Data security protection method, system, device and storage medium

Abstract

The present application provides a data security protection method, system, device and storage medium, which performs risk system diversion on historical access risk data to obtain access pass system data and access exception system data, performs credit decision processing on the access exception system data to obtain credit exception space, determines the access credit step according to the credit exception space, performs permission check according to the access credit step and the access pass system data, determines the access risk entropy according to the security protection permission set, identifies the risk threshold of the access risk entropy, obtains a fixed threshold corresponding to the strong protection risk and an elastic threshold corresponding to the weak protection risk, determines the data risk tolerance according to the fixed threshold corresponding to the strong protection risk and the elastic threshold corresponding to the weak protection risk, and triggers a data security protection warning if the data risk tolerance is higher than the preset maximum data security access quota, which can improve the effectiveness of data security protection when risks of different systems appear in data security protection.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and more specifically, to a data security protection method, system, device and storage medium. Background Art

[0002] Data security technology is a technology used to ensure the confidentiality, integrity and availability of data to prevent unauthorized access, leakage, tampering or destruction, including data encryption, access control, backup and recovery, network security, malware protection, security updates, security auditing and monitoring, identity authentication, data classification, compliance and regulatory compliance, etc., aiming to protect data from various potential threats and attacks, maintain the privacy of organizations and individuals, and protect sensitive data and digital assets.

[0003] Data security protection method is a method of protecting data by encrypting data, setting up firewalls and data backup. With the continuous development of data security protection methods, facing more complex data storage environments, data security protection methods are also constantly improving. At present, more data is protected through the implementation of access control strategies, including the use of usernames and passwords, role-based settings, etc. However, when risks of different systems arise in data security protection, it will affect the decision-making ability of access control, thereby reducing the effectiveness of data security protection. Summary of the invention

[0004] The present application provides a data security protection method, system, device and storage medium to solve the technical problem that the effectiveness of data security protection is reduced when risks of different systems arise in data security protection.

[0005] In order to solve the above technical problems, this application adopts the following technical solutions:

[0006] In a first aspect, the present application provides a data security protection method, comprising the following steps:

[0007] Start data security protection monitoring, obtain historical access risk data in the access event database, perform risk system diversion on the historical access risk data, and obtain access pass system data and access exception system data;

[0008] Performing credit decision processing on the access exception system data to obtain a credit exception space, determining an access credit step length according to the credit exception space, and performing permission check according to the access credit step length and the access pass system data to obtain a security protection permission set;

[0009] Determine access risk entropy according to the security protection permission set, perform risk threshold identification on the access risk entropy to obtain a fixed threshold corresponding to a strong protection risk and an elastic threshold corresponding to a weak protection risk, and determine data risk tolerance according to the fixed threshold corresponding to the strong protection risk and the elastic threshold corresponding to the weak protection risk;

[0010] Determine whether the data risk tolerance is higher than the preset maximum data security access quota. If the data risk tolerance is lower than the preset maximum data security access quota, control the data security protection to be in a silent state. If the data risk tolerance is higher than the preset maximum data security access quota, trigger a data security protection warning.

[0011] In some embodiments, the risk system diversion of the historical access risk data to obtain access pass system data and access exception system data specifically includes:

[0012] Obtain the access request time from all request data that actively initiates access requests;

[0013] Determine the access request balancing feature according to the access request time in all the request data of actively initiating the access request;

[0014] Determine access pass system data and access exception system data according to the access request balance feature

[0015] In some embodiments, performing permission checking according to the access authorization step length and the access pass system data to obtain a security protection permission set specifically includes:

[0016] Obtaining a credit step length set for accessing the credit step length;

[0017] Smoothing the access and passage system data to obtain access and passage smoothness;

[0018] The access smoothness is mapped to the credit step set to obtain a security protection permission set.

[0019] In some embodiments, determining the access risk entropy according to the security protection permission set specifically includes:

[0020] Determining a maximum value and a minimum value of the security protection permission data in the security protection permission set;

[0021] Determine the security timing flow according to the security protection permission data in the security protection permission set;

[0022] Preset access resolution factor;

[0023] The access risk entropy is determined according to the access resolution factor, the security timing flow, and the maximum and minimum values ​​of the security protection permission data in the security protection permission set.

[0024] In some embodiments, the access risk entropy is determined by the following formula:

[0025]

[0026] Among them, ζ represents the access risk entropy, X min represents the minimum value of the security protection permission data in the security protection permission set, X max represents the maximum value of the security protection permission data in the security protection permission set, υ represents the access resolution factor, x i (t) represents the i-th security timing traffic, and t represents the access time.

[0027] In some embodiments, the risk threshold is identified on the access risk entropy to obtain a fixed threshold corresponding to a strong protection risk and an elastic threshold corresponding to a weak protection risk, specifically including:

[0028] Determining the main frequency characteristics of the risk link according to the security protection permission set;

[0029] Determine the risk delay frequency modulation component according to the access abnormality signal delay of the access abnormality system data;

[0030] Threshold scheduling is performed on the main frequency characteristics of the risk link and the risk delay frequency modulation component to obtain a fixed threshold corresponding to a strong protection risk and an elastic threshold corresponding to a weak protection risk.

[0031] In some embodiments, historical access risk data in the access event database may be obtained through a database management tool.

[0032] In a second aspect, the present application provides a data security protection system, which includes a data security identification unit, and the data security identification unit includes:

[0033] A data access system determination module is used to start data security protection monitoring, obtain historical access risk data in the access event database, perform risk system diversion on the historical access risk data, and obtain access pass system data and access exception system data;

[0034] A security protection permission set determination module is used to perform credit decision processing on the access exception system data to obtain a credit exception space, determine an access credit step length according to the credit exception space, perform permission inspection according to the access credit step length and the access pass system data, and obtain a security protection permission set;

[0035] A data risk tolerance determination module is used to determine the access risk entropy according to the security protection permission set, perform risk threshold identification on the access risk entropy, obtain a fixed threshold corresponding to the strong protection risk and an elastic threshold corresponding to the weak protection risk, and determine the data risk tolerance according to the fixed threshold corresponding to the strong protection risk and the elastic threshold corresponding to the weak protection risk;

[0036] The security protection warning module is used to determine whether the data risk tolerance is higher than the preset maximum data security access quota. If the data risk tolerance is lower than the preset maximum data security access quota, the data security protection is controlled to be in a silent state. If the data risk tolerance is higher than the preset maximum data security access quota, a data security protection warning is triggered.

[0037] In a third aspect, the present application provides a computer device, comprising a memory and a processor, wherein the memory stores a code, and the processor is configured to obtain the code and execute the above-mentioned data security protection method.

[0038] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program implements the above-mentioned data security protection method when executed by a processor.

[0039] The technical solution provided by the embodiments disclosed in this application has the following beneficial effects:

[0040] In the data security protection method, system, device and storage medium provided by the present application, data security protection monitoring is first started, historical access risk data in the access event database is obtained, risk system diversion is performed on the historical access risk data, access pass system data and access exception system data are obtained, credit decision processing is performed on the access exception system data, and credit exception space is obtained, the access credit step is determined according to the credit exception space, permission is checked according to the access credit step and the access pass system data, a security protection permission set is obtained, access risk entropy is determined according to the security protection permission set, risk threshold identification is performed on the access risk entropy, a fixed threshold corresponding to a strong protection risk and an elastic threshold corresponding to a weak protection risk are obtained, data risk tolerance is determined according to the fixed threshold corresponding to the strong protection risk and the elastic threshold corresponding to the weak protection risk, and it is determined whether the data risk tolerance is higher than the preset maximum data security access quota. If the data risk tolerance is lower than the preset maximum data security access quota, the data security protection is controlled to be in a silent state. If the data risk tolerance is higher than the preset maximum data security access quota, a data security protection warning is triggered.

[0041] The present application divides the historical access risk data into risk system diversions, can quickly identify access abnormal data, provide convenience for further analysis of access abnormal data, perform credit decision processing, can better manage data access security risks, and after license inspection, can more accurately determine whether access is approved or rejected under the premise of ensuring data security, which helps to ensure legal access to data and reduce potential risks. Determine access risk entropy, which helps to evaluate data access risks. The fixed threshold corresponding to strong protection risk and the elastic threshold corresponding to weak protection risk can more accurately control access risks. The fixed threshold corresponding to strong protection risk and the elastic threshold corresponding to weak protection risk can flexibly adjust the intensity of access risks. The data risk tolerance can better understand the tolerance of the data security protection system to access risks, thereby clarifying the acceptable risk level and the critical point for triggering alarms, thereby improving the intelligence of data security protection. By comparing the maximum data security access quota with the data risk tolerance, it is determined whether the protected data has security risks, and the level of data security protection is improved, so that when risks of different systems appear in data security protection, the effectiveness of data security protection can be effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 is an exemplary flow chart of a data security protection method according to some embodiments of the present application;

[0043] Figure 2 A schematic diagram of a flow chart for determining a fixed threshold corresponding to a strong protection risk and an elastic threshold corresponding to a weak protection risk in some embodiments of the present application;

[0044] Figure 3 is a schematic diagram of exemplary hardware and / or software of a data security identification unit according to some embodiments of the present application;

[0045] Figure 4 It is a structural diagram of a computer device for implementing a data security protection method according to some embodiments of the present application. DETAILED DESCRIPTION

[0046] The core of this application is to divert historical access risk data through risk systems to obtain access pass system data and access exception system data, perform credit decision processing on the access exception system data to obtain credit exception space, determine the access credit step according to the credit exception space, perform permission check according to the access credit step and access pass system data, determine the access risk entropy according to the security protection permission set, identify the risk threshold of the access risk entropy, and obtain a fixed threshold corresponding to the strong protection risk and an elastic threshold corresponding to the weak protection risk, determine the data risk tolerance according to the fixed threshold corresponding to the strong protection risk and the elastic threshold corresponding to the weak protection risk, and if the data risk tolerance is higher than the preset maximum data security access quota, a data security protection warning is triggered, which can effectively improve the effectiveness of data security protection when risks of different systems appear in data security protection.

[0047] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods. Figure 1 , which is an exemplary flow chart of a data security protection method according to some embodiments of the present application. The data security protection method 100 mainly includes the following steps:

[0048] In step 101, data security protection monitoring is started, historical access risk data in the access event database is obtained, and risk system diversion is performed on the historical access risk data to obtain access pass system data and access exception system data.

[0049] It should be noted that data security protection monitoring in this application refers to regular and systematic inspection and tracking of data security status in order to promptly detect and respond to potential threats, risks or abnormal situations. The main goal of data security monitoring is to ensure the confidentiality, integrity and availability of data, and take timely measures to prevent or mitigate potential threats, which will not be repeated here.

[0050] In a specific implementation, the above steps obtain historical access risk data in an access event database, which is a database composed of all data related to access data in the data security protection process, including all request data for actively initiating access requests, data resources that can be accessed in the system, various access operation records for protected data, and various response information data occurring in the access control process, wherein all request data for actively initiating access requests refers to the number of times access requests are received for protected security data, the data resources that can be accessed in the system refers to the range of data that is determined to be accessible after receiving an access request in the data security protection system, the various access operation records for protected data refers to the number of times access is requested again or access is terminated after initiating access to the protected data and being denied, and the various response information data occurring in the access control process refers to the range of data requested for access in access control, and the range of data includes the range of data that is allowed to be accessed and the range of data that is denied to be accessed; the historical access risk data is data related to access risks composed of data in the access event database, and in a specific implementation, the historical access risk data in the access event database can be obtained through a database management tool such as "MySQL Workbench".

[0051] In some embodiments, the risk system diversion of the historical access risk data to obtain access pass system data and access exception system data can be implemented by the following steps:

[0052] Obtain the access request time from all request data that actively initiates access requests;

[0053] Determine the access request balancing feature according to the access request time in all the request data of actively initiating the access request;

[0054] Access pass system data and access exception system data are determined according to the access request balance characteristics.

[0055] In specific implementation, the access request time in all request data of actively initiating access requests is read through the database query language SQL in the prior art. The access request time is the time from each access request initiation to obtaining the access request result. The access request result is the preliminary judgment made by the system after receiving the access request, and the access is approved or rejected. The access request time for approved access is shorter, and the access request time for rejected access is longer. The time for waiting for judgment is the access request time. In all request data of actively initiating requests, each access corresponds to an access request time. In this application, the result obtained by dividing the total time of all access requests by the total number of accesses is used as the access request balance feature, which is the feature data for distinguishing the access system; the access request time in all request data of actively initiating access requests is traversed, and compared with the access request balance feature one by one until the comparison with the access request time in all request data of actively initiating access requests is completed. When the access time in all request data of actively initiating access requests is less than the access request balance feature, the access time is classified as the access pass system data. When the access time in all request data of actively initiating access requests is greater than or equal to the access request balance feature, the access time is classified as the access abnormal system data.

[0056] It should be noted that the access pass system data in the present application is a data system composed of data whose request time for actively initiating an access request is less than the access request balance characteristic, and the access anomaly system data is a data system composed of data whose request time for actively initiating an access request is equal to or greater than the access request balance characteristic. In the present application, the historical access risk data is diverted into the risk system, which can quickly identify access anomaly data and facilitate further analysis of access anomaly data.

[0057] In step 102, the access exception system data is processed for credit decision to obtain a credit exception space, an access credit step is determined based on the credit exception space, and a permission check is performed based on the access credit step and the access pass system data to obtain a security protection permission set.

[0058] In some embodiments, credit decision processing is performed on the access exception system data to obtain the credit exception space, which can be achieved by using the following steps:

[0059] Obtain access exception time in access exception system data;

[0060] Subtract all access exception times in the access exception system data from the access exception benchmark time to obtain the access exception signal delay;

[0061] Performing credit prediction on the access abnormality system data and the access abnormality signal delay to obtain an access credit prediction degree;

[0062] The credit abnormality space is determined according to the access credit prediction degree.

[0063] In specific implementation, the access exception system data includes the number of access exceptions, and each access exception has a corresponding access exception time. The number of all access exceptions is divided by the sum of all access exception times to obtain the average access exception time. The average access exception time is used as the access exception reference time. All access exception times in the access exception system data are subtracted from the access exception reference time to obtain the access exception signal delay. The result that is positive or zero after subtraction is used as the positive delay of the access exception signal, and the result that is negative after subtraction is used as the negative delay of the access exception signal. For example, if the access exception reference time is 2 and the access time in the access exception system data is 1, 0, 2, 3, the result after subtraction is -1, -2, 0. ,1, 0,1 belongs to the positive delay of the access abnormality signal, -1,-2 belongs to the negative delay of the access abnormality signal, credit prediction is performed on the access abnormality system data and the access abnormality signal delay, the number of accesses corresponding to all negative delays of the access abnormality signals in the access abnormality system data is counted, and probability calculation is performed on the number of accesses corresponding to all negative delays of the access abnormality signals and all accesses in the access abnormality system data, the number of accesses corresponding to all negative delays of the access abnormality signals is used as the sample number of probability calculation, and all accesses in the access abnormality system data are used as the total number of probability calculations to obtain the access probability of the access abnormality system, and the access probability of the access abnormality system is used as the access credit prediction degree.

[0064] It should be noted that in the present application, the credit anomaly space is determined according to the access credit prediction degree, which is to multiply the number of accesses corresponding to the positive delay of the access anomaly signal by the access credit prediction degree to obtain the access anomaly credit expectation, each access anomaly credit expectation corresponds to an access time, and the access anomaly credit expectation and the corresponding access time constitute the credit anomaly space.

[0065] In a specific implementation, determining the access credit step length according to the credit exception space is to establish a Cartesian coordinate system according to the access credit exception expectation and the time corresponding to the access credit expectation, taking the access credit exception expectation as the ordinate of the Cartesian coordinate system, taking 0 as the coordinate origin, and 2 unit lengths as a coordinate value, starting from the coordinate origin, according to the extension direction of the ordinate, according to the first coordinate value of 2, the second coordinate value of 4, that is, the marking interval of two adjacent coordinate values ​​is 2, and the coordinate value of the ordinate is marked, and the access credit exception expectation is scaled to between 0 and 10 through a computer program, and the access credit exception expectation is used as the ordinate of the Cartesian coordinate system. The time corresponding to the access abnormal credit expectation is used as the horizontal coordinate, with 0 as the coordinate origin, and according to the extension direction of the horizontal coordinate, with 0.5ms as a coordinate value, the first coordinate value is 0.5, the second coordinate value is 1, that is, the marking interval of two adjacent coordinate values ​​is 0.5, and the marking of all the coordinate values ​​of the horizontal coordinate is completed. The maximum coordinate value on the horizontal coordinate is greater than or equal to the maximum value of the time corresponding to the access abnormal credit expectation. The time unit corresponding to the access abnormal credit expectation is unified into "ms" as the time unit by using a computer program, and the time corresponding to the access abnormal credit expectation is arranged from small to large to obtain the order of abnormal credit access. time, starting from the first abnormal credit access time, find the corresponding coordinate value on the horizontal axis, and then determine the abnormal access credit expectation of the vertical axis according to the coordinate value, determine the point in the first Cartesian coordinate system that represents the abnormal access credit expectation and the time corresponding to the access credit expectation, and then determine the point in the second Cartesian coordinate system that represents the abnormal access credit expectation and the time corresponding to the access credit expectation, until all the points of the abnormal access credit expectation and the time corresponding to the access credit expectation are determined, connect all the points with a smooth curve to form an abnormal access credit expectation-time curve, and calculate the access credit expectation. The average value of the corresponding time, determine the corresponding access abnormal credit expectation according to the average value of the access credit expectation corresponding time in the Cartesian coordinate system, get the position point, connect the position point and the coordinate origin, get a straight line passing through the origin, and use the straight line as the access abnormal credit expectation-time straight line. Calculate the distance between the position on the access abnormal credit expectation-time curve and the straight line passing through the origin through the point-to-straight line distance formula, complete the calculation of all distances, and combine all distances into an access credit step. The access credit step described in this application is the distance from the access abnormal credit expectation-time curve to the access abnormal credit expectation-time straight line.

[0066] In some embodiments, the following steps may be used to perform permission checking based on the access authorization step length and the access pass system data to obtain a security protection permission set:

[0067] Obtaining a credit step length set for accessing the credit step length;

[0068] Smoothing the access and passage system data to obtain access and passage smoothness;

[0069] The access smoothness is mapped to the credit step set to obtain a security protection permission set.

[0070] In specific implementation, the credit step set is composed of the distance from all access abnormal credit expectations to the access abnormal credit expectation-time straight line, the access pass system data is smoothed, the access pass system data is obtained, the maximum and minimum values ​​in the access pass system data are removed, and the average value of the access pass system data after removing the maximum and minimum values ​​is calculated, and each data in the access pass system data is ratioed with the access pass system data, and all ratios obtained are used as access smoothness, and the access smoothness represents the proportion of the time allowed for access to the average value of the allowed access time.

[0071] In the present application, the access smoothness can be mapped to the credit step set, and the data in the access smoothness can be arranged in order from small to large to obtain sequential access smoothness data. Similarly, the data in the credit step set can be arranged in order from small to large to obtain a sequential credit step set. The first data in the sequential access smoothness is subtracted from the first data in the sequential credit step set to obtain the first security protection permission data, that is, the mapping of the first data is completed, and the mapping of the second data is entered. The second data in the sequential access smoothness is subtracted from the second data in the sequential credit step set to obtain the second security protection permission data, that is, the mapping of the second data is completed, and the mapping of the next data is entered, until the mapping of all data is completed to obtain a security protection permission set.

[0072] It should be noted that in this application, by performing credit decision processing on the access exception system data, the access security risks of the data can be better managed. After the permission check, it can be more accurately determined whether the access is approved or rejected under the premise of ensuring data security, which helps to ensure legal access to the data and reduce potential risks.

[0073] In step 103, the access risk entropy is determined based on the security protection permission set, and the risk threshold of the access risk entropy is identified to obtain a fixed threshold corresponding to the strong protection risk and an elastic threshold corresponding to the weak protection risk, and the data risk tolerance is determined based on the fixed threshold corresponding to the strong protection risk and the elastic threshold corresponding to the weak protection risk.

[0074] In some embodiments, determining the access risk entropy according to the security protection permission set may be implemented by the following steps:

[0075] Determining a maximum value and a minimum value of the security protection permission data in the security protection permission set;

[0076] Determine the security timing flow according to the security protection permission data in the security protection permission set;

[0077] Preset access resolution factor;

[0078] The access risk entropy is determined according to the access resolution factor, the security timing flow, and the maximum and minimum values ​​of the security protection permission data in the security protection permission set.

[0079] In specific implementation, the security protection permission set is traversed to obtain the maximum and minimum values ​​of the security protection permission data in the security protection permission set, the security timing flow is determined based on the security protection permission data in the security protection permission set, the average value of the security protection permission data in the security protection permission set is calculated, and the absolute value of each security protection permission data in the security protection permission set minus the average value is selected as the security timing flow, and each security protection permission data has a unique corresponding security timing flow; an access resolution factor is pre-set, and the access resolution factor set in the present application is a number between 0 and 1.

[0080] In specific implementation, the access risk entropy in this application can be determined by the following formula:

[0081]

[0082] Among them, ζ represents the access risk entropy, X min represents the minimum value of the security protection permission data in the security protection permission set, X max represents the maximum value of the security protection permission data in the security protection permission set, υ represents the access resolution factor, x i (t) represents the i-th security timing traffic, and t represents the access time.

[0083] It should be noted that the access resolution factor in this application is a parameter used to evaluate the size of the access risk. When the access resolution factor is close to 0, it indicates that the access risk to the securely protected data is low. When the access resolution factor is close to 1, it indicates that the access risk to the securely protected data is high. The access risk entropy is a parameter used to describe the access risk level.

[0084] In some embodiments, reference Figure 2 As shown, this figure is a schematic diagram of a process for determining a fixed threshold corresponding to a strong protection risk and an elastic threshold corresponding to a weak protection risk in some embodiments of the present application. In this embodiment, determining a fixed threshold corresponding to a strong protection risk and an elastic threshold corresponding to a weak protection risk can be implemented by the following steps:

[0085] In step 1031, the main frequency characteristics of the risk link are determined according to the security protection permission set;

[0086] In step 1032, a risk delay frequency modulation component is determined according to the access abnormality signal delay of the access abnormality system data;

[0087] In step 1033, threshold scheduling is performed on the main frequency characteristics of the risk link and the risk delay frequency modulation component to obtain a fixed threshold corresponding to a strong protection risk and an elastic threshold corresponding to a weak protection risk.

[0088] In specific implementation, the main frequency characteristic of the risk link is determined according to the security protection permission set, each security permission data in the security protection permission set corresponds to a risk link, and the risk link refers to the time path from initiating access to completing access in each access, that is, the access is initiated as the starting node of the time path, and the access is completed as the ending node of the time path. In this application, the risk link is used to represent the difference between each security permission data and the maximum value of the security permission data within the access time when the access is initiated. The main frequency characteristic of the risk link is the center distance between each security permission data and the maximum value of the security permission data in the security protection permission set. In some embodiments, the center distance between each security permission data and the maximum value of the security permission data can be represented by the mean value, or the center distance can be determined by other methods, which is not limited here; the risk delay frequency modulation component is determined according to the access abnormal signal delay of the access abnormal system data. In some embodiments, the abnormal signal delay of the access abnormal system data can be divided into equally spaced time windows to determine the signal delay concentration of the abnormal signal delay after the equally spaced time windows are divided. The signal delay concentration can be obtained by the median method. The ratio of the delay concentration in the first time window to the average of all signal delays in the first time window is used as the risk delay frequency modulation component in the first time window, and the risk delay frequency modulation component in the first time window is determined. Then, the risk delay frequency modulation component in the second time window is determined until the risk delay frequency modulation component in all time windows is determined, and the risk delay frequency modulation component in all time windows is obtained, wherein the risk delay frequency modulation component represents the degree of deviation between the access abnormality signal delay of each access abnormality system data and the signal delay concentration; threshold scheduling is performed on the main frequency characteristics of the risk link and the risk delay frequency modulation component, and the scheduling concentration is determined based on the main frequency characteristics of the risk link and the risk delay frequency modulation component. A fixed threshold corresponding to a strong protection risk is determined according to the scheduling concentration and the maximum value of the security protection permission data in the security protection permission set, and an elastic threshold corresponding to a weak protection risk is determined according to the scheduling concentration and the concentration of the security protection permission data in the security protection permission set. In some embodiments, the average of the security protection permission data in the security protection permission set can be used as the concentration of the security protection permission data in the security protection permission set.

[0089] In specific implementation, the scheduling concentration in this application can be specifically determined by the following formula:

[0090]

[0091] Among them, θ represents the scheduling concentration, y n (t) represents the main frequency characteristic of the risk link in the security protection permission set, t represents the access time, exp represents the exponential function with the natural constant e as the base, Tc represents the cth safe time sequence flow in the risk delay frequency modulation component of the abnormal signal delay, ω n (t) represents the risk delay frequency modulation component of the access abnormal signal delay of accessing abnormal system data, s(t) represents the signal delay concentration of the abnormal signal delay, and n represents the security protection permission data in the security protection permission set, n=1, 2,…,N.

[0092] In specific implementation, a fixed threshold corresponding to a strong protection risk is determined according to the maximum value of the scheduling concentration and the security protection permission data in the security protection permission set, and the scheduling concentration and the maximum value of the security protection permission data in the security protection permission set and the abnormal signal delay are characteristically connected to obtain a fixed threshold corresponding to the strong protection risk. In some embodiments, the characteristic connection can be determined by the inverse of the sum of squares. In other embodiments, it can also be implemented in other ways, which are not limited here; an elastic threshold corresponding to a weak protection risk is determined according to the scheduling concentration and the concentration of the security protection permission data in the security protection permission set, and the access risk entropy, the risk delay frequency modulation component of the access abnormal signal delay of the access abnormal system data and the minimum value of the security protection permission data in the security protection permission set are characteristically connected to obtain an elastic threshold corresponding to the weak protection risk. In some embodiments, the characteristic connection can be determined by the inverse of the sum of squares. In other embodiments, it can also be implemented in other ways, which are not limited here; wherein, the fixed threshold corresponding to the strong protection risk and the elastic threshold corresponding to the weak protection risk can be determined by the following formula:

[0093]

[0094] Where G represents the fixed threshold corresponding to strong protection risk, T represents the elastic threshold corresponding to weak protection risk, and s m (t) represents the mth abnormal signal delay in the concentration of the security protection permission data in the security protection permission set, m = 1, 2, ..., M, X max represents the maximum value of the security protection permission data in the security protection permission set, ω v (t) represents the risk delay frequency modulation component of the access abnormality signal delay of the vth access abnormality system data with a concentration higher than the security protection permission data in the security protection permission set, v = 1, 2, ..., V, X min represents the minimum value of the security protection permission data in the security protection permission set, x i (t) represents the i-th security timing traffic, t represents the access time, and ζ represents the access risk entropy.

[0095] It should be noted that in this application, the fixed threshold corresponding to the strong protection risk is associated with access being "denied", indicating that the risk is very high, and the elastic threshold corresponding to the weak protection risk is associated with access being "allowed", indicating that the risk is relatively low. The risk associated with the access request is determined based on the fixed threshold corresponding to the strong protection risk and the elastic threshold corresponding to the weak protection risk. If the quantified risk in data security protection is less than or equal to the elastic threshold corresponding to the weak protection risk, access to the protected data is allowed. If it is greater than the fixed threshold corresponding to the strong protection risk, access to the protected data is directly denied. If it is greater than the elastic threshold corresponding to the weak protection risk and less than or equal to the fixed threshold corresponding to the strong protection risk, whether access is allowed is determined by the data risk tolerance.

[0096] In some embodiments, determining the data risk tolerance according to the fixed threshold corresponding to the strong protection risk and the elastic threshold corresponding to the weak protection risk may be implemented by the following steps:

[0097] Obtaining the fixed threshold G corresponding to the strong protection risk;

[0098] Obtaining the elastic threshold T corresponding to the weak protection risk;

[0099] Obtaining the scheduling concentration θ;

[0100] Determine the safety time sequence flow state coefficient according to the safety time sequence flow

[0101] Get the data security protection normal access factor h;

[0102] According to the fixed threshold G corresponding to the strong protection risk, the elastic threshold T corresponding to the weak protection risk, the scheduling concentration θ, and the safety time series flow state coefficient The data risk tolerance is determined by the security protection normal access factor h, where the data risk tolerance is determined by the following formula:

[0103]

[0104] in, represents data risk tolerance, B represents access risk characteristics with Gaussian characteristics, It represents the state coefficient of the safety time series flow, and the pth eigenvalue of the safety time series flow is σ p , p=1,2,…,P.

[0105] It should be noted that the data risk tolerance in this application refers to the maximum acceptable degree of access risk in data security protection, and the security time sequence flow state coefficient is determined according to the security time sequence flow. The safety time series traffic is composed of P characteristic values, which represent the average level of data safety. The sum of the P characteristic values ​​constitutes the safety time series traffic state coefficient. The access risk feature B with Gaussian characteristics means that the distribution of these features presents a typical bell curve shape, in which the access risk values ​​are concentrated near the mean, and the number of access risks farther away from the mean gradually decreases. The data security protection normal access factor h is obtained by determining the frequency of normal access in the data security access protection model, which is usually a number in the range of (0,1) and not equal to 0 or 1. In other embodiments, other methods can also be used to determine it, which is not limited here; the data security protection model is a function used to count the number of secure accesses in data security protection. For example, the data security protection model can use a counting function to count the number of secure accesses, which is not specifically limited here.

[0106] It should be noted that in the present application, the access risk entropy is determined according to the security protection permission set, which is helpful to evaluate the risk of data access. The access risk can be controlled more accurately by using the fixed threshold corresponding to the strong protection risk and the elastic threshold corresponding to the weak protection risk. The intensity of the access risk can be flexibly adjusted by using the fixed threshold corresponding to the strong protection risk and the elastic threshold corresponding to the weak protection risk. The data risk tolerance can better understand the tolerance of the data security protection system to the access risk, which helps to clarify the acceptable risk level and the critical point for triggering the alarm, thereby improving the intelligence of data security protection.

[0107] In step 104, determine whether the data risk tolerance is higher than the preset maximum data security access quota. If the data risk tolerance is lower than the preset maximum data security access quota, control the data security protection to be in a silent state. If the data risk tolerance is higher than the preset maximum data security access quota, trigger a data security protection warning.

[0108] In specific implementation, the security access quota is a risk value corresponding to the probability of an access request being allowed when the access risk value is the largest among the access risks of different systems. In some embodiments, the access risks of different systems include the client IP of the access request, the time of the access request, multiple repeated access requests in a short period of time, repeated requests after access is denied, etc. The maximum access risk value can be the probability that the access request is allowed at the time when the access request duration reaches the longest time in the historical access times. At the same time, the access risk value also corresponds to the access risk value at this time point, which can be obtained by comparing the maximum value and the minimum value of the security protection permission data in the security protection permission set. The data risk tolerance is determined by the product of the value and the mean value of the security protection permission data in the security protection permission set; when the data risk tolerance is lower than the preset maximum data security access quota, the data security protection is in a silent state. The data security protection being in a silent state means that the data security protection warning has not been triggered, and the data security protection monitoring operation is not affected, indicating that the data security protection is not threatened by access. When the data risk tolerance is higher than the preset maximum data security access quota, it means that there is a risk in data security, triggering a data security protection warning, transmitting the warning information to the control center, forcibly releasing all access to the protected data and automatically encrypting it, so as to ensure the security of the protected data.

[0109] It should be noted that in this application, the maximum data security access quota is compared with the data risk tolerance to determine whether there is a security risk in the protected data, thereby improving the level of data security protection. When risks of different systems arise in data security protection, the effectiveness of data security protection can be effectively improved.

[0110] In addition, in another aspect of the present application, in some embodiments, the present application provides a data security protection system, the system includes a data security identification unit, referring to Figure 2 , which is a schematic diagram of exemplary hardware and / or software of a data security identification unit according to some embodiments of the present application, the data security identification unit 200 includes: a data access system determination module 201, a security protection permission set determination module 202, a data risk tolerance determination module 203 and a security protection warning module 204, which are respectively described as follows:

[0111] The data access system determination module 201 in this application is mainly used to start data security protection monitoring, obtain historical access risk data in the access event database, perform risk system diversion on the historical access risk data, and obtain access pass system data and access abnormal system data;

[0112] The security protection permission set determination module 202 in the present application is mainly used to perform credit decision processing on the access exception system data to obtain a credit exception space, determine the access credit step length according to the credit exception space, perform permission inspection according to the access credit step length and the access pass system data, and obtain a security protection permission set;

[0113] Data risk tolerance determination module 203, in this application, the data risk tolerance determination module 203 is mainly used to determine the access risk entropy according to the security protection permission set, perform risk threshold identification on the access risk entropy, obtain a fixed threshold corresponding to the strong protection risk and an elastic threshold corresponding to the weak protection risk, and determine the data risk tolerance according to the fixed threshold corresponding to the strong protection risk and the elastic threshold corresponding to the weak protection risk;

[0114] Security protection warning module 204. In this application, the security protection warning module 204 is mainly used to determine whether the data risk tolerance is higher than the preset maximum data security access quota. If the data risk tolerance is lower than the preset maximum data security access quota, the data security protection is controlled to be in a silent state. If the data risk tolerance is higher than the preset maximum data security access quota, a data security protection warning is triggered.

[0115] In addition, the present application also provides a computer device, which includes a memory and a processor, the memory stores a code, and the processor is configured to obtain the code and execute the above-mentioned data security protection method.

[0116] In some embodiments, reference Figure 3 , which is a schematic diagram of the structure of a computer device for implementing a data security protection method according to some embodiments of the present application. The data security protection method in the above embodiment can be Figure 3 The computer device shown in the figure is implemented, and the computer device includes at least one processor 301, a communication bus 302, a memory 303 and at least one communication interface 304.

[0117] Processor 301 can be a general-purpose central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more for controlling the execution of the data security protection method in the present application.

[0118] Communication bus 302 may include a pathway for transmitting information between the above-mentioned components.

[0119] The memory 303 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a disk or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 303 may exist independently and be connected to the processor 301 via the communication bus 302. The memory 303 may also be integrated with the processor 301.

[0120] The memory 303 is used to store the program code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the program code stored in the memory 303. The program code may include one or more software modules. The data security protection method in the above embodiment can be implemented by the processor 301 and one or more software modules in the program code in the memory 303.

[0121] The communication interface 304 uses any transceiver or other device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0122] In a specific implementation, as an embodiment, a computer device may include multiple processors, each of which may be a single-CPU processor or a multi-CPU processor. The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0123] The above-mentioned computer device can be a general-purpose computer device or a special-purpose computer device. In a specific implementation, the computer device can be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device or an embedded device. The embodiment of the present application does not limit the type of computer device.

[0124] In addition, the present application also provides a computer-readable storage medium, which stores a computer program, and the computer program implements the above-mentioned data security protection method when executed by a processor.

[0125] In summary, in the data security protection method, system, device and storage medium disclosed in the embodiments of the present application, the historical access risk data is firstly diverted into the risk system, which can quickly identify the data with abnormal access, facilitate further analysis of the abnormal access data, and perform credit decision processing, so as to better manage the access security risk of the data. After the permission check, it can more accurately decide whether to approve or deny the access under the premise of ensuring data security, which helps to ensure the legal access to the data, reduce potential risks, determine the access risk entropy, and help to evaluate the risk of data access. By using the fixed threshold corresponding to the strong protection risk and the fixed threshold corresponding to the weak protection risk, the data security risk can be better managed. Elastic thresholds can control access risks more accurately. The intensity of access risks can be flexibly adjusted through fixed thresholds for strong protection risks and elastic thresholds for weak protection risks. Data risk tolerance can better understand the tolerance of the data security protection system for access risks, which helps to clarify the acceptable risk level and the critical point for triggering alarms, thereby improving the intelligence of data security protection. By comparing the maximum data security access quota with the data risk tolerance, it can be determined whether there are security risks in the protected data, thereby improving the level of data security protection. When risks of different systems arise in data security protection, the effectiveness of data security protection can be effectively improved.

[0126] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0127] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data security protection method, characterized in that: The steps include: Start data security protection monitoring, obtain historical access risk data in the access event database, perform risk system diversion on the historical access risk data, and obtain access pass system data and access exception system data; Performing credit decision processing on the access exception system data to obtain a credit exception space, determining an access credit step length according to the credit exception space, and performing permission check according to the access credit step length and the access pass system data to obtain a security protection permission set; Determine access risk entropy according to the security protection permission set, perform risk threshold identification on the access risk entropy to obtain a fixed threshold corresponding to a strong protection risk and an elastic threshold corresponding to a weak protection risk, and determine data risk tolerance according to the fixed threshold corresponding to the strong protection risk and the elastic threshold corresponding to the weak protection risk; Determine whether the data risk tolerance is higher than the preset maximum data security access quota. If the data risk tolerance is lower than the preset maximum data security access quota, control the data security protection to be in a silent state. If the data risk tolerance is higher than the preset maximum data security access quota, trigger a data security protection warning. The risk system diversion of the historical access risk data to obtain access pass system data and access abnormal system data specifically includes: Obtain the access request time from all request data that actively initiates access requests; Determine the access request balancing feature according to the access request time in all the request data of actively initiating the access request; Determine access pass system data and access exception system data according to the access request balance feature; The credit decision processing is performed on the access abnormal system data to obtain the credit abnormal space, which specifically includes: Obtain access exception time in access exception system data; Subtract all access exception times in the access exception system data from the access exception benchmark time to obtain the access exception signal delay; Performing credit prediction on the access abnormality system data and the access abnormality signal delay to obtain an access credit prediction degree; Determining the credit abnormality space according to the access credit prediction degree; Among them, determining the access credit step length according to the credit anomaly space is to establish a Cartesian coordinate system according to the access credit anomaly expectation and the time corresponding to the access credit expectation, and determine the corresponding access credit anomaly expectation according to the average value of the time corresponding to the access credit expectation in the Cartesian coordinate system, obtain a position point, and connect the position point with the coordinate origin to obtain a straight line passing through the origin, and use the straight line as the access credit anomaly expectation-time straight line, and calculate the distance between the position on the access credit anomaly expectation-time curve and the straight line passing through the origin through the point-to-straight line distance formula, complete the calculation of all distances, and form all distances into the access credit step length; The access request balance feature is feature data used to identify the access system, and the result obtained by dividing the total time of all access requests by the total number of accesses is used as the access request balance feature.

2. The method according to claim 1, characterized in that According to the access authorization step length and the access pass system data, the permission check is performed to obtain the security protection permission set, which specifically includes: Obtaining a credit step length set for accessing the credit step length; Smoothing the access pass system data to obtain access pass smoothness, wherein the access pass smoothness represents the ratio of the allowed access time to the average allowed access time; The access smoothness is mapped to the credit step set to obtain a security protection permission set.

3. The method according to claim 1, characterized in that Determining the access risk entropy according to the security protection permission set specifically includes: Determining a maximum value and a minimum value of the security protection permission data in the security protection permission set; Determine the security timing flow according to the security protection permission data in the security protection permission set; Preset access resolution factor; The access risk entropy is determined according to the access resolution factor, the security timing flow, and the maximum and minimum values ​​of the security protection permission data in the security protection permission set.

4. The method according to claim 3, characterized in that The access risk entropy is determined by the following formula: in, represents the access risk entropy, represents the minimum value of the security protection permission data in the security protection permission set, represents the maximum value of the security protection permission data in the security protection permission set, represents the access resolution factor, Indicates A safe timing flow, Indicates the access time.

5. The method according to claim 1, characterized in that The access risk entropy is subjected to risk threshold identification to obtain a fixed threshold corresponding to a strong protection risk and an elastic threshold corresponding to a weak protection risk, which specifically includes: Determining the main frequency characteristics of the risk link according to the security protection permission set; Determine the risk delay frequency modulation component according to the access abnormality signal delay of the access abnormality system data; Threshold scheduling is performed on the main frequency characteristics of the risk link and the risk delay frequency modulation component to obtain a fixed threshold corresponding to a strong protection risk and an elastic threshold corresponding to a weak protection risk.

6. The method according to claim 1, characterized in that Obtain historical access risk data from the access event database through database management tools.

7. A data security protection system, which uses the method according to any one of claims 1 to 6 to perform data security protection, characterized in that: The data security protection system includes a data security identification unit, and the data security identification unit includes: A data access system determination module is used to start data security protection monitoring, obtain historical access risk data in the access event database, perform risk system diversion on the historical access risk data, and obtain access pass system data and access exception system data; A security protection permission set determination module is used to perform credit decision processing on the access exception system data to obtain a credit exception space, determine an access credit step length according to the credit exception space, perform permission inspection according to the access credit step length and the access pass system data, and obtain a security protection permission set; A data risk tolerance determination module is used to determine the access risk entropy according to the security protection permission set, perform risk threshold identification on the access risk entropy, obtain a fixed threshold corresponding to the strong protection risk and an elastic threshold corresponding to the weak protection risk, and determine the data risk tolerance according to the fixed threshold corresponding to the strong protection risk and the elastic threshold corresponding to the weak protection risk; The security protection warning module is used to determine whether the data risk tolerance is higher than the preset maximum data security access quota. If the data risk tolerance is lower than the preset maximum data security access quota, the data security protection is controlled to be in a silent state. If the data risk tolerance is higher than the preset maximum data security access quota, a data security protection warning is triggered.

8. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores codes, and the processor is configured to obtain the codes and execute the data security protection method according to any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the data security protection method as described in any one of claims 1 to 6 is implemented.

Images