vector, time security value, and content similarity data are input into the first neural network to obtain the first security level vector. The first security level vector and the number of security events are input into the second neural network to adjust the security level and obtain the second security level vector. The largest vector value in the second security level vector is the final security level.

6. An information security incident alarm level assessment system, characterized in that, include: The transmission acquisition module is used to acquire transmission data information during the transmission process, the transmission data information including transmission message data and transmission content data; The transition acquisition module is used to acquire the transition data information transmitted after the data has undergone a transition. The transition data information includes: transition message data and transition content data. The data analysis module is used to obtain security assessment information based on the transmitted data information and the transition data information. The security assessment information includes: a message judgment vector, obtained by analyzing the transmitted message data and the transition message data using a binary tree data structure; a time security value, obtained based on the transmitted message data and the transition message data, where a time security value of 1 indicates that the elapsed time of the transmission process is a safe time, and a time security value of 0 indicates that the elapsed time of the transmission process is an unsafe time; and content similarity data, obtained based on the transmitted data information and the transition data information, including length similarity value and content similarity value. The process of obtaining the time security value includes: obtaining the data transmission distance and transmission time, and dividing the transmission distance by the transmission time to obtain the transmission rate; obtaining the data transition distance and transition time, and dividing the transition distance by the transition time to obtain the transition rate; dividing the transition rate by the transmission rate to obtain the transmission entropy value, and comparing the transmission entropy value with a preset time threshold. If the transmission entropy value is less than the preset time threshold, the time security value is set to 1; if the transmission entropy value is greater than the preset time threshold, the time security value is set to 0. The security assessment module is used to process the security assessment information through a preset neural network to obtain the security level.

7. A computer device, characterized in that, include: A memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, the processor executing the computer instructions to perform the method of any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the method as described in any one of claims 1-5.

Images