A cluster-based security audit management method, device, medium and product

Abstract

The present application relates to the field of security audit technology, and in particular to a cluster-based security audit management method, device, medium and product, the method comprising obtaining multiple business data to be audited in a cluster, and identifying data features in each business data to be audited, the data features at least including data volume, data type and associated data volume; based on the data features in each business data to be audited, determining the feature hash value of each business data to be audited, and based on each feature hash value determining the hash partition corresponding to the business data to be audited, each hash partition containing at least one business data to be audited; based on all business data to be audited contained in each hash partition, determining the security audit rules corresponding to each hash partition; based on the security audit rules corresponding to each hash partition, performing security audit operations on the business data to be audited contained in each hash partition. The present application facilitates improving the accuracy of security audits on clusters.

Description

Technical Field

[0001] The present application relates to the field of security audit technology, and in particular to a cluster-based security audit management method, device, medium and product. Background Art

[0002] A cluster is a computer system consisting of multiple computers or servers that are interconnected through a high-speed communication network and work together to support the availability, reliability, and scalability of the system. The business data generally stored and processed in the cluster is usually of extremely high value, such as customer information, transaction data, and commercial secrets. By conducting a security audit on the cluster, it is convenient to conduct in-depth inspection and analysis of the business data in the cluster, discover and solve potential security issues in the business data, and improve the information security level of the business data. In addition, there are often interdependencies and associations between the various computers or servers in the cluster. When a computer or server has a security problem, it may affect the stability and security of the entire cluster. Therefore, it is crucial to conduct a security audit on the cluster.

[0003] In related technologies, relevant auditors generally conduct personnel audits on various business data within the cluster. However, due to the complexity and variability of the cluster, it may be difficult for relevant auditors to fully grasp the details and potential risks of all business data in the cluster, which may lead to a decrease in the accuracy of the audit results. Summary of the invention

[0004] In order to improve the accuracy of security auditing of a cluster, the present application provides a cluster-based security audit management method, device, medium and product.

[0005] In the first aspect, the present application provides a cluster-based security audit management method, which adopts the following technical solution:

[0006] A cluster-based security audit management method, comprising:

[0007] Acquire multiple business data to be audited in the cluster, and identify data features in each business data to be audited, wherein the data features at least include data volume, data type, and associated data volume;

[0008] Based on the data features in each business data to be audited, determine the feature hash value of each business data to be audited, and based on each feature hash value, determine the hash partition corresponding to the business data to be audited, each hash partition contains at least one business data to be audited;

[0009] Based on all the business data to be audited contained in each hash partition, determine the security audit rules corresponding to each hash partition;

[0010] Based on the security audit rules corresponding to each hash partition, a security audit operation is performed on the business data to be audited contained in each hash partition.

[0011] By adopting the above technical solution, by calculating the characteristic hash value of the data features contained in the business data to be audited, and classifying multiple business data based on the calculated characteristic hash value, it is convenient to improve the accuracy of the data classification results. In addition, through feature recognition and characteristic hash value calculation, it is convenient to realize automatic classification, which reduces the workload of relevant auditors and improves the rate of the classification process. Then, according to the business data features contained in each hash partition, targeted security audit rules are determined. Through this personalized audit method, it is convenient to accurately reflect the security audit needs and risk points of different hash partitions, so as to facilitate the timely discovery of potential security risks and problems in the cluster, and then facilitate the improvement of the accuracy and effectiveness of the audit results.

[0012] In one possible implementation, based on all the business data to be audited contained in the hash partition, the security audit rules corresponding to the hash partition are determined, including:

[0013] Identify the number of businesses corresponding to the business data to be audited in the hash partition, and when the number of businesses is higher than a first preset number, obtain historical audit records;

[0014] Determine the characteristic impact rate of each data characteristic corresponding to each business data to be audited according to the historical audit records, and determine the characteristic information of each business data to be audited according to each data characteristic and the corresponding characteristic impact rate;

[0015] Integrate all feature information to obtain target data features, where the number of feature types included in the target data features is greater than a second preset number;

[0016] The security audit rules corresponding to the hash partition are determined according to the target data characteristics and rule mapping relationship, wherein the rule mapping relationship is a corresponding relationship between a characteristic type and a security audit rule.

[0017] By adopting the above technical solution, for each hash partition, by identifying the feature types corresponding to all the business data to be audited contained therein and the type proportion of each feature type, it is helpful to have a more comprehensive understanding of the common characteristics of all the business data to be audited in the hash partition, determine the subsequent audit rules based on the common characteristics, and facilitate improving the adaptability between the security audit rules and all the business data to be audited in the hash partition, thereby facilitating improving the accuracy of determining the security audit results.

[0018] In a possible implementation, the information integration of all feature information to obtain target data features includes:

[0019] Identify the feature key-value pair corresponding to each data feature. The feature key-value pair includes the corresponding business data identifier to be audited and the corresponding feature impact rate. Each data feature contains at least one feature key-value pair.

[0020] Generate a data feature matrix according to at least one feature key-value pair corresponding to each data feature, wherein the data feature matrix includes all data features and all feature key-value pairs corresponding to each data feature;

[0021] The target data features are determined according to the data feature matrix.

[0022] By adopting the above technical solution, by identifying the feature key-value pairs corresponding to each data feature, including the business data identifier to be audited and the feature impact rate, each data feature can be accurately identified and quantified, which is helpful for subsequent data processing and analysis. In addition, by integrating multiple data features and their corresponding feature key-value pairs into a matrix, unified management and analysis are facilitated. Finally, the data feature matrix is ​​used to facilitate the determination of more representative data features, thereby facilitating the improvement of the accuracy of determining the target data features.

[0023] In a possible implementation manner, determining the target data feature according to the data feature matrix includes:

[0024] Identify a first most-valued data feature from the data feature matrix, where the first most-valued data feature is a data feature that contains the most feature key-value pairs in the data feature matrix;

[0025] Eliminate the first maximum value data feature from the data feature matrix to obtain a first screening data feature matrix, and identify a second maximum value data feature from the first screening data feature matrix, where the second maximum value data feature is a data feature having a highest feature influence rate in the first screening data feature matrix;

[0026] Eliminate the second maximum value data feature from the first screening data feature matrix to obtain a second screening data feature matrix, and determine supplementary data features from the second screening data feature matrix, wherein the supplementary data features are data features in which the number of feature key-value pairs in the second screening data feature matrix is ​​greater than a third preset number;

[0027] According to the first maximum feature, the second maximum feature and the supplementary data feature, the target data feature corresponding to the data feature matrix is ​​determined.

[0028] By adopting the above technical scheme, the most valuable data features are selected from the data feature matrix according to the number of key-value pairs and the feature influence rate, so as to quickly locate the most representative and influential data features. After determining the most valuable data features, supplementary data features are determined from other data features except the most valuable data features, so as to further improve the comprehensiveness of determining the target data features. Finally, by combining the first most valuable feature, the second most valuable feature and the supplementary data features, it is convenient to accurately determine the target data features corresponding to the data feature matrix.

[0029] In a possible implementation method, when there is business data to be audited with a related relationship, it also includes:

[0030] Determine the business data to be audited that have an associated relationship as a business data group to be audited, wherein the business group to be audited includes at least two business data to be audited;

[0031] Identify the business identifier corresponding to each business data to be audited in the business data group to be audited, and determine the business process corresponding to all the business data to be audited in the business group to be audited based on each business identifier;

[0032] Determine the business role perspective of each business data to be audited in each business group to be audited according to the business process, wherein the business role perspective includes a master perspective and a slave perspective;

[0033] Obtaining security audit records corresponding to the business data group to be audited, and determining perspective audit records of each business role perspective of each business data to be audited based on the business role perspective of each business data to be audited;

[0034] Based on the business role perspective of each business data to be audited and the perspective audit records of each business role perspective of each business data to be audited, the target audit record of each business data to be audited in the business data group to be audited is determined, and each target audit record is fed back.

[0035] By adopting the above technical solution, by determining the groups of business data to be audited that have associated relationships, it is convenient to focus accurately on the relevant business data to be audited, rather than processing a single business data to be audited in isolation. The identification of such associations helps to discover the intrinsic connections between the business data to be audited, thereby facilitating the improvement of the accuracy and efficiency of the security audit results. In addition, through the corresponding relationship between the business data to be audited, it is convenient to determine the main perspective audit results and the secondary perspective audit results of the business data to be audited. Finally, the main perspective audit results and the secondary perspective audit results are jointly fed back, which is convenient to improve the comprehensiveness of the corresponding audit results of the business data to be audited, and also convenient to provide a more accurate and in-depth data basis for subsequent analysis work.

[0036] In one possible implementation, based on the business role perspective of the business data to be audited and the perspective audit records of each business role perspective, the target audit records of the business data to be audited are determined, including:

[0037] Determine a main drawing picture according to the main viewing angle of the business data to be audited, and render the content of the main drawing picture according to the viewing angle audit record corresponding to the main viewing angle to obtain a main rendering canvas;

[0038] Determine a slave drawing picture according to the slave perspective of the business data to be audited, and render the content of the slave drawing picture according to the perspective audit record corresponding to the slave perspective to obtain a slave rendering canvas;

[0039] A target audit record of the to-be-audited business data is determined according to the master rendering canvas and the slave rendering canvas.

[0040] By adopting the above technical solution, by analyzing and considering the audit records corresponding to the main perspective and the slave perspective, it is convenient to improve the comprehensiveness and completeness when determining the audit results. In addition, by combining the audit records with the drawing pictures, it is convenient to render and display them directly on the canvas, thereby simplifying the processing of audit records. Relevant auditors do not need to manually organize and analyze large amounts of data, but only need to focus on the rendered canvas, which is convenient to improve the work efficiency in the subsequent sorting and feedback process.

[0041] In a second aspect, the present application provides an electronic device, which adopts the following technical solution:

[0042] An electronic device, comprising:

[0043] at least one processor;

[0044] Memory;

[0045] At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the above-mentioned cluster-based security audit management method.

[0046] In a third aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution:

[0047] A computer-readable storage medium includes: a computer program that can be loaded by a processor and execute the above-mentioned cluster-based security audit management method.

[0048] In a fourth aspect, the present application provides a computer program product, which adopts the following technical solution:

[0049] A computer program product includes a computer program, and when the computer program is executed by a processor, the cluster-based security audit management method is implemented.

[0050] In summary, the present application includes at least one of the following beneficial technical effects:

[0051] By calculating the characteristic hash values ​​of the data features contained in the business data to be audited, and classifying multiple business data based on the calculated characteristic hash values, it is convenient to improve the accuracy of the data classification results. In addition, through feature recognition and characteristic hash value calculation, it is convenient to realize automatic classification, which reduces the workload of relevant auditors and improves the rate of the classification process. Then, according to the business data features contained in each hash partition, targeted security audit rules are determined. This personalized audit method facilitates the accurate reflection of the security audit needs and risk points of different hash partitions, thereby facilitating the timely discovery of potential security risks and problems in the cluster, and further facilitating the improvement of the accuracy and effectiveness of the audit results.

[0052] By determining the groups of business data to be audited that have associated relationships, it is convenient to focus accurately on the relevant business data to be audited, rather than processing individual business data to be audited in isolation. The identification of such associations helps to discover the intrinsic connections between the business data to be audited, thereby improving the accuracy and efficiency of security audit results. In addition, through the corresponding relationship between the business data to be audited, it is convenient to determine the main perspective audit results and the secondary perspective audit results of the business data to be audited. Finally, the main perspective audit results and the secondary perspective audit results are jointly fed back, which is convenient to improve the comprehensiveness of the corresponding audit results of the business data to be audited, and also to provide a more accurate and in-depth data basis for subsequent analysis work. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a flow chart of a cluster-based security audit management method in an embodiment of the present application;

[0054] Figure 2 It is a flowchart of a method for determining security audit rules in an embodiment of the present application;

[0055] Figure 3 It is a structural schematic diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The following is combined with Figure 1-3 This application is described in further detail.

[0057] After reading this specification, those skilled in the art may make non-creative modifications to this embodiment as needed, but such modifications are protected by patent law as long as they are within the scope of the claims of this application.

[0058] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0059] Specifically, the embodiment of the present application provides a cluster-based security audit management method, which is executed by an electronic device, which can be a server or a terminal device, wherein the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. The terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited to this. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, and the embodiment of the present application does not limit this.

[0060] refer to Figure 1 , Figure 1 : is a flow chart of a cluster-based security audit management method in an embodiment of the present application, the method includes steps S110 to S140, wherein:

[0061] Step S110: Acquire multiple business data to be audited in the cluster, and identify data features in each business data to be audited, where the data features at least include data volume, data type, and associated data volume.

[0062] Specifically, with the diversified development of business, a single business data can no longer meet the development needs of the enterprise. Generally, multiple business systems or servers are built within the enterprise to handle different business scenarios. In order to facilitate unified management, multiple business systems or servers are generally added to the same cluster. Since the data uploaded to the cluster by each system or server may involve sensitive data, business plans, technical patents, etc., the systems or servers in the same cluster will sign a data confidentiality agreement, that is, only systems or servers that have signed the data confidentiality agreement can enter the cluster. The specific data confidentiality agreement is not specifically limited in the embodiments of this application.

[0063] The business data to be audited can be uploaded by various systems or servers within the cluster. The business data to be audited is the business data that needs to be security audited, which may include data volume, that is, the data volume corresponding to the business data to be audited; data type, that is, the data type corresponding to the business data to be audited, the data type can be a linked list, code, picture, audio, etc., and the specific type is not specifically limited in the embodiments of this application; the amount of associated data, that is, the number of business data that has an active or passive association relationship with the business data to be audited. Data features can also include other content, such as data sources, etc. The specific data features are not specifically limited in the embodiments of this application and can be added, deleted or modified according to actual needs.

[0064] Step S120: Based on the data features in each business data to be audited, determine the feature hash value of each business data to be audited, and based on each feature hash value determine the hash partition corresponding to the business data to be audited, each hash partition contains at least one business data to be audited.

[0065] Specifically, when determining the feature hash value based on the identified data features, it can be divided into three steps, among which:

[0066] Step one, preprocessing, that is, streamlining the identified data features. The extracted data features may contain a large amount of redundant information. When the corresponding feature hash value is determined based on the data features containing a large amount of redundant information, it may cause a large error in the final result. Therefore, feature selection methods or dimensionality reduction techniques can be used to reduce the number of data features or remove the redundant information contained in the data features. Among them, the feature selection method can use decision trees, random forests, etc., and the dimensionality reduction technology can use linear discriminant analysis methods, principal component analysis methods, etc. The specific feature selection method or dimensionality reduction technology is not specifically limited in the embodiments of this application and can be selected and set by relevant technical personnel.

[0067] Step 2: Select a hash function. The hash function that can be used may be MD5, SHA-1, SHA-256, etc. The specific hash function is not specifically limited in the embodiment of the present application.

[0068] Step 3: Calculate feature hash value: Input the preprocessed data features into the selected hash function. The hash function can convert the preprocessed data features into feature hash values ​​of fixed length. The feature hash values ​​can be used to represent the data features.

[0069] After the above steps 1 to 3, the characteristic hash value corresponding to each business data to be audited can be calculated. Since different business data to be audited contain different data characteristics, the characteristic hash values ​​corresponding to different business data to be audited are also different. Each hash partition corresponds to a preset characteristic hash value range. By comparing the characteristic hash value corresponding to each business data to be audited with each preset characteristic hash value range, the hash partition corresponding to each business data to be audited can be determined. The same hash partition contains at least one business data to be audited. When the number of business data to be audited contained in the same hash partition is higher than the preset limit number, the corresponding hash partition can be split, wherein the preset limit number can be 8 or 9, and the specific preset limit number is not specifically limited in the embodiment of the present application.

[0070] Step S130: Based on all the business data to be audited contained in each hash partition, determine the security audit rules corresponding to each hash partition.

[0071] Specifically, since the hash partition is determined based on the preset characteristic hash value range, at least one business data to be audited that belongs to the same hash partition may contain similar or identical data features. Therefore, the same security audit rule can be used for the security data to be audited in the same hash partition. The corresponding security audit rule can be determined based on the preset characteristic hash value range corresponding to the hash partition, wherein each security audit rule corresponds to a preset characteristic hash value range. The correspondence between the security audit rule and the preset characteristic hash value range can be determined by relevant staff based on historical operating experience and uploaded to the electronic device. The specific correspondence can be adjusted and updated according to actual needs.

[0072] In addition, based on all the business data to be audited contained in the hash partition, determining the security audit rules corresponding to the hash partition may also include steps S1 to S4, such as Figure 2 As shown, where:

[0073] Step S1: Identify the number of businesses corresponding to the business data to be audited in the hash partition, and when the number of businesses is higher than a first preset number, obtain historical audit records.

[0074] Specifically, the first preset number can be 5 or 6. The first preset number is less than the preset limit number. That is, when the corresponding business number in the same hash partition is higher than the first preset number and lower than the preset limit number, it is necessary to retrieve the historical audit records. The historical audit records are records of anomalies that occurred during the security audit of all business data to be audited in the cluster in the historical period.

[0075] Step S2: Determine the feature impact rate of each data feature corresponding to each business data to be audited according to the historical audit records, and determine the feature information of each business data to be audited according to each data feature and the corresponding feature impact rate.

[0076] Specifically, since the business data to be audited is the business data generated within the enterprise, etc., the historical audit records may contain historical audit business data that is similar or identical to the business data to be audited. The feature impact rate of different data features that may cause abnormalities in the audit process is determined based on the abnormal audit operation records. For example, the feature impact rate of data feature 1 is 20%, that is, 20% of all historical audit business data in which abnormal audit operations appear in the historical audit records contain data feature 1.

[0077] Step S3: Integrate all feature information to obtain target data features, where the number of feature types included in the target data features is higher than a second preset number.

[0078] Specifically, for any hash partition whose number of services is higher than the first preset number, the formed feature information includes each data feature and the feature influence rate corresponding to each data feature. Finally, the target data feature is determined from the feature information. The number of target data features is higher than the second preset number. The second preset number can be 3 or 4. The specific number is not specifically limited in the embodiment of the present application. That is, all the data features contained in the feature information may be determined as target data features, or some of the data features may be determined as target data features.

[0079] Among them, the target data features can be directly randomly selected from the feature information, as long as the number of selected target data features can be guaranteed to be higher than the second preset number. In order to improve the accuracy of determining the target data features, all feature information is integrated, and obtaining the target data features can also include: identifying the feature key-value pairs corresponding to each data feature, the feature key-value pairs include the corresponding business data identifier to be audited and the corresponding feature impact rate, and each data feature contains at least one feature key-value pair; according to at least one feature key-value pair corresponding to each data feature, a data feature matrix is ​​generated, and the data feature matrix contains all data features and all feature key-value pairs corresponding to each data feature; and the target data features are determined according to the data feature matrix.

[0080] Specifically, the identifier of the business data to be audited can be a symbol or a code. The specific form is not specifically limited in the embodiments of the present application, as long as the corresponding data feature can be uniquely determined by the determined symbol or code. Since the same business data to be audited contains multiple data features, the same business data to be audited corresponds to multiple feature key-value pairs. For example, the business data 1 to be audited contains three data features, namely data feature 1, data feature 2, and data feature 3, wherein the feature impact rate corresponding to data feature 1 is 20%, the feature impact rate corresponding to data feature 2 is 30%, and the feature impact rate corresponding to data feature 3 is 50%. Therefore, the business data 1 to be audited corresponds to three feature key-value pairs, namely (a, 20%), (b, 30%), and (c, 50%), wherein a is used to represent data feature 1, b is used to represent data feature 2, and c is used to represent data feature 3.

[0081] According to the above method of determining the characteristic key-value pairs, the characteristic key-value pairs corresponding to all the business data to be audited in the hash partition can be determined. After integrating the characteristic key-value pairs corresponding to all the business data to be audited, the initial data characteristic matrix can be obtained. For example, the initial data characteristic matrix can be:

[0082] , where d can be used to characterize data feature 4, e can be used to characterize data feature 5, and business 1 is used to characterize business data 1 to be audited.

[0083] In the initial data feature matrix, different business data to be audited may contain the same data features. After integrating the initial data feature matrix, the resulting data feature matrix can be:

[0084] .

[0085] In the data feature matrix formed after integration, the distribution of the same data feature in different business data to be audited can be intuitively viewed. In addition, the target data feature can be directly determined from multiple data features based on the number of distributed business data to be audited.

[0086] Furthermore, in order to improve the comprehensiveness of determining the target data features, the target data features are determined according to the data feature matrix, including:

[0087] A first most-valued data feature is identified from the data feature matrix, where the first most-valued data feature is a data feature that contains the most feature key-value pairs in the data feature matrix.

[0088] Specifically, the number of feature key-value pairs corresponding to each data feature in the data feature matrix can be identified first, and the data feature containing the most feature key-value pairs can be determined as the first most valuable data feature. The number of first most valuable data features can be multiple, that is, when the data feature matrix contains multiple data features with the highest feature key-value pairs, multiple data features can be determined as the first most valuable data features. Since the data feature matrix is ​​the distribution of each data feature in each business data to be audited, the number of feature key-value pairs is the largest, and the number of business data to be audited that characterizes the distribution is also the largest, determining the first most valuable data feature as one of the target data features can improve the adaptability between the target data feature and each business data to be audited.

[0089] The first maximum data feature is removed from the data feature matrix to obtain a first screening data feature matrix, and the second maximum data feature is identified from the first screening data feature matrix. The second maximum data feature is the data feature having the highest feature influence rate in the first screening data feature matrix.

[0090] Specifically, in order to avoid repeated selection, after determining the first maximum value data feature, the first maximum value data feature can be removed from the data feature matrix to obtain a first screening data feature matrix, and then the data feature with the highest feature impact rate is identified from the first screening data feature matrix according to the feature impact rate. At this time, the distribution of the data feature with the highest feature impact rate in each business data to be audited is not considered. Since the higher the feature impact rate, the higher the probability of anomalies occurring in the security audit process, the feature impact rate is taken into consideration when determining the target feature, so that the second maximum value data feature can be audited in a targeted manner in the subsequent security audit process, thereby facilitating the timely discovery of potential anomalies in the security audit process.

[0091] The second maximum value data feature is eliminated from the first screening data feature matrix to obtain a second screening data feature matrix, and supplementary data features are determined from the second screening data feature matrix, where the supplementary data features are data features in which the number of feature key-value pairs in the second screening data feature matrix is ​​higher than a third preset number.

[0092] Specifically, in order to avoid repeated selection, the second most significant data feature can be removed from the first screening data feature matrix to obtain a second screening data feature matrix. When determining the supplementary data feature from the second screening data feature, the remaining data features contained in the second screening data feature matrix can be sorted according to the number of feature key-value pairs, and then the supplementary data feature can be selected from the remaining data features according to the sorting result, wherein the remaining data features are data features other than the first most significant data feature and the second most significant data feature in the data feature matrix. The third preset number can be 2 or 3, and the specific number is not specifically limited in the embodiment of the present application and can be set by relevant staff.

[0093] According to the first maximum feature, the second maximum feature and the supplementary data feature, the target data feature corresponding to the data feature matrix is ​​determined.

[0094] Specifically, the target data feature is composed of the first maximum feature, the second maximum feature and the supplementary data feature. The maximum data feature is selected from the data feature matrix according to the number of key-value pairs and the feature influence rate, so as to quickly locate the most representative and influential data feature. After determining the maximum data feature, the supplementary data feature is determined from other data features except the maximum data feature, so as to further improve the comprehensiveness of determining the target data feature.

[0095] Step S4: Determine the security audit rules corresponding to the hash partition according to the target data characteristics and the rule mapping relationship. The rule mapping relationship is the corresponding relationship between the feature type and the security audit rule.

[0096] Among them, different security audit rules are applicable to different data feature combinations. The security audit rules corresponding to the target data can be determined based on the target data characteristics and the rule mapping relationship, that is, the target data characteristics correspond to the security audit rules of the hash partition, wherein the rule mapping relationship contains data feature combinations corresponding to different security audit rules. The specific content of the rule mapping relationship is not specifically limited in the embodiments of this application and can be modified and adjusted according to actual needs.

[0097] For each hash partition, by identifying the feature types corresponding to all the business data to be audited contained in it and the type ratio of each feature type, it helps to have a more comprehensive understanding of the common characteristics of all business data to be audited in the hash partition, and determine the subsequent audit rules based on the common characteristics, so as to improve the adaptability between the security audit rules and all the business data to be audited in the hash partition, thereby facilitating the improvement of the accuracy of the security audit results.

[0098] Step S140: Based on the security audit rules corresponding to each hash partition, a security audit operation is performed on the business data to be audited contained in each hash partition.

[0099] Specifically, after determining the security audit rules corresponding to each hash partition, security audit operations can be performed on all business data to be audited in the hash partition according to the corresponding security audit rules, rather than using consistent security audit rules to perform security audit operations on all business data to be audited with different data characteristics.

[0100] For the embodiments of the present application, by calculating the characteristic hash values ​​of the data features contained in the business data to be audited, and classifying multiple business data based on the calculated characteristic hash values, it is convenient to improve the accuracy of the data classification results. In addition, automatic classification is convenient to achieve through feature recognition and characteristic hash value calculation, which reduces the workload of relevant auditors while facilitating the improvement of the rate of the classification process. Then, targeted security audit rules are determined based on the business data features contained in each hash partition. This personalized audit method facilitates the accurate reflection of the security audit needs and risk points of different hash partitions, thereby facilitating the timely discovery of potential security risks and problems in the cluster, and further facilitating the improvement of the accuracy and effectiveness of the audit results.

[0101] Furthermore, when there is business data to be audited with an associated relationship, the method further includes:

[0102] The business data to be audited that have an associated relationship are determined as a business data group to be audited, and the business group to be audited includes at least two business data to be audited.

[0103] Specifically, the association relationship includes active association relationship and passive association relationship. For example, there is an existing business chain, which includes three nodes, A, B and C, and the business generation process of the three nodes is ABC, where A is the active association node of B, and B is the passive association node of A. At this time, it can be determined that A and B have an association relationship. The business data to be audited that have an association relationship are divided into business data groups to be audited. It is sufficient that there is an association relationship between the business data to be audited in the business data group to be audited and at least one other business data to be audited. For example, A and B have an association relationship, and B and C have an association relationship. A, B, and C can be divided into one business data group to be audited.

[0104] Identify the business identifier corresponding to each business data to be audited in the business data group to be audited, and based on each business identifier, determine the business process corresponding to all business data to be audited in the business group to be audited.

[0105] Specifically, the business identifier can be a code or a symbol. The specific display method is not specifically limited in the embodiments of this application, as long as the business process corresponding to the business data to be audited can be determined through the business identifier. The business process of the business data to be audited includes the upstream business and downstream business of the business data to be audited, wherein the upstream business is executed after the business data to be audited is executed, and the downstream business is the business executed after the business data to be audited is executed, that is, the association relationship between the upstream business and the business data to be audited is an active association relationship, and the association relationship between the business data to be audited and the downstream business is a passive association relationship.

[0106] Determine the business role perspective of each business data to be audited in each business group to be audited based on the business process. The business role perspective includes the main perspective and the secondary perspective.

[0107] Specifically, the business process corresponding to the business data to be audited is the main perspective of the business data to be audited, and the business process corresponding to other business data to be audited that has an associated relationship with the business data to be audited is the secondary perspective of the business data to be audited. Since one business data to be audited may contain one or more associated business data to be audited, each business data to be audited may contain one or more secondary perspectives, but each business data to be audited may only contain one main perspective.

[0108] The security audit records corresponding to the business data group to be audited are obtained, and based on the business role perspective of each business data to be audited, the perspective audit records of each business role perspective of each business data to be audited are determined.

[0109] Specifically, the security audit records corresponding to the group of business data to be audited include security audit records corresponding to each business data to be audited in the group. The security audit records corresponding to each business data to be audited are security audit records of the corresponding business processes. From all the security audit records, the audit records corresponding to each business data to be audited from the perspective of different business roles can be determined based on the business role perspective of each business data to be audited. For example, the audit records corresponding to the active execution of the operation process of the business data to be audited and the audit records corresponding to the input operation process of the business data to be audited as input content can be obtained.

[0110] Based on the business role perspective of each business data to be audited and the perspective audit records of each business role perspective of each business data to be audited, the target audit record of each business data to be audited in the business data group to be audited is determined, and each target audit record is fed back.

[0111] Specifically, by combining the perspective audit records corresponding to the business data to be audited from the perspectives of various business roles, the target audit records corresponding to the business data to be audited can be determined. The security audit results of the business data to be audited can be fully displayed through the target audit records.

[0112] By determining the groups of business data to be audited that have associated relationships, it is convenient to focus accurately on the relevant business data to be audited, rather than processing individual business data to be audited in isolation. The identification of such associations helps to discover the intrinsic connections between the business data to be audited, thereby improving the accuracy and efficiency of security audit results. In addition, through the corresponding relationship between the business data to be audited, it is convenient to determine the main perspective audit results and the secondary perspective audit results of the business data to be audited. Finally, the main perspective audit results and the secondary perspective audit results are jointly fed back, which is convenient to improve the comprehensiveness of the corresponding audit results of the business data to be audited, and also to provide a more accurate and in-depth data basis for subsequent analysis work.

[0113] Furthermore, in order to improve the work efficiency in the subsequent sorting and feedback process, based on the business role perspective of the business data to be audited and the perspective audit records of each business role perspective, the target audit records of the business data to be audited are determined, including:

[0114] The main drawing screen is determined according to the main perspective of the business data to be audited, and the content of the main drawing screen is rendered according to the perspective audit record corresponding to the main perspective to obtain a main rendering canvas; the sub-drawing screen is determined according to the sub-perspective of the business data to be audited, and the content of the sub-drawing screen is rendered according to the perspective audit record corresponding to the sub-perspective to obtain a sub-rendering canvas; based on the main rendering canvas and the sub-rendering canvas, the target audit record of the business data to be audited is determined.

[0115] Specifically, the main drawing screen is used to display the perspective audit record corresponding to the main perspective. The area corresponding to the main drawing screen is the area in the relevant display device that displays the perspective audit record corresponding to the main perspective. The size of the main drawing screen is not specifically limited in the embodiment of the present application, and can be set by relevant technical personnel according to the actual display device. The drawing screen can be a chart, image, table or other visual form, depending on the nature of the perspective audit record and the audit requirements. The obtained perspective audit record is used to render the content of the main drawing screen, that is, the perspective audit record corresponding to the main perspective is displayed in a visual form on the main drawing screen. The main rendering canvas obtained after content rendering contains all the necessary information and details of the perspective audit record corresponding to the main perspective, which can support subsequent audit analysis and decision-making. The method for determining the secondary rendering canvas can refer to the above-mentioned method for determining the main rendering canvas, which will not be repeated here.

[0116] When determining the target audit records of the business data to be audited based on the main rendering canvas and the slave rendering canvas, the main rendering canvas and the slave rendering canvas can be layered to facilitate rendering and display directly on the canvas, thereby simplifying the processing of audit records. Relevant auditors do not need to manually organize and analyze large amounts of data, but only need to focus on the rendered canvas, which facilitates improving work efficiency in the subsequent organization and feedback process.

[0117] An electronic device is provided in an embodiment of the present application, such as Figure 3 As shown, Figure 3 The electronic device 300 shown includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one, and the structure of the electronic device 300 does not constitute a limitation on the embodiments of the present application.

[0118] The processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0119] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The fact that only one line is used in the diagram does not mean that there is only one bus or only one type of bus.

[0120] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0121] The memory 303 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the contents shown in the above method embodiment.

[0122] The electronic devices include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TVs, desktop computers, etc. It can also be a server, etc. Figure 3 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0123] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0124] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the method in any of the above embodiments is implemented.

[0125] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0126] The above is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A cluster-based security audit management method, characterized in that: include: Acquire multiple business data to be audited in the cluster, and identify data features in each business data to be audited, wherein the data features at least include data volume, data type, and associated data volume; Based on the data features in each business data to be audited, determine the feature hash value of each business data to be audited, and based on each feature hash value, determine the hash partition corresponding to the business data to be audited, each hash partition contains at least one business data to be audited; Based on all the business data to be audited contained in each hash partition, determine the security audit rules corresponding to each hash partition; Based on the security audit rules corresponding to each hash partition, perform security audit operations on the business data to be audited contained in each hash partition; Among them, based on all the business data to be audited contained in the hash partition, the security audit rules corresponding to the hash partition are determined, including: Identify the number of businesses corresponding to the business data to be audited in the hash partition, and when the number of businesses is higher than a first preset number, obtain historical audit records; Determine the characteristic impact rate of each data characteristic corresponding to each business data to be audited according to the historical audit records, and determine the characteristic information of each business data to be audited according to each data characteristic and the corresponding characteristic impact rate; Integrate all feature information to obtain target data features, where the number of feature types included in the target data features is greater than a second preset number; Determine the security audit rule corresponding to the hash partition according to the target data feature and rule mapping relationship, wherein the rule mapping relationship is the corresponding relationship between the feature type and the security audit rule; When there is business data to be audited in an associated relationship, it also includes: Determine the business data to be audited that have an associated relationship as a business data group to be audited, wherein the business data group to be audited includes at least two business data to be audited; Identify the business identifier corresponding to each business data to be audited in the business data group to be audited, and determine the business process corresponding to all business data to be audited in the business data group to be audited based on each business identifier; Determine the business role perspective of each business data to be audited in each business data group to be audited according to the business process, wherein the business role perspective includes a master perspective and a slave perspective; Obtaining security audit records corresponding to the business data group to be audited, and determining perspective audit records of each business role perspective of each business data to be audited based on the business role perspective of each business data to be audited; Based on the business role perspective of each business data to be audited and the perspective audit records of each business role perspective of each business data to be audited, determine the target audit record of each business data to be audited in the business data group to be audited, and provide feedback for each target audit record; Among them, based on the business role perspective of the business data to be audited and the perspective audit records of each business role perspective, the target audit records of the business data to be audited are determined, including: Determine a main drawing picture according to the main viewing angle of the business data to be audited, and render the content of the main drawing picture according to the viewing angle audit record corresponding to the main viewing angle to obtain a main rendering canvas; Determine a slave drawing picture according to the slave perspective of the business data to be audited, and render the content of the slave drawing picture according to the perspective audit record corresponding to the slave perspective to obtain a slave rendering canvas; A target audit record of the to-be-audited business data is determined according to the master rendering canvas and the slave rendering canvas.

2. According to claim 1, a cluster-based security audit management method is characterized in that: The step of integrating all feature information to obtain target data features includes: Identify the feature key-value pair corresponding to each data feature. The feature key-value pair includes the corresponding business data identifier to be audited and the corresponding feature impact rate. Each data feature contains at least one feature key-value pair. Generate a data feature matrix according to at least one feature key-value pair corresponding to each data feature, wherein the data feature matrix includes all data features and all feature key-value pairs corresponding to each data feature; The target data features are determined according to the data feature matrix.

3. A cluster-based security audit management method according to claim 2, characterized in that: The determining the target data feature according to the data feature matrix comprises: Identify a first most-valued data feature from the data feature matrix, where the first most-valued data feature is a data feature that contains the most feature key-value pairs in the data feature matrix; Eliminate the first maximum value data feature from the data feature matrix to obtain a first screening data feature matrix, and identify a second maximum value data feature from the first screening data feature matrix, where the second maximum value data feature is a data feature having a highest feature influence rate in the first screening data feature matrix; Eliminate the second maximum value data feature from the first screening data feature matrix to obtain a second screening data feature matrix, and determine supplementary data features from the second screening data feature matrix, wherein the supplementary data features are data features in which the number of feature key-value pairs in the second screening data feature matrix is ​​greater than a third preset number; According to the first maximum data feature, the second maximum data feature and the supplementary data feature, a target data feature corresponding to the data feature matrix is ​​determined.

4. An electronic device, characterized in that: The electronic device includes: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute a cluster-based security audit management method as described in any one of claims 1-3.

5. A computer-readable storage medium, characterized in that: include: A computer program is stored which can be loaded by a processor and execute a cluster-based security audit management method as described in any one of claims 1-3.

6. A computer program product, characterized in that It comprises a computer program, which, when executed by a processor, implements the steps of a cluster-based security audit management method according to any one of claims 1 to 3.

Images