A kernel-based hardening test method for protecting server data

Abstract

The present invention relates to the field of reinforcement testing technology, and in particular to a reinforcement testing method based on kernel protection server data. The method comprises the following steps: performing flow state analysis according to kernel log files to generate comprehensive abnormal flow data; performing attack load design based on comprehensive abnormal flow data to generate attack load data; performing threat utilization probability analysis on threat intelligence data to generate threat utilization probability data; formulating reinforcement strategies based on attack load data and threat utilization probability data to generate reinforcement strategy data; performing repair necessity assessment according to comprehensive load attack reports and reinforcement strategy data to generate repair necessity scores; transmitting reinforcement strategy data and repair necessity scores to a terminal to generate a reinforcement test report. The present invention obtains threat intelligence data, designs attack loads to perform simulated attacks, so as to achieve early perception of vulnerability threats and improve the accuracy of reinforcement testing.

Description

Technical Field

[0001] The present invention relates to the technical field of reinforcement testing, and in particular to a reinforcement testing method based on kernel protection of server data. Background Art

[0002] The server kernel is the core part of the operating system, responsible for managing hardware resources and performing key operations. Therefore, the data stored in the kernel is usually the most sensitive, including access control lists, user credentials, encryption keys, etc. Once the kernel is attacked or leaked, the security of the entire system will be threatened. The kernel protection test method can ensure the comprehensive security of the system. By ensuring the security of the kernel, the attack surface of the system can be reduced. However, the traditional hardening test method based on kernel protection server data mainly focuses on known vulnerabilities or lacks real-time performance, resulting in inaccurate hardening test results and false negative results. Summary of the invention

[0003] Based on this, it is necessary to provide a hardening test method for protecting server data based on the kernel to solve at least one of the above technical problems.

[0004] To achieve the above purpose, a hardening test method based on kernel protection server data is provided, the method comprising the following steps:

[0005] Step S1: Obtain a kernel log file; perform traffic status analysis based on the kernel log file to generate comprehensive abnormal traffic data; perform attack payload design based on the comprehensive abnormal traffic data to generate attack payload data;

[0006] Step S2: Acquire threat intelligence data; perform data clustering on the threat intelligence data to generate high-confidence data and low-confidence data; perform confidence correction on the high-confidence data and the low-confidence data to generate high-confidence corrected data and low-confidence corrected data;

[0007] Step S3: constructing a potential threat model based on the high-confidence correction data and the low-confidence correction data; performing threat exploitation probability analysis through the potential threat model to generate threat exploitation probability data;

[0008] Step S4: Perform attack simulation based on the attack load data and threat utilization probability data to generate a comprehensive load attack report; formulate a reinforcement strategy based on the comprehensive load attack report to generate reinforcement strategy data;

[0009] Step S5: Perform a repair necessity assessment based on the comprehensive load attack report and the reinforcement strategy data to generate a repair necessity score; transmit the reinforcement strategy data and the repair necessity score to the terminal to generate a reinforcement test report.

[0010] The present invention can gain in-depth understanding of the operating status and potential problems of the system by obtaining kernel log files. Analyzing the traffic state in the kernel log file helps detect abnormal activities, such as network attacks, abnormal access, etc. It helps to detect potential threats early and reduce the attack surface. The results of the traffic state analysis are summarized into comprehensive abnormal traffic data, providing a comprehensive view of the security status of the system. By analyzing the abnormal traffic data, a specific attack payload can be designed to simulate potential attack scenarios. It helps to test the vulnerability of the system and prepare defense strategies. Threat intelligence data is obtained to better understand the current threat situation, including known attack patterns and attackers' behaviors. Clustering threat intelligence data can help classify data into high confidence and low confidence, so that security professionals can focus more on processing the most threatening information. By correcting the data for confidence, the accuracy and credibility of the data can be improved, and the most important information can be further screened out. Combining high confidence corrected data with low confidence corrected data can build a potential threat model for predicting possible threat situations. Generating threat utilization probability data helps to assess the potential impact of threats. This helps system administrators understand which threats are more risky so that more targeted measures can be taken. Attack simulation is performed through attack payload data and threat exploitation probability data to evaluate the system's ability to resist various attacks. It helps to reveal potential weaknesses. Reinforcement strategies are formulated based on attack reports, which help improve the security of the system. For example, they include repairing known vulnerabilities, strengthening access control and other security measures. By evaluating attack reports and reinforcement strategy data, it can be determined which problems need to be urgently resolved to improve the security of the system. The reinforcement test report provides comprehensive information about the security of the system, including vulnerabilities, repair strategies, repair necessity scores, etc. It helps to understand the security status of the system. Therefore, the reinforcement test method based on kernel protection server data of the present invention constructs a potential threat model through threat intelligence data to timely discover hidden vulnerabilities and weaknesses. By designing attack payloads to simulate attacks, the possibility of hidden vulnerabilities being exploited is determined to improve the accuracy of reinforcement testing.

[0011] Preferably, step S1 comprises the following steps:

[0012] Step S11: Obtain kernel log file;

[0013] Step S12: Analyze the traffic status according to the kernel log file to generate normal traffic data and abnormal traffic data;

[0014] Step S13: tracing the source of normal traffic data to generate hidden abnormal traffic data;

[0015] Step S14: supplementing the abnormal traffic data with the hidden abnormal traffic data to generate comprehensive abnormal traffic data;

[0016] Step S15: Design an attack load based on the comprehensive abnormal traffic data to generate attack load data.

[0017] The present invention obtains the kernel log file, which is a record of system activities and events and an important data source for evaluating system health and security. By analyzing the flow status of the kernel log file, normal and abnormal network traffic can be distinguished. This helps to discover potential attacks, faults or system anomalies. Tracing the source of normal traffic data can reveal hidden abnormal traffic, that is, those abnormal situations that cannot be immediately identified. It helps to understand the potential risks in the system more comprehensively. Combined with the hidden abnormal traffic data, the identified abnormal traffic is further supplemented and analyzed to generate more comprehensive comprehensive abnormal traffic data. It helps to describe the abnormal situation of the system more accurately. Based on the comprehensive abnormal traffic data, various attack payload data are designed. It provides an important basis for simulating potential attacks and helps to test the weaknesses and security of the system.

[0018] Preferably, step S13 comprises the following steps:

[0019] Step S131: extracting the number of visits from normal traffic data to generate the number of visits data;

[0020] Step S132: designing data labels for the access number data based on a preset access number threshold, generating low access label data when the access number data is less than or equal to the preset access number threshold; generating high access label data when the access number data is greater than the preset access number threshold;

[0021] Step S133: tracing the source of normal traffic data according to the low-access tag data to generate low-access traffic tracing data;

[0022] Step S134: Analyze the low-visit traffic source tracing data to generate low-imitation abnormal traffic data;

[0023] Step S135: Analyze the access habits of normal traffic data according to the high-access tag data to generate special access habit data;

[0024] Step S136: Integrate the low-simulation abnormal traffic data with the special access habit data to generate hidden abnormal traffic data.

[0025] The present invention can help identify which resources have received how much attention by extracting the number of visits information from normal traffic, which helps to understand the behavior of users or systems. Label design based on access number data helps to classify traffic into different categories, such as low access and high access, making subsequent analysis and processing easier. Tracing the source based on low-access label data can reveal the source of low-access traffic and help determine which resources or users may be overlooked or have problems. By analyzing the low-access traffic tracing data, anomalies in the low-access data can be detected, which helps to detect potential problems or threats early. Analyzing high-access label data can help understand special access habits, identify whether there are unusual behavior patterns, and help detect abuse or anomalies. Integrating low-imitation abnormal traffic data with special access habit data helps to create comprehensive abnormal traffic data, which may contain abnormal behavior hidden in normal traffic, and helps to identify more comprehensive risks.

[0026] Preferably, step S134 includes the following steps:

[0027] Step S1341: Perform IP address statistics according to the kernel log file to generate IP address distribution data;

[0028] Step S1342: using the IP address distribution data to classify the low-visit traffic source tracing data, and generating low-visit area address data and high-visit area address data;

[0029] Step S1343: performing communication behavior analysis on the low-imitation area address data to generate low-imitation area abnormal data;

[0030] Step S1344: extracting request information based on the high-imitation regional address data to generate request information data;

[0031] Step S1345: Calculate the reasonable value of the request information data using the request reasonableness calculation formula to generate a request reasonableness score;

[0032] Step S1346: performing abnormal access analysis on the address data of the high-visited areas by requesting rationality scores, and generating abnormal data of the high-imitation areas;

[0033] Step S1347: Fusing the abnormal data in the low-simulation area with the abnormal data in the high-simulation area to generate comprehensive abnormal traffic data.

[0034] The present invention uses kernel log files to perform IP address statistics, which helps to understand the distribution of IP addresses in network traffic, helps to determine which IP addresses generate most of the traffic, and thus helps to identify potential sources of problems. Using IP address distribution data to classify low-access traffic tracing data, and dividing traffic data into low-access area addresses and high-access area addresses, helps to focus traffic on specific areas. By analyzing the communication behavior of low-imitation area address data, it helps to detect potential abnormal behaviors, which may involve unauthorized access or other security issues. Extracting request information from high-access area addresses helps to further analyze and understand the nature of these requests, which helps to identify normal and abnormal requests. By calculating the request rationality score, the rationality of the request can be quantitatively evaluated, which helps to determine which requests are normal and which may be abnormal. Using the request rationality score to perform abnormal access analysis on high-imitation area address data helps to detect possible unusual requests and behaviors, thereby discovering potential problems early. Fusion of low-imitation area abnormal data with high-imitation area abnormal data can create comprehensive abnormal traffic data, which helps to fully understand various abnormal situations in network traffic.

[0035] Preferably, the request rationality calculation formula in step S1345 is as follows:

[0036]

[0037] Where R is the request rationality score, t1 is the request start time, t2 is the request end time, N(t) is the total number of requests in time period t, T is the duration of time period t, and a t is the weight of time period t, τ0 is the start time of time period t, τ is the end time of time period t, c s is the network fluctuation value at time s, e is the base of the natural logarithm, b s is the request density value at time s, β is the request type weight, n is the total number of request time periods, y i is the i-th request type, and ω is the deviation adjustment item of the request rationality score.

[0038] The present invention constructs a request rationality calculation formula, which is used to calculate the rational value of the request information data and generate a request rationality score. The formula fully considers the request start time t1, the request end time t2, the total number of requests N(t) when the time period is t, the length T of the time period t, the weight a of the time period t t , the starting time of time period t is τ0, the ending time of time period t is τ, and the network fluctuation value c at time s s , the base of the natural logarithm e, the requested density value b at time s s , request type weight β, total number of request time periods n, i-th request type yi , request the bias adjustment term ω of the rationality score and the interaction between the variables to form the following functional relationship:

[0039]

[0040] pass It indicates the dynamic nature of the request density. If N(t) fluctuates greatly within a time period and T is short, it may cause the request density to fluctuate drastically, which means that the request is frequent and may also mean that the rationality of the request is reduced. t The introduction of indicates the importance of different time periods. Longer time periods may be considered more important, so a t It can be used to adjust the contribution of the time period to the overall rationality score by adjusting a t The value of can be used to assign different weights to different time periods to reflect their actual impact on system performance. This helps to reasonably consider the importance of different time periods. The calculation of considers the relationship between network conditions and request distribution. The network fluctuation value may affect the success rate and latency of requests, while the request density value indicates the concentration of requests. Through this part of the calculation, the impact of network conditions on the rationality of requests can be more comprehensively evaluated. It is helpful for system optimization to accurately evaluate the rationality of requests under different network fluctuation conditions. i The impact of request type on request rationality is considered. Different request types may have different impacts on server data. By adjusting β and y i The value of can adjust the rationality score according to the importance of the request type, which can better reflect the impact of different request types. This functional relationship can accurately evaluate the request rationality score of each user, so as to more accurately select abnormal access data in the high-imitation area address data, thereby improving the accuracy of the reinforcement test. The deviation adjustment term ω of the request rationality score is used to adjust and correct the functional relationship, such as adjusting the request failure or performance degradation caused by hardware failure, the impact of external events on server availability, etc., to reduce the error impact caused by this data or error term, so as to more accurately generate the request rationality score R, and improve the accuracy and reliability of the rationality evaluation of request data of different users. At the same time, the weights and adjustment values ​​in the formula can be adjusted according to the actual situation, and applied to the request information data of different applicants, which improves the flexibility and applicability of the algorithm.

[0041] Preferably, step S2 comprises the following steps:

[0042] Step S21: construct a threat intelligence network using blockchain technology; obtain threat intelligence data based on the threat intelligence network;

[0043] Step S22: performing sentiment semantic analysis on the threat intelligence data to generate reliable intelligence data; performing data structuring processing on the reliable intelligence data to generate structured intelligence data;

[0044] Step S23: performing data clustering processing on the structured intelligence data to generate high-confidence data and low-confidence data;

[0045] Step S24: performing submission time analysis on the high-confidence intelligence data to generate submission time distribution data; performing confidence correction on the high-confidence intelligence data based on the submission time distribution data to generate high-confidence correction data;

[0046] Step S25: extracting low-frequency words from the low-confidence data to generate special word data; screening the low-confidence data according to the special word data to generate special low-confidence data;

[0047] Step S26: Perform submission association analysis on the special low-confidence data based on the high-confidence correction data to generate submitter-associated data; perform confidence correction on the special low-confidence data based on the submitter-associated data to generate low-confidence correction data.

[0048] The present invention ensures the security and traceability of data by establishing a distributed, tamper-proof threat intelligence network. This makes the data more credible, difficult to tamper with, and enables data sharing and cooperation. Data providers and users can exchange information with confidence. Sentimental semantic analysis helps to understand the emotional tendency and meaning of intelligence data, thereby providing more contextual information. Data structuring makes data easy to process and query, improving the availability and readability of data. Data clustering helps to divide intelligence data into high-confidence data and low-confidence data, making the quality of the data clearer. It helps to reduce false alarms and improve the accuracy of intelligence data. Through submission time analysis, the timeliness of data can be considered to ensure that high-confidence data is still valuable. Confidence correction helps to improve the credibility of data and ensure that the most important information is fully valued. Extracting low-frequency words and special words helps to identify potential information in the data or trends in new fields. Data screening can help eliminate irrelevant information, making the data more focused and useful. Submitter association analysis helps to discover the association between high-confidence data and the publishers of special low-confidence data. For example, if it is found that the publisher of a special low-confidence data is the same as the publisher of a high-confidence data, then through confidence correction, the confidence of the low-confidence data can be improved to better assess potential threats.

[0049] Preferably, step S3 comprises the following steps:

[0050] Step S31: performing feature vectorization according to the high-confidence correction data and the low-confidence correction data to generate high-confidence vector data and low-confidence vector data;

[0051] Step S32: Perform data dimensionality reduction fusion on high confidence vector data and low confidence vector data to generate dimensionality reduction intelligence data; design an attention mechanism based on the confidence in the dimensionality reduction intelligence data to generate a model attention mechanism;

[0052] Step S33: constructing a threat network model based on the dimensionality reduction intelligence data and the model attention mechanism;

[0053] Step S34: performing association path analysis on the threat network model to generate association path data; performing entity dependency analysis on the threat network model to generate entity dependency relationship data;

[0054] Step S35: performing association compensation on the association path data according to the entity dependency data to generate compensated association path data;

[0055] Step S36: training the threat network model by compensating the associated path data to generate a potential threat model;

[0056] Step S37: Perform threat exploitation probability analysis based on the potential threat model to generate threat exploitation probability data.

[0057] The present invention can make data easier to be processed and analyzed by a machine learning model by converting high-confidence correction data and low-confidence correction data into feature vectors. It is helpful to convert intelligence data into a numerical form that can be processed by the algorithm. Dimensionality reduction and fusion of high-confidence vector data and low-confidence vector data can reduce data dimensions, reduce computing costs, and retain key information. By designing an attention mechanism based on the confidence in the dimension-reduced intelligence data, important information can be highlighted and the effect of subsequent analysis can be improved. Building a threat network model based on dimension-reduced intelligence data and a model attention mechanism helps to understand the association and dependency of threats. The threat network can be analyzed more systematically, so as to better understand the nature and behavior patterns of threats. By performing association path analysis and entity dependency analysis on the threat network model, the propagation path and associated entities of the threat can be revealed. By performing association compensation on the association path data through entity dependency data, the association path data can be corrected or supplemented, making the analysis more comprehensive and accurate. By training the threat network model using compensated association path data, a more accurate potential threat model can be generated. This model can better predict and identify threats. By conducting threat exploitation probability analysis based on potential threat models, we can evaluate the possibility of actual threat exploitation and take corresponding defensive measures.

[0058] Preferably, step S4 comprises the following steps:

[0059] Step S41: construct a virtual environment; use the attack load data to simulate the attack on the virtual environment and generate a first load attack report;

[0060] Step S42: performing a load update design on the attack load data according to the threat utilization probability data to generate a threat attack load;

[0061] Step S43: performing threat attack simulation on the virtual environment data based on the threat attack payload, and generating a second payload attack report;

[0062] Step S44: performing similar attack analysis on the first load attack report and the second load attack report to generate a comprehensive load attack report;

[0063] Step S45: formulate a reinforcement strategy based on the comprehensive load attack report and generate reinforcement strategy data.

[0064] The present invention can evaluate the performance of the system when it is attacked by constructing a virtual environment and performing attack simulation. It is helpful to discover potential vulnerabilities and weaknesses and identify the weak links of the system in advance. Updating the attack load according to the threat utilization probability data can make the attack simulation more realistic and close to the actual threat. It is helpful to simulate the latest threat forms and improve the defense capability against new attacks. Simulating based on the updated threat attack load and generating a second load attack report can more comprehensively evaluate the security of the system. It is helpful to discover the weaknesses and possible response strategies of the system under different attack scenarios. By performing similar attack analysis on the first and second load attack reports and generating a comprehensive load attack report, common attack patterns and vulnerabilities can be identified. This helps to formulate a more comprehensive and targeted reinforcement strategy. Based on the comprehensive load attack report, a reinforcement strategy can be formulated to improve the security of the system in a targeted manner. It helps to take measures to prevent known and potential threats and reduce the impact of potential attacks on the system.

[0065] Preferably, step S5 comprises the following steps:

[0066] Step S51: Evaluate the attack cost through the comprehensive load attack report to generate attack cost analysis data;

[0067] Step S52: Perform reinforcement cost evaluation on the reinforcement strategy data to generate reinforcement cost data;

[0068] Step S53: Use the repair necessity evaluation formula to perform repair necessity evaluation on the attack cost analysis data and the reinforcement cost data to generate a repair necessity score.

[0069] Step S54: Transmit the reinforcement strategy data and the repair necessity score to the terminal to generate a reinforcement test report.

[0070] The present invention can estimate the potential cost of an attacker by analyzing the comprehensive payload attack report. It helps to understand the economic motivation of the attack and assess the risk to the system. It helps to determine which vulnerabilities or threats are the most threatening. Cost assessment of the established reinforcement strategies can determine the resources and costs required to implement these strategies. It helps to decide whether you are willing to bear these costs to improve the security of the system. Using the repair necessity assessment formula combined with the attack cost and reinforcement cost data, it can be determined which vulnerabilities or threats should be repaired with the highest priority. It helps to allocate limited security resources to the most urgent issues to minimize risks. Transmitting the reinforcement strategy data and the repair necessity score to the terminal to generate a reinforcement test report helps to provide a clear action plan. This report can include specific steps and timetables to help ensure that the security of the system is improved to reduce potential threats.

[0071] Preferably, the repair necessity evaluation formula in step S53 is as follows:

[0072]

[0073] In the formula, X is the necessity assessment score, T1 is the start time of the necessity assessment, T2 is the end time of the necessity assessment, and H j (m) is the reinforcement cost at time m, H g (m) is the attack cost at time m, f(m) is the attack frequency at time m, V(m) is the vulnerability impact value at time m, O(m) is the threat severity score at time m, g(m) is the vulnerability exposure probability value at time m, E(m) is the vulnerability exposure value at time m, P(m) is the threat occurrence probability value at time m, A bias adjustment value for the necessity assessment score.

[0074] The present invention constructs a repair necessity assessment formula, which is used to evaluate the repair necessity of attack cost analysis data and reinforcement cost data and generate a repair necessity score. The formula fully considers the start time T1 of the necessity assessment, the end time T2 of the necessity assessment, and the reinforcement cost H at time m. j (m), the attack cost H at time m g (m), the attack frequency value f(m) at time m, the vulnerability impact value V(m) at time m, the threat severity score O(m) at time m, the vulnerability exposure probability value g(m) at time m, the vulnerability exposure value E(m) at time m, the threat occurrence probability value P(m) at time m, and the deviation adjustment value of the necessity assessment score and the interactions between variables to form the following functional relationship:

[0075]

[0076] By H g (m)-H j (m) is used to obtain the difference between the attack cost and the reinforcement cost. When the value is positive, it means that the reinforcement cost is greater than the attack cost. The greater the probability of the corresponding vulnerability threat being exploited, the greater the corresponding repair necessity score, and measures need to be taken to reduce the risk. f(m) indicates the possibility of an attack at this point in time. If f(m) is higher, attacks may occur more frequently during this time period, increasing the urgency of repairing the vulnerability. V(m) indicates the impact of the vulnerability on the system after it is exploited. If V(m) is large, the vulnerability may cause greater harm to the system after it is exploited, increasing the urgency of repairing the vulnerability. O(m) indicates the severity of the threat. A higher threat severity score may mean that the impact of the attack is more serious. Through H g (m)+H j (m) to get the sum of the attack cost and the reinforcement cost, that is, the total cost. The total cost data helps to determine which vulnerability threats pose a greater threat to the security of server data and need to be dealt with first. If g(m) is higher, the vulnerability is more likely to be exploited by attackers during this time period; if E(m) is higher, the vulnerability in the system is more likely to be discovered; if P(m) is higher, the threat is more likely to occur. The reference to time integral takes into account the changes in various relevant parameters of vulnerability threats over time, and dynamically evaluates the necessity of vulnerability repair. This functional relationship can accurately and real-time evaluate the necessity of repairing each threat discovered in the test, thereby obtaining a repair necessity score, which can be fed back to the terminal device to help make more accurate and necessary decisions. And use the deviation adjustment value of the necessity assessment score Adjust and modify the functional relationship. For example, if the current calculated necessity score is low, that is, the repair urgency is low, but the risk has not appeared in historical data, then we should consider whether to use Adjustments are made to reduce the impact of errors caused by this data or error term, so as to more accurately generate the necessity assessment score X, and improve the accuracy and reliability of the repair necessity assessment of the attack cost analysis data and the reinforcement cost data. At the same time, the adjustment value in the formula can be adjusted according to the actual situation and applied to the repair necessity assessment of different risk vulnerabilities, which improves the flexibility and applicability of the algorithm.

[0077] The beneficial effect of the present application is that the present invention obtains a kernel log file, which contains key information about the operation of the system, such as abnormal events and error messages. By obtaining these files, potential problems can be quickly identified. Analyzing the traffic state in the kernel log file helps to identify anomalies in network traffic, such as large-scale data packet transmission or frequent connection attempts. Integrating abnormal traffic data into comprehensive abnormal traffic data helps to more comprehensively understand the abnormal situations that may exist in the system. Based on the abnormal traffic data, attack payloads are designed, which can be used to simulate potential attack behaviors and help to discover system weaknesses and vulnerabilities. Threat intelligence data includes information about the latest threats and attacks from multiple sources to understand the current threat environment. Clustering the threat intelligence data can classify related information together to provide a clearer threat image. Dividing the intelligence data into high-confidence and low-confidence data can focus on the most important and most credible information. Confidence correction of low-confidence data helps to improve the availability and credibility of the data. Using high-confidence data and low-confidence data to build a threat model helps the system better understand the nature and potential threats of different threats. Through probability analysis, the actual utilization probability of different threats can be estimated, which helps to determine which threats are more likely to pose a threat to the system. Using attack payload data and threat utilization probability data, actual attack scenarios are simulated to understand the vulnerabilities and potential attack paths in the system. An attack report is generated, detailing the simulation results of the attack, which helps to identify the weak points that need to be taken. Based on the results of the attack simulation, a reinforcement strategy is formulated to reduce the vulnerability of the system and improve security. According to the comprehensive load attack report and reinforcement strategy data, the urgency of the vulnerabilities and vulnerabilities that need to be repaired in the system is evaluated. The reinforcement strategy data and the repair necessity score are transmitted to the terminal, and a reinforcement test report is generated to verify the effectiveness of the reinforcement measures and the improvement of the system. Therefore, the reinforcement test method based on kernel protection server data of the present invention constructs a potential threat model through threat intelligence data to timely discover hidden vulnerabilities and weaknesses. By designing an attack payload to simulate an attack, the possibility of hidden vulnerabilities being exploited is determined to improve the accuracy of the reinforcement test. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 A schematic diagram of the steps of a hardening test method for protecting server data based on the kernel;

[0079] Figure 2 for Figure 1 Detailed implementation steps of step S2 in the flowchart;

[0080] Figure 3 for Figure 1 Detailed implementation steps of step S3 in FIG.

[0081] Figure 4 for Figure 1 Detailed implementation steps of step S4 in FIG.

[0082] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0083] The following is a clear and complete description of the technical method of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by technicians in this field without creative work are within the scope of protection of the present invention.

[0084] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor methods and / or microcontroller methods.

[0085] It should be understood that, although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are used only to distinguish one unit from another unit. For example, without departing from the scope of the exemplary embodiments, the first unit may be referred to as the second unit, and similarly the second unit may be referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0086] To achieve this, please refer to Figures 1 to 4 , a hardening test method for protecting server data based on kernel, the method comprising the following steps:

[0087] Step S1: Obtain a kernel log file; perform traffic status analysis based on the kernel log file to generate comprehensive abnormal traffic data; perform attack payload design based on the comprehensive abnormal traffic data to generate attack payload data;

[0088] Step S2: Acquire threat intelligence data; perform data clustering on the threat intelligence data to generate high-confidence data and low-confidence data; perform confidence correction on the high-confidence data and the low-confidence data to generate high-confidence corrected data and low-confidence corrected data;

[0089] Step S3: constructing a potential threat model based on the high-confidence correction data and the low-confidence correction data; performing threat exploitation probability analysis through the potential threat model to generate threat exploitation probability data;

[0090] Step S4: Perform attack simulation based on the attack load data and threat utilization probability data to generate a comprehensive load attack report; formulate a reinforcement strategy based on the comprehensive load attack report to generate reinforcement strategy data;

[0091] Step S5: Perform a repair necessity assessment based on the comprehensive load attack report and the reinforcement strategy data to generate a repair necessity score; transmit the reinforcement strategy data and the repair necessity score to the terminal to generate a reinforcement test report.

[0092] The present invention can gain in-depth understanding of the operating status and potential problems of the system by obtaining kernel log files. Analyzing the traffic state in the kernel log file helps detect abnormal activities, such as network attacks, abnormal access, etc. It helps to detect potential threats early and reduce the attack surface. The results of the traffic state analysis are summarized into comprehensive abnormal traffic data, providing a comprehensive view of the security status of the system. By analyzing the abnormal traffic data, a specific attack payload can be designed to simulate potential attack scenarios. It helps to test the vulnerability of the system and prepare defense strategies. Threat intelligence data is obtained to better understand the current threat situation, including known attack patterns and attackers' behaviors. Clustering threat intelligence data can help classify data into high confidence and low confidence, so that security professionals can focus more on processing the most threatening information. By correcting the data for confidence, the accuracy and credibility of the data can be improved, and the most important information can be further screened out. Combining high confidence corrected data with low confidence corrected data can build a potential threat model for predicting possible threat situations. Generating threat utilization probability data helps to assess the potential impact of threats. This helps system administrators understand which threats are more risky so that more targeted measures can be taken. Attack simulation is performed through attack payload data and threat exploitation probability data to evaluate the system's ability to resist various attacks. It helps to reveal potential weaknesses. Reinforcement strategies are formulated based on attack reports, which help improve the security of the system. For example, they include repairing known vulnerabilities, strengthening access control and other security measures. By evaluating attack reports and reinforcement strategy data, it can be determined which problems need to be urgently resolved to improve the security of the system. The reinforcement test report provides comprehensive information about the security of the system, including vulnerabilities, repair strategies, repair necessity scores, etc. It helps to understand the security status of the system. Therefore, the reinforcement test method based on kernel protection server data of the present invention constructs a potential threat model through threat intelligence data to timely discover hidden vulnerabilities and weaknesses. By designing attack payloads to simulate attacks, the possibility of hidden vulnerabilities being exploited is determined to improve the accuracy of reinforcement testing.

[0093] In the embodiment of the present invention, reference Figure 1 The above is a schematic diagram of the steps of a hardening test method based on kernel protection of server data of the present invention. In this example, the hardening test method based on kernel protection of server data includes the following steps:

[0094] Step S1: Obtain a kernel log file; perform traffic status analysis based on the kernel log file to generate comprehensive abnormal traffic data; perform attack payload design based on the comprehensive abnormal traffic data to generate attack payload data;

[0095] In an embodiment of the present invention, by configuring the system to record kernel logs, tools such as rsyslog can usually be used to manage and store log data. Use log analysis tools such as ELK Stack (Elasticsearch, Logstash, Kibana) or Splunk to analyze network traffic related information in kernel log files. Generate abnormal traffic data by formulating rules, filtering abnormal events, and detecting abnormal traffic. Based on abnormal traffic data and known attack vectors, design different types of attack payloads, such as SQL injection, cross-site scripting attacks, etc. Use tools such as Metasploit Framework, OWASPZAP or Burp Suite to generate and test attack payloads.

[0096] Step S2: Acquire threat intelligence data; perform data clustering on the threat intelligence data to generate high-confidence data and low-confidence data; perform confidence correction on the high-confidence data and the low-confidence data to generate high-confidence corrected data and low-confidence corrected data;

[0097] In an embodiment of the present invention, by subscribing to a threat intelligence provider, a threat intelligence sharing standard (such as STIX / TAXII) is used to obtain real-time threat intelligence data. Or a threat intelligence network is built based on blockchain technology, and a reward mechanism is established to obtain real-time threat intelligence data. Information from channels such as security news, hacker communities, and vulnerability reports is collected and summarized. Threat intelligence data is classified and grouped using data analysis tools, and similar data is merged according to sharing standards. Confidence scores are assigned to threat intelligence data based on factors such as the credibility and accuracy of the data source. Confidence corrections can be made to high-confidence data based on the submission time. For example, if the release time of high-confidence data is consistent, the confidence of the intelligence can be appropriately increased. If the release time is dispersed, the confidence of the corresponding intelligence can be appropriately reduced. For low-confidence data, corrections can be made based on publisher information. For example, when the publisher of a low-confidence intelligence is consistent with the publisher of a high-confidence data, the confidence of the low-confidence data can be appropriately increased to improve the accuracy of the data.

[0098] Step S3: constructing a potential threat model based on the high-confidence correction data and the low-confidence correction data; performing threat exploitation probability analysis through the potential threat model to generate threat exploitation probability data;

[0099] In the embodiment of the present invention, a potential threat model is constructed based on high-confidence data and low-confidence data by using machine learning or statistical modeling techniques, taking into account various data characteristics. Using the constructed model, the potential exploitation probability of different threats is analyzed, taking into account the goals and capabilities of the attacker. Threat exploitation probability data is generated to help determine which threats are more likely to pose a threat to the system.

[0100] Step S4: Perform attack simulation based on the attack load data and threat utilization probability data to generate a comprehensive load attack report; formulate a reinforcement strategy based on the comprehensive load attack report to generate reinforcement strategy data;

[0101] In an embodiment of the present invention, a virtual environment is constructed, which can be an isolated test environment or a simulated network. The prepared attack payload data is applied to the system and network in the virtual environment. It may involve deploying malware to the target system, simulating network traffic, or performing other attack behaviors. Different types of attacks are simulated in the virtual environment, including malware propagation, vulnerability exploitation, denial of service attacks, etc. Activities and data during the attack are recorded. The network traffic, system logs, and other relevant data of the virtual environment are monitored to capture the results of the attack simulation. Based on the results of the attack simulation, a comprehensive payload attack report is generated, which includes information such as the attack method, the affected system, and the attack success rate. Threat analysis is performed on the comprehensive payload attack report to identify potential threats and vulnerabilities. Based on the results of the threat analysis, a reinforcement strategy is formulated, including patching vulnerabilities, improving security configuration, implementing access control, strengthening identity authentication, etc. Determine the priority of the reinforcement strategy and arrange the execution order according to the severity and potential impact of the threat.

[0102] Step S5: Perform a repair necessity assessment based on the comprehensive load attack report and the reinforcement strategy data to generate a repair necessity score; transmit the reinforcement strategy data and the repair necessity score to the terminal to generate a reinforcement test report.

[0103] In an embodiment of the present invention, by combining the comprehensive load attack report and the reinforcement strategy data, the threat impact that may occur if no repair is performed is evaluated. Based on the assessed threat impact, the priority of the reinforcement strategy, and the resource availability, the repair necessity score for each threat or reinforcement strategy is calculated. This can be done using an algorithm or method that weighs different factors. The generated reinforcement strategy data and the repair necessity score are transmitted to the terminal device, which can be done through network transmission, data export, or other means. On the terminal device, a reinforcement test report is generated using the transmitted data. The report may include a repair necessity score for each threat, a recommended reinforcement strategy, an implementation plan, and resource requirements. Based on the recommendations and priorities in the reinforcement test report, the corresponding reinforcement strategy is implemented to improve the security of the system and network. As the reinforcement measures are implemented, the security of the system is continuously monitored, and the reinforcement strategy and test report are updated to reflect the latest threat intelligence and system status.

[0104] Preferably, step S1 comprises the following steps:

[0105] Step S11: Obtain kernel log file;

[0106] Step S12: Analyze the traffic status according to the kernel log file to generate normal traffic data and abnormal traffic data;

[0107] Step S13: tracing the source of normal traffic data to generate hidden abnormal traffic data;

[0108] Step S14: supplementing the abnormal traffic data with the hidden abnormal traffic data to generate comprehensive abnormal traffic data;

[0109] Step S15: Design an attack load based on the comprehensive abnormal traffic data to generate attack load data.

[0110] The present invention obtains the kernel log file, which is a record of system activities and events and an important data source for evaluating system health and security. By analyzing the flow status of the kernel log file, normal and abnormal network traffic can be distinguished. This helps to discover potential attacks, faults or system anomalies. Tracing the source of normal traffic data can reveal hidden abnormal traffic, that is, those abnormal situations that cannot be immediately identified. It helps to understand the potential risks in the system more comprehensively. Combined with the hidden abnormal traffic data, the identified abnormal traffic is further supplemented and analyzed to generate more comprehensive comprehensive abnormal traffic data. It helps to more accurately describe the abnormal situation of the system. Based on the comprehensive abnormal traffic data, various attack payload data are designed. It provides an important basis for simulating potential attacks and helps to test the weaknesses and security of the system.

[0111] In an embodiment of the present invention, by configuring kernel logging, a log management tool is used to automatically collect and archive kernel log files to ensure data integrity and long-term preservation. Use appropriate tools to extract network traffic-related data from kernel log files. By parsing the network traffic information in the kernel log, various attributes of the traffic, such as source IP, target IP, port, protocol, connection duration, etc., are analyzed. A baseline model of normal traffic is established using historical normal traffic data. A baseline model can be constructed using a statistical model, a machine learning model, or a deep learning model. Real-time kernel log data is compared with the baseline model to identify traffic that does not match the normal traffic pattern. The non-matching traffic is considered to be abnormal traffic and is marked to generate abnormal traffic data. Normal traffic usually conforms to normal network behavior, while abnormal traffic may include large-scale connection attempts, unauthorized access attempts, etc. Analyze the normal traffic data to determine its source IP address or the identity of the source user. Identify traffic that appears normal but may actually be abnormal, which may include internal threats, potential malicious activities, advanced persistent threats, etc. Tools such as Wireshark, tcpdump, etc. can be used to deeply analyze traffic to detect hidden abnormal behavior. Combine the hidden abnormal traffic data with the original abnormal traffic data to obtain a more comprehensive abnormal traffic data set. Perform in-depth analysis based on the comprehensive abnormal traffic data to understand the characteristics of the attack payload, such as the protocol type, target port, packet structure, etc. of the attack, to provide a basis for designing similar attack payloads. According to the analysis results of the comprehensive abnormal traffic data, select the corresponding attack payload type, such as malicious packets, code injection, buffer overflow, etc. Design a variety of attack payloads based on the selected type, including different types of vulnerability exploits, SQL injection, cross-site scripting attacks, buffer overflows, etc. The design process should consider bypassing the security protection mechanism of the server system to ensure the effectiveness of the attack payload. Various attack tools, such as Metasploit, Burp Suite, OWASP ZAP, etc., can be used to generate and test attack payloads. Simulate the use of the designed attack payload in a controlled environment, such as a security lab or isolated network. Detect the attack results and optimize the designed attack payload based on the attack results.

[0112] Preferably, step S13 comprises the following steps:

[0113] Step S131: extracting the number of visits from normal traffic data to generate the number of visits data;

[0114] Step S132: designing data labels for the access number data based on a preset access number threshold, generating low access label data when the access number data is less than or equal to the preset access number threshold; generating high access label data when the access number data is greater than the preset access number threshold;

[0115] Step S133: tracing the source of normal traffic data according to the low-access tag data to generate low-access traffic tracing data;

[0116] Step S134: Analyze the low-visit traffic source tracing data to generate low-imitation abnormal traffic data;

[0117] Step S135: Analyze the access habits of normal traffic data according to the high-access tag data to generate special access habit data;

[0118] Step S136: Integrate the low-simulation abnormal traffic data with the special access habit data to generate hidden abnormal traffic data.

[0119] The present invention can help identify which resources have received how much attention by extracting the number of visits information from normal traffic, which helps to understand the behavior of users or systems. Label design based on access number data helps to classify traffic into different categories, such as low access and high access, making subsequent analysis and processing easier. Tracing the source based on low-access label data can reveal the source of low-access traffic and help determine which resources or users may be overlooked or have problems. By analyzing the low-access traffic tracing data, anomalies in the low-access data can be detected, which helps to detect potential problems or threats early. Analyzing high-access label data can help understand special access habits, identify whether there are unusual behavior patterns, and help detect abuse or anomalies. Integrating low-imitation abnormal traffic data with special access habit data helps to create comprehensive abnormal traffic data, which may contain abnormal behavior hidden in normal traffic, and helps to identify more comprehensive risks.

[0120] In an embodiment of the present invention, key information such as source IP address, target IP address, access time, etc. is extracted from normal traffic data. According to the extracted data, the number of visits of each source IP address or user is counted to generate access number data. A preset access number threshold is set, which is usually set according to the access frequency of normal traffic. According to the threshold, the access number data is divided into two types of labels: low access label and high access label. The low access label indicates that the number of visits is less than or equal to the threshold, and the high access label indicates that the number of visits is greater than the threshold. The normal traffic data with low access labels is analyzed to determine the identity of its source IP address or user. The identity of the low access source is determined using access records, identity authentication information, session data, etc., so as to identify potential abnormal behaviors. The low access traffic tracing data is analyzed to find behaviors that do not conform to the normal access mode, which may include unauthorized access, abnormal data transmission, etc. The data of specific abnormal behaviors are integrated into low-simulation abnormal traffic data. Special analysis is performed on normal traffic data with high access labels to find possible special access habits or abnormal behaviors. Data of special access habits is recorded, such as abnormally frequent access, unconventional operations, etc. Integrate low-simulation abnormal traffic data with special access habit data to generate hidden abnormal traffic data.

[0121] Preferably, step S134 includes the following steps:

[0122] Step S1341: Perform IP address statistics according to the kernel log file to generate IP address distribution data;

[0123] Step S1342: using the IP address distribution data to classify the low-visit traffic source tracing data, and generating low-visit area address data and high-visit area address data;

[0124] Step S1343: performing communication behavior analysis on the low-imitation area address data to generate low-imitation area abnormal data;

[0125] Step S1344: extracting request information based on the high-imitation regional address data to generate request information data;

[0126] Step S1345: Calculate the reasonable value of the request information data using the request reasonableness calculation formula to generate a request reasonableness score;

[0127] Step S1346: performing abnormal access analysis on the address data of the high-visited areas by requesting rationality scores, and generating abnormal data of the high-imitation areas;

[0128] Step S1347: Fusing the abnormal data in the low-simulation area with the abnormal data in the high-simulation area to generate comprehensive abnormal traffic data.

[0129] The present invention uses kernel log files to perform IP address statistics, which helps to understand the distribution of IP addresses in network traffic, helps to determine which IP addresses generate most of the traffic, and thus helps to identify potential sources of problems. Using IP address distribution data to classify low-access traffic tracing data, and dividing traffic data into low-access area addresses and high-access area addresses, helps to focus traffic on specific areas. By analyzing the communication behavior of low-imitation area address data, it helps to detect potential abnormal behaviors, which may involve unauthorized access or other security issues. Extracting request information from high-access area addresses helps to further analyze and understand the nature of these requests, which helps to identify normal and abnormal requests. By calculating the request rationality score, the rationality of the request can be quantitatively evaluated, which helps to determine which requests are normal and which may be abnormal. Using the request rationality score to perform abnormal access analysis on high-imitation area address data helps to detect possible unusual requests and behaviors, thereby discovering potential problems early. Fusion of low-imitation area abnormal data with high-imitation area abnormal data can create comprehensive abnormal traffic data, which helps to fully understand various abnormal situations in network traffic.

[0130] In an embodiment of the present invention, data related to network traffic, including source IP addresses and target IP addresses, are extracted from kernel log files. Statistics are performed on the extracted data, and the frequency of occurrence of each IP address is calculated to generate IP address distribution data. Using the IP address distribution data, the IP addresses in the low-access traffic tracing data are divided into two categories, namely, low-access area addresses and high-access area addresses, according to the frequency of the IP addresses in the distribution data. A threshold is set to distinguish between low-access and high-access area addresses, usually based on the relative frequency of IP address occurrence. The communication behavior in the low-imitation area address data is analyzed, including the frequency of data transmission, data packet size, protocol usage, etc. Identify behaviors that are inconsistent with normal communication behaviors, which may include abnormally frequent data transmission, unconventional protocol usage, etc. The data of specific abnormal behaviors are integrated into low-imitation area abnormal data for subsequent analysis and processing. The request information in the high-imitation area address data is analyzed, including URL, HTTP header, request method, etc. The extracted request information data is converted into a structured format for subsequent processing and analysis. The preset request rationality calculation formula is used, which fully considers variables such as the total number of requests, request time period, and network fluctuation value to accurately evaluate the request rationality score of each user, which helps to quickly and accurately select abnormal access data in the address data of high-imitation areas and improve the accuracy of subsequent reinforcement tests. In addition to the preset formula, machine learning models, rule-based systems, behavioral analysis, context-based evaluation and other methods can also be used to evaluate the request rationality score. Use the request rationality score to analyze abnormal access to the address data of high-visit areas and identify unreasonable requests. Integrate unreasonable request information data into abnormal data of high-imitation areas. Merge the abnormal data of low-imitation areas and the abnormal data of high-imitation areas into a data set. This data set contains various abnormal behaviors, captures anomalies from different angles of low-visit areas and high-visit areas, and generates comprehensive abnormal traffic data.

[0131] Preferably, the request rationality calculation formula in step S1345 is as follows:

[0132]

[0133] Where R is the request rationality score, t1 is the request start time, t2 is the request end time, N(t) is the total number of requests in time period t, T is the duration of time period t, and a t is the weight of time period t, τ0 is the start time of time period t, τ is the end time of time period t, c s is the network fluctuation value at time s, e is the base of the natural logarithm, b s is the request density value at time s, β is the request type weight, n is the total number of request time periods, y i is the i-th request type, and ω is the deviation adjustment item of the request rationality score.

[0134] The present invention constructs a request rationality calculation formula, which is used to calculate the rational value of the request information data and generate a request rationality score. The formula fully considers the request start time t1, the request end time t2, the total number of requests N(t) when the time period is t, the length T of the time period t, the weight a of the time period t t , the starting time of time period t is τ0, the ending time of time period t is τ, and the network fluctuation value c at time s s , the base of the natural logarithm e, the requested density value b at time s s , request type weight β, total number of request time periods n, i-th request type y i , request the bias adjustment term ω of the rationality score and the interaction between the variables to form the following functional relationship:

[0135]

[0136] pass It indicates the dynamic nature of the request density. If N(t) fluctuates greatly within a time period and T is short, it may cause the request density to fluctuate drastically, which means that the request is frequent and may also mean that the rationality of the request is reduced. t The introduction of indicates the importance of different time periods. Longer time periods may be considered more important, so a t It can be used to adjust the contribution of the time period to the overall rationality score by adjusting a t The value of can be used to assign different weights to different time periods to reflect their actual impact on system performance. This helps to reasonably consider the importance of different time periods. The calculation of considers the relationship between network conditions and request distribution. The network fluctuation value may affect the success rate and latency of requests, while the request density value indicates the concentration of requests. Through this part of the calculation, the impact of network conditions on the rationality of requests can be more comprehensively evaluated. It is helpful for system optimization to accurately evaluate the rationality of requests under different network fluctuation conditions. i The impact of request type on request rationality is considered. Different request types may have different impacts on server data. By adjusting β and y iThe value of can adjust the rationality score according to the importance of the request type, which can better reflect the impact of different request types. This functional relationship can accurately evaluate the request rationality score of each user, so as to more accurately select abnormal access data in the high-imitation area address data, thereby improving the accuracy of the reinforcement test. The deviation adjustment term ω of the request rationality score is used to adjust and correct the functional relationship, such as adjusting the request failure or performance degradation caused by hardware failure, the impact of external events on server availability, etc., to reduce the error impact caused by this data or error term, so as to more accurately generate the request rationality score R, and improve the accuracy and reliability of the rationality evaluation of request data of different users. At the same time, the weights and adjustment values ​​in the formula can be adjusted according to the actual situation, and applied to the request information data of different applicants, which improves the flexibility and applicability of the algorithm.

[0137] Preferably, step S2 comprises the following steps:

[0138] Step S21: construct a threat intelligence network using blockchain technology; obtain threat intelligence data based on the threat intelligence network;

[0139] Step S22: performing sentiment semantic analysis on the threat intelligence data to generate reliable intelligence data; performing data structuring processing on the reliable intelligence data to generate structured intelligence data;

[0140] Step S23: performing data clustering processing on the structured intelligence data to generate high-confidence data and low-confidence data;

[0141] Step S24: performing submission time analysis on the high-confidence intelligence data to generate submission time distribution data; performing confidence correction on the high-confidence intelligence data based on the submission time distribution data to generate high-confidence correction data;

[0142] Step S25: extracting low-frequency words from the low-confidence data to generate special word data; screening the low-confidence data according to the special word data to generate special low-confidence data;

[0143] Step S26: Perform submission association analysis on the special low-confidence data based on the high-confidence correction data to generate submitter-associated data; perform confidence correction on the special low-confidence data based on the submitter-associated data to generate low-confidence correction data.

[0144] The present invention ensures the security and traceability of data by establishing a distributed, tamper-proof threat intelligence network. This makes the data more credible, difficult to tamper with, and enables data sharing and cooperation. Data providers and users can exchange information with confidence. Sentimental semantic analysis helps to understand the emotional tendency and meaning of intelligence data, thereby providing more contextual information. Data structuring makes data easy to process and query, improving the availability and readability of data. Data clustering helps to divide intelligence data into high-confidence data and low-confidence data, making the quality of the data clearer. It helps to reduce false alarms and improve the accuracy of intelligence data. Through submission time analysis, the timeliness of data can be considered to ensure that high-confidence data is still valuable. Confidence correction helps to improve the credibility of data and ensure that the most important information is fully valued. Extracting low-frequency words and special words helps to identify potential information in the data or trends in new fields. Data screening can help eliminate irrelevant information, making the data more focused and useful. Submitter association analysis helps to discover the association between high-confidence data and the publishers of special low-confidence data. For example, if it is found that the publisher of a special low-confidence data is the same as the publisher of a high-confidence data, then through confidence correction, the confidence of the low-confidence data can be improved to better assess potential threats.

[0145] As an example of the present invention, refer to Figure 2 As shown, in this example, step S2 includes:

[0146] Step S21: construct a threat intelligence network using blockchain technology; obtain threat intelligence data based on the threat intelligence network;

[0147] In the embodiment of the present invention, by creating an autonomous blockchain network, participants are allowed to anonymously submit threat intelligence data, which will be encrypted and recorded on the blockchain. Smart contracts can reward contributors based on the quality and importance of the data to encourage more people to participate in sharing threat intelligence data and improve the diversity and timeliness of the data. The anonymity of the data can be protected by technologies such as zero-knowledge proof.

[0148] Step S22: performing sentiment semantic analysis on the threat intelligence data to generate reliable intelligence data; performing data structuring processing on the reliable intelligence data to generate structured intelligence data;

[0149] In the embodiment of the present invention, the threat intelligence data is subjected to sentiment analysis and semantic analysis by using natural language processing technology to determine the sentiment polarity and semantic content of the data. Through sentiment semantic analysis, the threat intelligence data with neutral or positive sentiment and clear semantics is screened out to generate reliable intelligence data. The threat intelligence data is converted into a structured format, including standard fields such as threat type, attack method, affected assets, etc., to generate structured intelligence data.

[0150] Step S23: performing data clustering processing on the structured intelligence data to generate high-confidence data and low-confidence data;

[0151] In the embodiment of the present invention, the structured intelligence data is grouped by using a clustering algorithm (such as K-means clustering, hierarchical clustering, etc.), and the data is divided into different clusters according to similarity. Through the clustering results, it is determined which structured data appears more frequently, and it is marked as high-confidence data, while the less clear or uncertain data is marked as low-confidence data.

[0152] Step S24: performing submission time analysis on the high-confidence intelligence data to generate submission time distribution data; performing confidence correction on the high-confidence intelligence data based on the submission time distribution data to generate high-confidence correction data;

[0153] In an embodiment of the present invention, by analyzing the submission time of high-confidence intelligence data, the submission time distribution, such as the number of submissions per day, week, or month, is determined. Based on the submission time distribution data, the confidence of the high-confidence intelligence data is adjusted. More evenly distributed data may obtain a higher confidence, while data generated in a specific time period may have a lower confidence. High-confidence data with confidence adjustment is generated to better reflect the credibility of the data.

[0154] Step S25: extracting low-frequency words from the low-confidence data to generate special word data; screening the low-confidence data according to the special word data to generate special low-confidence data;

[0155] In the embodiment of the present invention, by analyzing the text content of the low-confidence data, uncommon or special words are extracted, and these words may contain hidden information. According to the extracted special words, the low-confidence data is screened, and the data related to the special words are retained. A low-confidence data set containing special words is generated, and these data may contain potential threat information or unusual intelligence.

[0156] Step S26: Perform submission association analysis on the special low-confidence data based on the high-confidence correction data to generate submitter association data

[0157] In an embodiment of the present invention, by analyzing the submitter information in the high confidence corrected data and the special low confidence data, it is determined whether there is a connection or commonality between the submitters. Based on the submitter association data, the special low confidence data is adjusted for confidence. If there is a connection, the credibility of the data may be improved. The low confidence corrected data with confidence adjustment is generated to more accurately reflect the credibility of the data while taking into account the submitter association information.

[0158] Preferably, step S3 comprises the following steps:

[0159] Step S31: performing feature vectorization according to the high-confidence correction data and the low-confidence correction data to generate high-confidence vector data and low-confidence vector data;

[0160] Step S32: Perform data dimensionality reduction fusion on high confidence vector data and low confidence vector data to generate dimensionality reduction intelligence data; design an attention mechanism based on the confidence in the dimensionality reduction intelligence data to generate a model attention mechanism;

[0161] Step S33: constructing a threat network model based on the dimensionality reduction intelligence data and the model attention mechanism;

[0162] Step S34: performing association path analysis on the threat network model to generate association path data; performing entity dependency analysis on the threat network model to generate entity dependency relationship data;

[0163] Step S35: performing association compensation on the association path data according to the entity dependency data to generate compensated association path data;

[0164] Step S36: training the threat network model by compensating the associated path data to generate a potential threat model;

[0165] Step S37: Perform threat exploitation probability analysis based on the potential threat model to generate threat exploitation probability data.

[0166] The present invention can make data easier to be processed and analyzed by a machine learning model by converting high-confidence correction data and low-confidence correction data into feature vectors. It is helpful to convert intelligence data into a numerical form that can be processed by the algorithm. Dimensionality reduction and fusion of high-confidence vector data and low-confidence vector data can reduce data dimensions, reduce computing costs, and retain key information. By designing an attention mechanism based on the confidence in the dimension-reduced intelligence data, important information can be highlighted and the effect of subsequent analysis can be improved. Building a threat network model based on dimension-reduced intelligence data and a model attention mechanism helps to understand the association and dependency of threats. The threat network can be analyzed more systematically, so as to better understand the nature and behavior patterns of threats. By performing association path analysis and entity dependency analysis on the threat network model, the propagation path and associated entities of the threat can be revealed. By performing association compensation on the association path data through entity dependency data, the association path data can be corrected or supplemented, making the analysis more comprehensive and accurate. By training the threat network model using compensated association path data, a more accurate potential threat model can be generated. This model can better predict and identify threats. By conducting threat exploitation probability analysis based on potential threat models, we can evaluate the possibility of actual threat exploitation and take corresponding defensive measures.

[0167] As an example of the present invention, refer to Figure 3 As shown, in this example, step S3 includes:

[0168] Step S31: performing feature vectorization according to the high-confidence correction data and the low-confidence correction data to generate high-confidence vector data and low-confidence vector data;

[0169] In the embodiment of the present invention, features are extracted from the high-confidence corrected data and the low-confidence corrected data, and these features may include text features, numerical features, time features, etc. The extracted features are converted into numerical vector form, and technologies such as Bag of Words or Word Embeddings are used to represent the text features to generate high-confidence vector data and low-confidence vector data.

[0170] Step S32: Perform data dimensionality reduction fusion on high confidence vector data and low confidence vector data to generate dimensionality reduction intelligence data; design an attention mechanism based on the confidence in the dimensionality reduction intelligence data to generate a model attention mechanism;

[0171] In an embodiment of the present invention, by using dimensionality reduction techniques such as principal component analysis (PCA) or singular value decomposition (SVD), high confidence vector data and low confidence vector data are reduced in dimension to reduce the dimension and extract the main information. The two types of data are merged to generate reduced dimension intelligence data. According to the confidence in the reduced dimension intelligence data, a model attention mechanism is designed. The attention mechanism can assign different weights according to the importance of the data so that the model pays more attention to high confidence data.

[0172] Step S33: constructing a threat network model based on the dimensionality reduction intelligence data and the model attention mechanism;

[0173] In the embodiment of the present invention, a model attention mechanism is designed based on the confidence in the dimensionality reduction intelligence data. The attention mechanism can assign different weights according to the importance of the data so that the model pays more attention to high confidence data.

[0174] Step S34: performing association path analysis on the threat network model to generate association path data; performing entity dependency analysis on the threat network model to generate entity dependency relationship data;

[0175] In an embodiment of the present invention, association path data is generated by performing association path analysis on a threat network model. This may include using a graph algorithm or network analysis technique to determine information propagation paths and relationships, such as a shortest path algorithm or a depth-first search. According to the threat network model, the entity dependencies between different threat information are analyzed. A network analysis tool (such as NetworkX) may be used to identify dependencies between entities.

[0176] Step S35: performing association compensation on the association path data according to the entity dependency data to generate compensated association path data;

[0177] In the embodiment of the present invention, the associated path data is adjusted according to the entity dependency data to more accurately reflect the relationship of the threat information, which may include adding or deleting a connection or path.

[0178] Step S36: training the threat network model by compensating the associated path data to generate a potential threat model;

[0179] In the embodiment of the present invention, the threat network model is trained by using data with associated path compensation to establish a potential threat model. Deep learning technology, such as a neural network, can be used for training.

[0180] Step S37: Perform threat exploitation probability analysis based on the potential threat model to generate threat exploitation probability data.

[0181] In the embodiment of the present invention, by using the potential threat model, the probability distribution of the threat information is analyzed to estimate the probability of the use of the threat information. It can be done by statistical analysis or simulation methods. According to the analysis results, the use probability data of the threat information is generated to assess the risk and impact of the potential threat. The probability data can be generated using statistical tools or data analysis libraries (such as Pandas or Matplotlib).

[0182] In an embodiment of the present invention, a specific threat scenario or threat hypothesis is selected. For example, a scenario about a specific threat action or attacker behavior, including attack targets, attack methods, etc. Based on the potential threat model and the selected threat scenario, a probability model is established to estimate the probability of exploitation of the potential threat. A Bayesian network, a probabilistic graph model, a machine learning model, or other applicable methods can be used. The data (association paths, entity dependencies, compensating association paths, etc.) in the potential threat model is imported into the probability model as the input of the model. For the parameters in the probability model, parameter estimation is performed. For example, by analyzing and statistically estimating historical data, the probability distribution in the model is determined. The probability model is used for inference through methods such as Bayesian inference and Monte Carlo simulation to estimate the probability of exploitation of the potential threat in the selected threat scenario. The output of the analysis model, including the probability of exploitation of the potential threat, generates threat exploitation probability data.

[0183] Preferably, step S4 comprises the following steps:

[0184] Step S41: construct a virtual environment; use the attack load data to simulate an attack on the virtual environment and generate a first load attack report;

[0185] Step S42: performing a load update design on the attack load data according to the threat utilization probability data to generate a threat attack load;

[0186] Step S43: performing threat attack simulation on the virtual environment data based on the threat attack payload, and generating a second payload attack report;

[0187] Step S44: performing similar attack analysis on the first load attack report and the second load attack report to generate a comprehensive load attack report;

[0188] Step S45: formulate a reinforcement strategy based on the comprehensive load attack report and generate reinforcement strategy data.

[0189] The present invention can evaluate the performance of the system when it is attacked by constructing a virtual environment and performing attack simulation. It is helpful to discover potential vulnerabilities and weaknesses and identify the weak links of the system in advance. Updating the attack load according to the threat utilization probability data can make the attack simulation more realistic and close to the actual threat. It is helpful to simulate the latest threat forms and improve the defense capability against new attacks. Simulating based on the updated threat attack load and generating a second load attack report can more comprehensively evaluate the security of the system. It is helpful to discover the weaknesses and possible response strategies of the system under different attack scenarios. By performing similar attack analysis on the first and second load attack reports and generating a comprehensive load attack report, common attack patterns and vulnerabilities can be identified. This helps to formulate a more comprehensive and targeted reinforcement strategy. Based on the comprehensive load attack report, a reinforcement strategy can be formulated to improve the security of the system in a targeted manner. It helps to take measures to prevent known and potential threats and reduce the impact of potential attacks on the system.

[0190] As an example of the present invention, refer to Figure 4 As shown, in this example, step S4 includes:

[0191] Step S41: construct a virtual environment; use the attack load data to simulate an attack on the virtual environment and generate a first load attack report;

[0192] In an embodiment of the present invention, an isolated virtual environment is created to simulate a target system or network, which can be achieved using virtualization technology (such as VMware, VirtualBox) or a cloud platform. Prepare attack payload data, which may include malware, vulnerability exploitation tools, or custom attack scripts. Deploy attack payloads in a virtual environment to simulate different types of attack behaviors, including malware propagation, port scanning, vulnerability exploitation, etc. Monitor the network traffic and system logs of the virtual environment to capture data on attack behaviors. Generate a first payload attack report based on the captured data, describing the method of attack, the affected system, and possible threats.

[0193] Step S42: performing a load update design on the attack load data according to the threat utilization probability data to generate a threat attack load;

[0194] In an embodiment of the present invention, by using the threat exploitation probability data, the potential threat of the attack payload data is evaluated. The attack methods with high probability are identified. Based on the analysis results, the attack payload data is updated to include new attack methods or variants. This may include modifying the malware code, changing the attack parameters, etc. An updated attack payload is generated to include the attack methods identified in the threat exploitation probability data.

[0195] Step S43: performing threat attack simulation on the virtual environment data based on the threat attack payload, and generating a second payload attack report;

[0196] In the embodiment of the present invention, a new threat attack is simulated by deploying the updated attack payload into the virtual environment. The network traffic and system logs of the virtual environment are monitored again to capture data of the second attack behavior. A second payload attack report is generated based on the captured data, describing the new attack method, the affected system, and the possible threat.

[0197] Step S44: performing similar attack analysis on the first load attack report and the second load attack report to generate a comprehensive load attack report;

[0198] In the embodiment of the present invention, by comparing the first payload attack report and the second payload attack report, similar attack methods and differences are identified. Based on the results of similar attack analysis, the same attack methods are screened out, the advantages and disadvantages of similar attack methods are analyzed, and the data of the two attacks are integrated to more comprehensively describe the threat and generate a comprehensive payload attack report.

[0199] Step S45: formulate a reinforcement strategy based on the comprehensive load attack report and generate reinforcement strategy data.

[0200] In the embodiment of the present invention, a reinforcement strategy is formulated based on the threat analysis results in the comprehensive payload attack report, including patching vulnerabilities, improving security configuration, implementing access control, etc. The reinforcement strategy is clarified in the form of data, including specific steps, priorities, and schedules. According to the reinforcement strategy data, corresponding security reinforcement measures are implemented in a virtual environment or an actual production environment.

[0201] In an embodiment of the present invention, the comprehensive payload attack report is analyzed in detail to understand the nature of the attack, the degree of threat, the attack path, and the vulnerability points. The security measures of the current system or network are determined, including firewalls, intrusion detection systems, vulnerability management, etc., so as to understand the effectiveness and weaknesses of the measures. Based on the analysis of the comprehensive payload attack report, specific reinforcement strategies are formulated, such as methods such as patching known vulnerabilities, updating security configurations, and strengthening access control. The reinforcement strategy is clarified in the form of data, including specific steps, priorities, and schedules. Based on the severity of the threat and the potential risks, determine which strategies should be implemented first, so as to prioritize the formulated reinforcement strategies. Regularly evaluate the effectiveness of implemented strategies, and update the strategies based on new threat intelligence and attack situations.

[0202] Preferably, step S5 comprises the following steps:

[0203] Step S51: Evaluate the attack cost through the comprehensive load attack report to generate attack cost analysis data;

[0204] Step S52: Perform reinforcement cost evaluation on the reinforcement strategy data to generate reinforcement cost data;

[0205] Step S53: Use the repair necessity evaluation formula to perform repair necessity evaluation on the attack cost analysis data and the reinforcement cost data to generate a repair necessity score.

[0206] Step S54: Transmit the reinforcement strategy data and the repair necessity score to the terminal to generate a reinforcement test report.

[0207] The present invention can estimate the potential cost of an attacker by analyzing the comprehensive payload attack report. It helps to understand the economic motivation of the attack and assess the risk to the system. It helps to determine which vulnerabilities or threats are the most threatening. Cost assessment of the established reinforcement strategies can determine the resources and costs required to implement these strategies. It helps to decide whether you are willing to bear these costs to improve the security of the system. Using the repair necessity assessment formula combined with the attack cost and reinforcement cost data, it can be determined which vulnerabilities or threats should be repaired with the highest priority. It helps to allocate limited security resources to the most urgent issues to minimize risks. Transmitting the reinforcement strategy data and the repair necessity score to the terminal to generate a reinforcement test report helps to provide a clear action plan. This report can include specific steps and timetables to help ensure that the security of the system is improved to reduce potential threats.

[0208] In an embodiment of the present invention, the threat described in the comprehensive load attack report is evaluated for cost, including the time, resources, skills and tool costs of the attack. This can be done based on the results of threat analysis and simulated attacks. The attack cost evaluation results are organized into data, including cost estimates, attack methods and impacts. The cost of implementing the reinforcement strategy is evaluated, including time, resources, manpower and technical requirements. This can be done based on the specific steps and implementation process of the reinforcement strategy. The reinforcement cost evaluation results are organized into data, including cost estimates, reinforcement strategies and required resources. A preset repair necessity evaluation formula is used, which fully considers the reinforcement cost, attack cost, attack frequency, and vulnerability impact variables to objectively, accurately and in real time evaluate the necessity of each threat found in the test to be repaired, and generate a repair necessity score. It is used to measure which threats need to be repaired more urgently and which reinforcement strategies are most worth implementing. In addition to the preset formula, evaluation can also be performed through expert opinions, subjective weighing, return on investment analysis and other methods to obtain a repair necessity score. The generated reinforcement strategy data and repair necessity score are transmitted to the terminal device, which may include network transmission or data export. On the terminal device, the transmitted data is used to generate a reinforcement test report. The report includes the recommended hardening strategy, its repair necessity score, and implementation recommendations. This can be done through a report generation tool or a custom script. Submit the generated hardening test report to the relevant security team or management to support decision making and implementation of hardening measures.

[0209] Preferably, the repair necessity evaluation formula in step S53 is as follows:

[0210]

[0211] In the formula, X is the necessity assessment score, T1 is the start time of the necessity assessment, T2 is the end time of the necessity assessment, and H j (m) is the reinforcement cost at time m, H g (m) is the attack cost at time m, f(m) is the attack frequency at time m, V(m) is the vulnerability impact value at time m, O(m) is the threat severity score at time m, g(m) is the vulnerability exposure probability value at time m, E(m) is the vulnerability exposure value at time m, P(m) is the threat occurrence probability value at time m, A bias adjustment value for the necessity assessment score.

[0212] The present invention constructs a repair necessity assessment formula, which is used to evaluate the repair necessity of attack cost analysis data and reinforcement cost data and generate a repair necessity score. The formula fully considers the start time T1 of the necessity assessment, the end time T2 of the necessity assessment, and the reinforcement cost H at time m. j (m), the attack cost H at time m g (m), the attack frequency value f(m) at time m, the vulnerability impact value V(m) at time m, the threat severity score O(m) at time m, the vulnerability exposure probability value g(m) at time m, the vulnerability exposure value E(m) at time m, the threat occurrence probability value P(m) at time m, and the deviation adjustment value of the necessity assessment score and the interactions between variables to form the following functional relationship:

[0213]

[0214] By H g (m)-H j(m) is used to obtain the difference between the attack cost and the reinforcement cost. When the value is positive, it means that the reinforcement cost is greater than the attack cost. The greater the probability of the corresponding vulnerability threat being exploited, the greater the corresponding repair necessity score, and measures need to be taken to reduce the risk. f(m) indicates the possibility of an attack at this point in time. If f(m) is higher, attacks may occur more frequently during this time period, increasing the urgency of repairing the vulnerability. V(m) indicates the impact of the vulnerability on the system after it is exploited. If V(m) is large, the vulnerability may cause greater harm to the system after it is exploited, increasing the urgency of repairing the vulnerability. O(m) indicates the severity of the threat. A higher threat severity score may mean that the impact of the attack is more serious. Through H g (m)+H j (m) to get the sum of the attack cost and the reinforcement cost, that is, the total cost. The total cost data helps to determine which vulnerability threats pose a greater threat to the security of server data and need to be dealt with first. If g(m) is higher, the vulnerability is more likely to be exploited by attackers during this time period; if E(m) is higher, the vulnerability in the system is more likely to be discovered; if P(m) is higher, the threat is more likely to occur. The reference to time integral takes into account the changes in various relevant parameters of vulnerability threats over time, and dynamically evaluates the necessity of vulnerability repair. This functional relationship can accurately and real-time evaluate the necessity of repairing each threat discovered in the test, thereby obtaining a repair necessity score, which can be fed back to the terminal device to help make more accurate and necessary decisions. And use the deviation adjustment value of the necessity assessment score Adjust and modify the functional relationship. For example, if the current calculated necessity score is low, that is, the repair urgency is low, but the risk has not appeared in historical data, then we should consider whether to use Adjustments are made to reduce the impact of errors caused by this data or error term, so as to more accurately generate the necessity assessment score X, and improve the accuracy and reliability of the repair necessity assessment of the attack cost analysis data and the reinforcement cost data. At the same time, the adjustment value in the formula can be adjusted according to the actual situation and applied to the repair necessity assessment of different risk vulnerabilities, which improves the flexibility and applicability of the algorithm.

[0215] The beneficial effect of the present application is that the present invention obtains a kernel log file, which contains key information about the operation of the system, such as abnormal events and error messages. By obtaining these files, potential problems can be quickly identified. Analyzing the traffic state in the kernel log file helps to identify anomalies in network traffic, such as large-scale data packet transmission or frequent connection attempts. Integrating abnormal traffic data into comprehensive abnormal traffic data helps to more comprehensively understand the abnormal situations that may exist in the system. Based on the abnormal traffic data, attack payloads are designed, which can be used to simulate potential attack behaviors and help to discover system weaknesses and vulnerabilities. Threat intelligence data includes information about the latest threats and attacks from multiple sources to understand the current threat environment. Clustering the threat intelligence data can classify related information together to provide a clearer threat image. Dividing the intelligence data into high-confidence and low-confidence data can focus on the most important and most credible information. Confidence correction of low-confidence data helps to improve the availability and credibility of the data. Using high-confidence data and low-confidence data to build a threat model helps the system better understand the nature and potential threats of different threats. Through probability analysis, the actual utilization probability of different threats can be estimated, which helps to determine which threats are more likely to pose a threat to the system. Using attack payload data and threat utilization probability data, actual attack scenarios are simulated to understand the vulnerabilities and potential attack paths in the system. An attack report is generated, detailing the simulation results of the attack, which helps to identify the weak points that need to be taken. Based on the results of the attack simulation, a reinforcement strategy is formulated to reduce the vulnerability of the system and improve security. According to the comprehensive load attack report and reinforcement strategy data, the urgency of the vulnerabilities and vulnerabilities that need to be repaired in the system is evaluated. The reinforcement strategy data and the repair necessity score are transmitted to the terminal, and a reinforcement test report is generated to verify the effectiveness of the reinforcement measures and the improvement of the system. Therefore, the reinforcement test method based on kernel protection server data of the present invention constructs a potential threat model through threat intelligence data to timely discover hidden vulnerabilities and weaknesses. By designing an attack payload to simulate an attack, the possibility of hidden vulnerabilities being exploited is determined to improve the accuracy of the reinforcement test.

[0216] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0217] The above description is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A reinforcement test method based on kernel protection server data, characterized in that: The following steps are involved: Step S1: Obtain kernel log file; Analyze traffic status based on kernel log files and generate comprehensive abnormal traffic data; Design attack payload based on comprehensive abnormal traffic data and generate attack payload data; Step S2: Obtain threat intelligence data; Perform data clustering on threat intelligence data to generate high-confidence data and low-confidence data; perform confidence correction on high-confidence data and low-confidence data to generate high-confidence corrected data and low-confidence corrected data; Step S3: constructing a potential threat model based on the high-confidence correction data and the low-confidence correction data; Perform threat exploitation probability analysis through potential threat models to generate threat exploitation probability data; Step S4: Perform attack simulation based on attack payload data and threat exploitation probability data to generate a comprehensive payload attack report; Formulate reinforcement strategies based on comprehensive payload attack reports and generate reinforcement strategy data; Step S5: Perform a repair necessity assessment based on the comprehensive load attack report and the reinforcement strategy data to generate a repair necessity score; transmit the reinforcement strategy data and the repair necessity score to the terminal to generate a reinforcement test report; Step S1 includes the following steps: Step S11: Obtain the kernel log file; Step S12: Perform traffic status analysis according to the kernel log file to generate normal traffic data and abnormal traffic data; Step S13: Tracing the source of the normal traffic data to generate hidden abnormal traffic data; Step S14: Supplement the abnormal traffic data with abnormal data according to the hidden abnormal traffic data to generate comprehensive abnormal traffic data; Step S15: Design an attack payload based on the comprehensive abnormal traffic data to generate attack payload data; Step S13 includes the following steps: Step S131: extract the number of visits to normal traffic data to generate visit number data; Step S132: design data labels for the visit number data based on a preset visit number threshold, and when the visit number data is less than or equal to the preset visit number threshold, generate low visit label data; when the visit number data is greater than the preset visit number threshold, generate high visit label data; Step S133: trace the source of normal traffic data according to the low visit label data to generate low visit traffic source tracing data; Step S134: perform data analysis on the low visit traffic source tracing data to generate low imitation abnormal traffic data; Step S135: perform access habit analysis on normal traffic data according to the high access label data to generate special access habit data; Step S136: integrate the low imitation abnormal traffic data with the special access habit data to generate hidden abnormal traffic data; Step S134 includes the following steps: Step S1341: Perform IP address statistics according to the kernel log file to generate IP address distribution data; Step S1342: Use the IP address distribution data to classify the low-visit traffic tracing data to generate low-visit area address data and high-visit area address data; Step S1343: Perform communication behavior analysis on the low-imitation area address data to generate low-imitation area abnormal data; Step S1344: extract request information based on high-imitation area address data to generate request information data; Step S1345: calculate the reasonable value of the request information data using the request rationality calculation formula to generate a request rationality score; Step S1346: analyze the abnormal access of the high-visit area address data through the request rationality score to generate high-imitation area abnormal data; Step S1347: fuse the low-imitation area abnormal data with the high-imitation area abnormal data to generate comprehensive abnormal traffic data; The formula for calculating the request rationality in step S1345 is as follows: Where R is the request rationality score, t1 is the request start time, t2 is the request end time, N(t) is the total number of requests in time period t, T is the duration of time period t, and a t is the weight of time period t, τ0 is the start time of time period t, τ is the end time of time period t, c s is the network fluctuation value at time s, e is the base of the natural logarithm, b s is the request density value at time s, β is the request type weight, n is the total number of request time periods, y i is the i-th request type, ω is the deviation adjustment item of the request rationality score; Step S2 includes the following steps: Step S21: construct a threat intelligence network using blockchain technology; obtain threat intelligence data based on the threat intelligence network; Step S22: perform sentiment semantic analysis on threat intelligence data to generate reliable intelligence data; perform data structuring processing on reliable intelligence data to generate structured intelligence data; Step S23: perform data clustering processing on structured intelligence data to generate high-confidence data and low-confidence data; Step S24: perform submission time analysis on high-confidence intelligence data to generate submission time distribution data; perform confidence correction on high-confidence intelligence data based on submission time distribution data to generate high-confidence corrected data; Step S25: perform low-frequency vocabulary extraction on low-confidence data to generate special vocabulary data; perform data screening on low-confidence data based on special vocabulary data to generate special low-confidence data; Step S26: perform submission association analysis on special low-confidence data based on high-confidence corrected data to generate submitter association data; perform confidence correction on special low-confidence data based on submitter association data to generate low-confidence corrected data; Step S3 includes the following steps: Step S31: quantize the features according to the high-confidence correction data and the low-confidence correction data to generate high-confidence vector data and low-confidence vector data; Step S32: perform data dimension reduction fusion on the high-confidence vector data and the low-confidence vector data to generate dimension reduction intelligence data; design the attention mechanism according to the confidence in the dimension reduction intelligence data to generate the model attention mechanism; Step S33: construct the threat network model according to the dimension reduction intelligence data and based on the model attention mechanism; Step S34: perform association path analysis on the threat network model to generate association path data; perform entity dependency analysis on the threat network model to generate entity dependency relationship data; Step S35: perform association compensation on the association path data according to the entity dependency relationship data to generate compensated association path data; Step S36: perform model training on the threat network model through the compensated association path data to generate a potential threat model; Step S37: perform threat exploitation probability analysis according to the potential threat model to generate threat exploitation probability data; Step S4 includes the following steps: Step S41: construct a virtual environment; use the attack payload data to simulate the attack on the virtual environment and generate a first payload attack report; step S42: perform payload update design on the attack payload data according to the threat utilization probability data and generate a threat attack payload; step S43: perform threat attack simulation on the virtual environment data based on the threat attack payload and generate a second payload attack report; step S44: perform similar attack analysis on the first payload attack report and the second payload attack report and generate a comprehensive payload attack report; step S45: formulate a reinforcement strategy based on the comprehensive payload attack report and generate reinforcement strategy data.

2. The method for reinforcing server data based on kernel protection according to claim 1 is characterized in that: Step S5 includes the following steps: Step S51: Evaluate the attack cost through the comprehensive load attack report to generate attack cost analysis data; Step S52: Perform reinforcement cost evaluation on the reinforcement strategy data to generate reinforcement cost data; Step S53: using the repair necessity evaluation formula to evaluate the attack cost analysis data and the reinforcement cost data for repair necessity, and generating a repair necessity score; Step S54: Transmit the reinforcement strategy data and the repair necessity score to the terminal to generate a reinforcement test report.

3. The method for reinforcing and testing server data based on kernel protection according to claim 2 is characterized in that: The repair necessity evaluation formula in step S53 is as follows: In the formula, X is the necessity assessment score, T1 is the start time of the necessity assessment, T2 is the end time of the necessity assessment, and H j (m) is the reinforcement cost at time m, H g (m) is the attack cost at time m, f(m) is the attack frequency at time m, V(m) is the vulnerability impact value at time m, O(m) is the threat severity score at time m, g(m) is the vulnerability exposure probability value at time m, E(m) is the vulnerability exposure value at time m, P(m) is the threat occurrence probability value at time m, A bias adjustment value for the necessity assessment score.

Images